SCARD

Suspicious activity by IP address 66.163.122.241

Below is a list of the last 500 suspicious interactions with this IP.

Last observed Tue, 04 Aug 2026 06:39:50 (Australia/Brisbane)

Back to main list

Summary of suspicious activity by IP address 66.163.122.241

Description Count
ET HUNTING Suspicious Chmod Usage in URI (Inbound) 221
ET WEB_SERVER WebShell Generic - wget http - POST 94
ET WEB_SPECIFIC_APPS GeoVision DateSetting.cgi szSrvIpAddr Parameter Command Injection Attempt 74
ET WEB_SPECIFIC_APPS TBK DVR-4104/4216 Command Injection Attempt (CVE-2024-3721) 72
SERVER-WEBAPP Netgear DGN1000 series routers authentication bypass attempt 62
ET SCAN Mirai Variant User-Agent (Inbound) 30
ET EXPLOIT HackingTrio UA (Hello, World) 30

Detailed activity by IP address 66.163.122.241

Timestamp Description Protocol Destination Port
2026-08-04 06:39:50 ET SCAN Mirai Variant User-Agent (Inbound) TCP 80
2026-08-04 06:39:50 ET EXPLOIT HackingTrio UA (Hello, World) TCP 80
2026-08-04 06:39:50 ET WEB_SERVER WebShell Generic - wget http - POST TCP 80
2026-08-04 06:39:50 ET WEB_SERVER WebShell Generic - wget http - POST TCP 80
2026-08-04 06:39:50 ET EXPLOIT HackingTrio UA (Hello, World) TCP 80
2026-08-04 06:39:50 ET SCAN Mirai Variant User-Agent (Inbound) TCP 80
2026-08-04 06:39:40 ET WEB_SERVER WebShell Generic - wget http - POST TCP 80
2026-08-04 06:39:40 ET WEB_SPECIFIC_APPS GeoVision DateSetting.cgi szSrvIpAddr Parameter Command Injection Attempt TCP 80
2026-08-04 06:39:40 SERVER-WEBAPP Netgear DGN1000 series routers authentication bypass attempt TCP 80
2026-08-04 06:39:40 SERVER-WEBAPP Netgear DGN1000 series routers authentication bypass attempt TCP 80
2026-08-04 06:39:40 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-04 06:39:40 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-04 06:39:40 ET WEB_SERVER WebShell Generic - wget http - POST TCP 80
2026-08-04 06:39:40 ET WEB_SPECIFIC_APPS GeoVision DateSetting.cgi szSrvIpAddr Parameter Command Injection Attempt TCP 80
2026-08-04 06:39:40 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-04 06:39:40 ET WEB_SPECIFIC_APPS TBK DVR-4104/4216 Command Injection Attempt (CVE-2024-3721) TCP 80
2026-08-04 06:39:40 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-04 06:39:40 ET WEB_SPECIFIC_APPS TBK DVR-4104/4216 Command Injection Attempt (CVE-2024-3721) TCP 80
2026-08-04 05:41:09 ET WEB_SPECIFIC_APPS GeoVision DateSetting.cgi szSrvIpAddr Parameter Command Injection Attempt TCP 80
2026-08-04 05:41:09 ET WEB_SPECIFIC_APPS TBK DVR-4104/4216 Command Injection Attempt (CVE-2024-3721) TCP 80
2026-08-04 05:41:09 SERVER-WEBAPP Netgear DGN1000 series routers authentication bypass attempt TCP 80
2026-08-04 05:41:09 ET WEB_SPECIFIC_APPS TBK DVR-4104/4216 Command Injection Attempt (CVE-2024-3721) TCP 80
2026-08-04 05:41:09 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-04 05:41:09 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-04 05:41:09 ET WEB_SERVER WebShell Generic - wget http - POST TCP 80
2026-08-04 05:41:09 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-04 05:41:09 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-04 05:41:09 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-04 05:41:09 ET WEB_SPECIFIC_APPS GeoVision DateSetting.cgi szSrvIpAddr Parameter Command Injection Attempt TCP 80
2026-08-04 05:41:09 SERVER-WEBAPP Netgear DGN1000 series routers authentication bypass attempt TCP 80
2026-08-04 05:41:09 ET WEB_SERVER WebShell Generic - wget http - POST TCP 80
2026-08-04 05:41:09 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-04 04:31:19 ET WEB_SERVER WebShell Generic - wget http - POST TCP 80
2026-08-04 04:31:19 ET WEB_SERVER WebShell Generic - wget http - POST TCP 80
2026-08-04 04:31:19 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-04 04:31:19 ET WEB_SPECIFIC_APPS TBK DVR-4104/4216 Command Injection Attempt (CVE-2024-3721) TCP 80
2026-08-04 04:31:19 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-04 04:31:19 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-04 04:31:19 ET WEB_SPECIFIC_APPS TBK DVR-4104/4216 Command Injection Attempt (CVE-2024-3721) TCP 80
2026-08-04 04:31:19 ET WEB_SPECIFIC_APPS GeoVision DateSetting.cgi szSrvIpAddr Parameter Command Injection Attempt TCP 80
2026-08-04 04:31:19 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-04 04:31:19 ET WEB_SPECIFIC_APPS GeoVision DateSetting.cgi szSrvIpAddr Parameter Command Injection Attempt TCP 80
2026-08-04 03:48:57 ET WEB_SPECIFIC_APPS TBK DVR-4104/4216 Command Injection Attempt (CVE-2024-3721) TCP 80
2026-08-04 03:48:57 ET EXPLOIT HackingTrio UA (Hello, World) TCP 80
2026-08-04 03:48:57 ET WEB_SERVER WebShell Generic - wget http - POST TCP 80
2026-08-04 03:48:57 ET SCAN Mirai Variant User-Agent (Inbound) TCP 80
2026-08-04 03:48:57 ET SCAN Mirai Variant User-Agent (Inbound) TCP 80
2026-08-04 03:48:57 ET WEB_SPECIFIC_APPS TBK DVR-4104/4216 Command Injection Attempt (CVE-2024-3721) TCP 80
2026-08-04 03:48:57 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-04 03:48:57 ET WEB_SERVER WebShell Generic - wget http - POST TCP 80
2026-08-04 03:48:57 ET EXPLOIT HackingTrio UA (Hello, World) TCP 80
2026-08-04 03:48:57 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-04 02:56:09 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-04 02:56:09 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-04 02:56:09 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-04 02:56:09 SERVER-WEBAPP Netgear DGN1000 series routers authentication bypass attempt TCP 80
2026-08-04 02:56:09 SERVER-WEBAPP Netgear DGN1000 series routers authentication bypass attempt TCP 80
2026-08-04 02:56:09 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-04 02:56:08 ET WEB_SPECIFIC_APPS GeoVision DateSetting.cgi szSrvIpAddr Parameter Command Injection Attempt TCP 80
2026-08-04 02:56:08 ET WEB_SERVER WebShell Generic - wget http - POST TCP 80
2026-08-04 02:56:08 ET WEB_SERVER WebShell Generic - wget http - POST TCP 80
2026-08-04 02:56:08 ET WEB_SPECIFIC_APPS GeoVision DateSetting.cgi szSrvIpAddr Parameter Command Injection Attempt TCP 80
2026-08-04 02:54:00 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 8080
2026-08-04 00:22:57 ET WEB_SERVER WebShell Generic - wget http - POST TCP 80
2026-08-04 00:22:57 ET WEB_SPECIFIC_APPS GeoVision DateSetting.cgi szSrvIpAddr Parameter Command Injection Attempt TCP 80
2026-08-04 00:22:57 ET WEB_SPECIFIC_APPS GeoVision DateSetting.cgi szSrvIpAddr Parameter Command Injection Attempt TCP 80
2026-08-04 00:22:57 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-04 00:22:57 ET WEB_SERVER WebShell Generic - wget http - POST TCP 80
2026-08-04 00:22:57 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-03 23:18:13 ET WEB_SPECIFIC_APPS GeoVision DateSetting.cgi szSrvIpAddr Parameter Command Injection Attempt TCP 80
2026-08-03 23:18:13 ET WEB_SERVER WebShell Generic - wget http - POST TCP 80
2026-08-03 23:18:13 ET WEB_SPECIFIC_APPS GeoVision DateSetting.cgi szSrvIpAddr Parameter Command Injection Attempt TCP 80
2026-08-03 23:18:13 ET WEB_SERVER WebShell Generic - wget http - POST TCP 80
2026-08-03 23:18:13 SERVER-WEBAPP Netgear DGN1000 series routers authentication bypass attempt TCP 80
2026-08-03 23:18:13 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-03 23:18:13 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-03 23:18:13 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-03 23:18:13 ET WEB_SPECIFIC_APPS TBK DVR-4104/4216 Command Injection Attempt (CVE-2024-3721) TCP 80
2026-08-03 23:18:13 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-03 23:18:13 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-03 23:18:13 ET WEB_SPECIFIC_APPS TBK DVR-4104/4216 Command Injection Attempt (CVE-2024-3721) TCP 80
2026-08-03 23:18:13 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-03 23:18:13 SERVER-WEBAPP Netgear DGN1000 series routers authentication bypass attempt TCP 80
2026-08-03 23:14:26 ET EXPLOIT HackingTrio UA (Hello, World) TCP 80
2026-08-03 23:14:26 ET WEB_SPECIFIC_APPS TBK DVR-4104/4216 Command Injection Attempt (CVE-2024-3721) TCP 80
2026-08-03 23:14:26 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-03 23:14:26 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-03 23:14:26 ET WEB_SPECIFIC_APPS GeoVision DateSetting.cgi szSrvIpAddr Parameter Command Injection Attempt TCP 80
2026-08-03 23:14:26 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-03 23:14:26 ET SCAN Mirai Variant User-Agent (Inbound) TCP 80
2026-08-03 21:58:24 ET WEB_SPECIFIC_APPS TBK DVR-4104/4216 Command Injection Attempt (CVE-2024-3721) TCP 80
2026-08-03 21:58:24 ET WEB_SPECIFIC_APPS TBK DVR-4104/4216 Command Injection Attempt (CVE-2024-3721) TCP 80
2026-08-03 21:58:24 ET SCAN Mirai Variant User-Agent (Inbound) TCP 80
2026-08-03 21:58:24 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-03 21:58:24 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-03 21:58:24 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-03 21:58:24 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-03 21:58:24 ET SCAN Mirai Variant User-Agent (Inbound) TCP 80
2026-08-03 21:58:24 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-03 21:58:24 ET EXPLOIT HackingTrio UA (Hello, World) TCP 80
2026-08-03 21:58:24 ET WEB_SERVER WebShell Generic - wget http - POST TCP 80
2026-08-03 21:58:24 ET WEB_SERVER WebShell Generic - wget http - POST TCP 80
2026-08-03 21:58:24 SERVER-WEBAPP Netgear DGN1000 series routers authentication bypass attempt TCP 80
2026-08-03 21:58:24 ET WEB_SPECIFIC_APPS GeoVision DateSetting.cgi szSrvIpAddr Parameter Command Injection Attempt TCP 80
2026-08-03 21:58:24 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-03 21:58:24 ET EXPLOIT HackingTrio UA (Hello, World) TCP 80
2026-08-03 21:58:24 ET WEB_SERVER WebShell Generic - wget http - POST TCP 80
2026-08-03 21:58:24 ET WEB_SERVER WebShell Generic - wget http - POST TCP 80
2026-08-03 21:58:24 ET WEB_SPECIFIC_APPS GeoVision DateSetting.cgi szSrvIpAddr Parameter Command Injection Attempt TCP 80
2026-08-03 21:58:24 SERVER-WEBAPP Netgear DGN1000 series routers authentication bypass attempt TCP 80
2026-08-03 21:56:04 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-03 21:56:04 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-03 21:56:04 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-03 21:56:04 ET WEB_SPECIFIC_APPS GeoVision DateSetting.cgi szSrvIpAddr Parameter Command Injection Attempt TCP 80
2026-08-03 21:56:04 ET WEB_SPECIFIC_APPS TBK DVR-4104/4216 Command Injection Attempt (CVE-2024-3721) TCP 80
2026-08-03 21:56:04 ET SCAN Mirai Variant User-Agent (Inbound) TCP 80
2026-08-03 21:56:04 ET EXPLOIT HackingTrio UA (Hello, World) TCP 80
2026-08-03 19:47:49 ET WEB_SERVER WebShell Generic - wget http - POST TCP 80
2026-08-03 19:47:49 ET EXPLOIT HackingTrio UA (Hello, World) TCP 80
2026-08-03 19:47:49 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-03 19:47:49 ET WEB_SPECIFIC_APPS TBK DVR-4104/4216 Command Injection Attempt (CVE-2024-3721) TCP 80
2026-08-03 19:47:49 ET WEB_SERVER WebShell Generic - wget http - POST TCP 80
2026-08-03 19:47:49 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-03 19:47:49 ET SCAN Mirai Variant User-Agent (Inbound) TCP 80
2026-08-03 19:47:49 ET WEB_SERVER WebShell Generic - wget http - POST TCP 80
2026-08-03 19:47:49 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-03 19:47:49 ET WEB_SERVER WebShell Generic - wget http - POST TCP 80
2026-08-03 19:47:49 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-03 19:47:49 ET WEB_SPECIFIC_APPS GeoVision DateSetting.cgi szSrvIpAddr Parameter Command Injection Attempt TCP 80
2026-08-03 19:47:49 ET WEB_SPECIFIC_APPS GeoVision DateSetting.cgi szSrvIpAddr Parameter Command Injection Attempt TCP 80
2026-08-03 19:47:49 ET SCAN Mirai Variant User-Agent (Inbound) TCP 80
2026-08-03 19:47:49 SERVER-WEBAPP Netgear DGN1000 series routers authentication bypass attempt TCP 80
2026-08-03 19:47:49 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-03 19:47:49 SERVER-WEBAPP Netgear DGN1000 series routers authentication bypass attempt TCP 80
2026-08-03 19:47:49 ET WEB_SPECIFIC_APPS TBK DVR-4104/4216 Command Injection Attempt (CVE-2024-3721) TCP 80
2026-08-03 19:47:49 ET EXPLOIT HackingTrio UA (Hello, World) TCP 80
2026-08-03 19:47:49 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-03 19:29:02 ET WEB_SPECIFIC_APPS TBK DVR-4104/4216 Command Injection Attempt (CVE-2024-3721) TCP 80
2026-08-03 19:29:02 ET WEB_SERVER WebShell Generic - wget http - POST TCP 80
2026-08-03 19:29:02 ET SCAN Mirai Variant User-Agent (Inbound) TCP 80
2026-08-03 19:29:02 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-03 19:29:02 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-03 19:29:02 SERVER-WEBAPP Netgear DGN1000 series routers authentication bypass attempt TCP 80
2026-08-03 19:29:02 ET WEB_SPECIFIC_APPS TBK DVR-4104/4216 Command Injection Attempt (CVE-2024-3721) TCP 80
2026-08-03 19:29:02 ET EXPLOIT HackingTrio UA (Hello, World) TCP 80
2026-08-03 19:29:02 SERVER-WEBAPP Netgear DGN1000 series routers authentication bypass attempt TCP 80
2026-08-03 19:29:02 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-03 19:29:02 ET WEB_SERVER WebShell Generic - wget http - POST TCP 80
2026-08-03 19:29:02 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-03 19:29:02 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-03 19:29:02 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-03 19:29:02 ET EXPLOIT HackingTrio UA (Hello, World) TCP 80
2026-08-03 19:29:02 ET SCAN Mirai Variant User-Agent (Inbound) TCP 80
2026-08-03 17:04:23 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-03 17:04:23 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-03 17:04:23 ET WEB_SERVER WebShell Generic - wget http - POST TCP 80
2026-08-03 17:04:23 ET WEB_SPECIFIC_APPS TBK DVR-4104/4216 Command Injection Attempt (CVE-2024-3721) TCP 80
2026-08-03 17:04:23 SERVER-WEBAPP Netgear DGN1000 series routers authentication bypass attempt TCP 80
2026-08-03 17:04:23 ET WEB_SPECIFIC_APPS TBK DVR-4104/4216 Command Injection Attempt (CVE-2024-3721) TCP 80
2026-08-03 17:04:23 ET WEB_SPECIFIC_APPS GeoVision DateSetting.cgi szSrvIpAddr Parameter Command Injection Attempt TCP 80
2026-08-03 17:04:23 ET WEB_SPECIFIC_APPS GeoVision DateSetting.cgi szSrvIpAddr Parameter Command Injection Attempt TCP 80
2026-08-03 17:04:23 SERVER-WEBAPP Netgear DGN1000 series routers authentication bypass attempt TCP 80
2026-08-03 17:04:23 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-03 17:04:23 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-03 17:04:23 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-03 17:04:23 ET WEB_SERVER WebShell Generic - wget http - POST TCP 80
2026-08-03 17:04:23 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-03 16:44:25 ET SCAN Mirai Variant User-Agent (Inbound) TCP 80
2026-08-03 16:44:25 ET EXPLOIT HackingTrio UA (Hello, World) TCP 80
2026-08-03 16:44:25 ET SCAN Mirai Variant User-Agent (Inbound) TCP 80
2026-08-03 16:44:25 ET WEB_SPECIFIC_APPS TBK DVR-4104/4216 Command Injection Attempt (CVE-2024-3721) TCP 80
2026-08-03 16:44:25 ET WEB_SPECIFIC_APPS TBK DVR-4104/4216 Command Injection Attempt (CVE-2024-3721) TCP 80
2026-08-03 16:44:25 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-03 16:44:25 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-03 16:44:25 ET WEB_SERVER WebShell Generic - wget http - POST TCP 80
2026-08-03 16:44:25 ET WEB_SERVER WebShell Generic - wget http - POST TCP 80
2026-08-03 16:44:25 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-03 16:44:25 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-03 16:44:25 ET EXPLOIT HackingTrio UA (Hello, World) TCP 80
2026-08-03 15:40:15 ET EXPLOIT HackingTrio UA (Hello, World) TCP 80
2026-08-03 15:40:15 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-03 15:40:15 ET WEB_SPECIFIC_APPS GeoVision DateSetting.cgi szSrvIpAddr Parameter Command Injection Attempt TCP 80
2026-08-03 15:40:15 ET EXPLOIT HackingTrio UA (Hello, World) TCP 80
2026-08-03 15:40:15 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-03 15:40:15 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-03 15:40:15 ET WEB_SERVER WebShell Generic - wget http - POST TCP 80
2026-08-03 15:40:15 ET WEB_SERVER WebShell Generic - wget http - POST TCP 80
2026-08-03 15:40:15 SERVER-WEBAPP Netgear DGN1000 series routers authentication bypass attempt TCP 80
2026-08-03 15:40:15 ET SCAN Mirai Variant User-Agent (Inbound) TCP 80
2026-08-03 15:40:15 ET WEB_SERVER WebShell Generic - wget http - POST TCP 80
2026-08-03 15:40:15 ET SCAN Mirai Variant User-Agent (Inbound) TCP 80
2026-08-03 15:40:15 ET WEB_SPECIFIC_APPS TBK DVR-4104/4216 Command Injection Attempt (CVE-2024-3721) TCP 80
2026-08-03 15:40:15 ET WEB_SPECIFIC_APPS GeoVision DateSetting.cgi szSrvIpAddr Parameter Command Injection Attempt TCP 80
2026-08-03 15:40:15 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-03 15:40:15 SERVER-WEBAPP Netgear DGN1000 series routers authentication bypass attempt TCP 80
2026-08-03 15:40:15 ET WEB_SPECIFIC_APPS TBK DVR-4104/4216 Command Injection Attempt (CVE-2024-3721) TCP 80
2026-08-03 15:40:15 ET WEB_SERVER WebShell Generic - wget http - POST TCP 80
2026-08-03 15:40:15 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-03 15:40:15 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-03 14:20:21 ET WEB_SPECIFIC_APPS TBK DVR-4104/4216 Command Injection Attempt (CVE-2024-3721) TCP 80
2026-08-03 14:20:21 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-03 14:20:21 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-03 14:16:42 SERVER-WEBAPP Netgear DGN1000 series routers authentication bypass attempt TCP 80
2026-08-03 14:16:42 ET WEB_SERVER WebShell Generic - wget http - POST TCP 80
2026-08-03 14:16:42 ET WEB_SPECIFIC_APPS GeoVision DateSetting.cgi szSrvIpAddr Parameter Command Injection Attempt TCP 80
2026-08-03 14:16:42 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-03 14:16:42 ET WEB_SERVER WebShell Generic - wget http - POST TCP 80
2026-08-03 14:16:42 SERVER-WEBAPP Netgear DGN1000 series routers authentication bypass attempt TCP 80
2026-08-03 14:16:42 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-03 14:16:42 ET WEB_SPECIFIC_APPS GeoVision DateSetting.cgi szSrvIpAddr Parameter Command Injection Attempt TCP 80
2026-08-03 14:16:42 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-03 14:16:42 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-03 13:08:50 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-03 13:08:50 ET WEB_SPECIFIC_APPS TBK DVR-4104/4216 Command Injection Attempt (CVE-2024-3721) TCP 80
2026-08-03 13:08:50 ET WEB_SPECIFIC_APPS TBK DVR-4104/4216 Command Injection Attempt (CVE-2024-3721) TCP 80
2026-08-03 13:08:50 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-03 13:08:50 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-03 13:08:50 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-03 13:08:50 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-03 13:08:50 SERVER-WEBAPP Netgear DGN1000 series routers authentication bypass attempt TCP 80
2026-08-03 13:08:50 SERVER-WEBAPP Netgear DGN1000 series routers authentication bypass attempt TCP 80
2026-08-03 13:08:50 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-03 12:19:54 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 8080
2026-08-03 12:19:54 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 8080
2026-08-03 11:38:49 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 8080
2026-08-03 11:38:49 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 8080
2026-08-03 10:51:48 ET WEB_SERVER WebShell Generic - wget http - POST TCP 80
2026-08-03 10:51:48 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-03 10:51:48 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-03 10:51:48 ET WEB_SERVER WebShell Generic - wget http - POST TCP 80
2026-08-03 10:51:48 ET WEB_SERVER WebShell Generic - wget http - POST TCP 80
2026-08-03 10:51:48 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-03 10:51:48 ET WEB_SERVER WebShell Generic - wget http - POST TCP 80
2026-08-03 10:51:48 ET WEB_SPECIFIC_APPS TBK DVR-4104/4216 Command Injection Attempt (CVE-2024-3721) TCP 80
2026-08-03 10:51:48 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-03 10:51:48 ET EXPLOIT HackingTrio UA (Hello, World) TCP 80
2026-08-03 10:51:48 ET WEB_SPECIFIC_APPS GeoVision DateSetting.cgi szSrvIpAddr Parameter Command Injection Attempt TCP 80
2026-08-03 10:51:48 ET SCAN Mirai Variant User-Agent (Inbound) TCP 80
2026-08-03 10:51:48 SERVER-WEBAPP Netgear DGN1000 series routers authentication bypass attempt TCP 80
2026-08-03 10:51:48 ET EXPLOIT HackingTrio UA (Hello, World) TCP 80
2026-08-03 10:51:48 ET WEB_SPECIFIC_APPS GeoVision DateSetting.cgi szSrvIpAddr Parameter Command Injection Attempt TCP 80
2026-08-03 10:51:48 ET WEB_SPECIFIC_APPS TBK DVR-4104/4216 Command Injection Attempt (CVE-2024-3721) TCP 80
2026-08-03 10:51:48 ET SCAN Mirai Variant User-Agent (Inbound) TCP 80
2026-08-03 10:51:48 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-03 10:51:48 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-03 10:51:48 SERVER-WEBAPP Netgear DGN1000 series routers authentication bypass attempt TCP 80
2026-08-03 10:35:30 ET WEB_SPECIFIC_APPS TBK DVR-4104/4216 Command Injection Attempt (CVE-2024-3721) TCP 80
2026-08-03 10:35:30 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-03 10:35:30 ET WEB_SPECIFIC_APPS GeoVision DateSetting.cgi szSrvIpAddr Parameter Command Injection Attempt TCP 80
2026-08-03 10:35:30 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-03 10:35:30 ET WEB_SERVER WebShell Generic - wget http - POST TCP 80
2026-08-03 10:35:30 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-03 10:35:30 ET WEB_SERVER WebShell Generic - wget http - POST TCP 80
2026-08-03 10:35:30 ET WEB_SERVER WebShell Generic - wget http - POST TCP 80
2026-08-03 10:35:30 ET WEB_SPECIFIC_APPS GeoVision DateSetting.cgi szSrvIpAddr Parameter Command Injection Attempt TCP 80
2026-08-03 10:35:30 ET WEB_SERVER WebShell Generic - wget http - POST TCP 80
2026-08-03 10:35:30 ET WEB_SPECIFIC_APPS TBK DVR-4104/4216 Command Injection Attempt (CVE-2024-3721) TCP 80
2026-08-03 10:35:30 ET SCAN Mirai Variant User-Agent (Inbound) TCP 80
2026-08-03 10:35:30 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-03 10:35:30 ET SCAN Mirai Variant User-Agent (Inbound) TCP 80
2026-08-03 10:35:30 ET EXPLOIT HackingTrio UA (Hello, World) TCP 80
2026-08-03 10:35:30 ET EXPLOIT HackingTrio UA (Hello, World) TCP 80
2026-08-03 10:25:04 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 8080
2026-08-03 08:05:04 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-03 08:05:04 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-03 08:05:04 SERVER-WEBAPP Netgear DGN1000 series routers authentication bypass attempt TCP 80
2026-08-03 08:05:04 SERVER-WEBAPP Netgear DGN1000 series routers authentication bypass attempt TCP 80
2026-08-03 08:05:04 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-03 08:05:04 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-03 08:05:04 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-03 08:05:04 ET WEB_SPECIFIC_APPS TBK DVR-4104/4216 Command Injection Attempt (CVE-2024-3721) TCP 80
2026-08-03 08:05:04 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-03 08:05:04 ET WEB_SPECIFIC_APPS TBK DVR-4104/4216 Command Injection Attempt (CVE-2024-3721) TCP 80
2026-08-03 07:41:40 ET WEB_SERVER WebShell Generic - wget http - POST TCP 80
2026-08-03 07:41:40 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-03 07:41:40 ET WEB_SPECIFIC_APPS GeoVision DateSetting.cgi szSrvIpAddr Parameter Command Injection Attempt TCP 80
2026-08-03 07:41:40 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-03 07:41:40 ET WEB_SERVER WebShell Generic - wget http - POST TCP 80
2026-08-03 07:41:40 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-03 07:41:40 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-03 07:41:40 SERVER-WEBAPP Netgear DGN1000 series routers authentication bypass attempt TCP 80
2026-08-03 07:41:40 SERVER-WEBAPP Netgear DGN1000 series routers authentication bypass attempt TCP 80
2026-08-03 07:41:40 ET WEB_SPECIFIC_APPS GeoVision DateSetting.cgi szSrvIpAddr Parameter Command Injection Attempt TCP 80
2026-08-03 05:43:23 ET SCAN Mirai Variant User-Agent (Inbound) TCP 80
2026-08-03 05:43:23 ET EXPLOIT HackingTrio UA (Hello, World) TCP 80
2026-08-03 05:43:23 ET WEB_SPECIFIC_APPS TBK DVR-4104/4216 Command Injection Attempt (CVE-2024-3721) TCP 80
2026-08-03 05:43:23 ET WEB_SPECIFIC_APPS GeoVision DateSetting.cgi szSrvIpAddr Parameter Command Injection Attempt TCP 80
2026-08-03 05:43:23 ET WEB_SERVER WebShell Generic - wget http - POST TCP 80
2026-08-03 05:43:23 ET WEB_SERVER WebShell Generic - wget http - POST TCP 80
2026-08-03 05:43:23 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-03 05:43:23 ET WEB_SPECIFIC_APPS GeoVision DateSetting.cgi szSrvIpAddr Parameter Command Injection Attempt TCP 80
2026-08-03 05:43:23 ET SCAN Mirai Variant User-Agent (Inbound) TCP 80
2026-08-03 05:43:23 ET WEB_SPECIFIC_APPS TBK DVR-4104/4216 Command Injection Attempt (CVE-2024-3721) TCP 80
2026-08-03 05:43:23 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-03 05:43:23 ET WEB_SERVER WebShell Generic - wget http - POST TCP 80
2026-08-03 05:43:23 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-03 05:43:23 ET WEB_SERVER WebShell Generic - wget http - POST TCP 80
2026-08-03 05:43:23 ET EXPLOIT HackingTrio UA (Hello, World) TCP 80
2026-08-03 05:43:23 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-03 05:25:56 SERVER-WEBAPP Netgear DGN1000 series routers authentication bypass attempt TCP 80
2026-08-03 05:25:56 ET EXPLOIT HackingTrio UA (Hello, World) TCP 80
2026-08-03 05:25:56 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-03 05:25:56 ET EXPLOIT HackingTrio UA (Hello, World) TCP 80
2026-08-03 05:25:56 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-03 05:25:56 ET WEB_SERVER WebShell Generic - wget http - POST TCP 80
2026-08-03 05:25:56 ET SCAN Mirai Variant User-Agent (Inbound) TCP 80
2026-08-03 05:25:56 ET WEB_SERVER WebShell Generic - wget http - POST TCP 80
2026-08-03 05:25:56 SERVER-WEBAPP Netgear DGN1000 series routers authentication bypass attempt TCP 80
2026-08-03 05:25:56 ET SCAN Mirai Variant User-Agent (Inbound) TCP 80
2026-08-03 02:45:33 ET WEB_SERVER WebShell Generic - wget http - POST TCP 80
2026-08-03 02:45:33 ET WEB_SPECIFIC_APPS TBK DVR-4104/4216 Command Injection Attempt (CVE-2024-3721) TCP 80
2026-08-03 02:45:33 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-03 02:45:33 ET WEB_SERVER WebShell Generic - wget http - POST TCP 80
2026-08-03 02:45:33 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-03 02:45:33 SERVER-WEBAPP Netgear DGN1000 series routers authentication bypass attempt TCP 80
2026-08-03 02:45:33 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-03 02:45:33 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-03 02:45:33 SERVER-WEBAPP Netgear DGN1000 series routers authentication bypass attempt TCP 80
2026-08-03 02:45:33 ET SCAN Mirai Variant User-Agent (Inbound) TCP 80
2026-08-03 02:45:33 ET EXPLOIT HackingTrio UA (Hello, World) TCP 80
2026-08-03 02:45:33 ET SCAN Mirai Variant User-Agent (Inbound) TCP 80
2026-08-03 02:45:33 ET EXPLOIT HackingTrio UA (Hello, World) TCP 80
2026-08-03 02:45:33 ET WEB_SPECIFIC_APPS TBK DVR-4104/4216 Command Injection Attempt (CVE-2024-3721) TCP 80
2026-08-03 02:07:12 ET SCAN Mirai Variant User-Agent (Inbound) TCP 80
2026-08-03 02:07:12 ET WEB_SERVER WebShell Generic - wget http - POST TCP 80
2026-08-03 02:07:12 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-03 02:07:12 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-03 02:07:12 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-03 02:07:12 ET EXPLOIT HackingTrio UA (Hello, World) TCP 80
2026-08-03 02:07:12 ET WEB_SERVER WebShell Generic - wget http - POST TCP 80
2026-08-03 02:07:12 ET WEB_SPECIFIC_APPS TBK DVR-4104/4216 Command Injection Attempt (CVE-2024-3721) TCP 80
2026-08-03 02:07:12 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-03 02:07:12 ET WEB_SPECIFIC_APPS TBK DVR-4104/4216 Command Injection Attempt (CVE-2024-3721) TCP 80
2026-08-03 02:07:12 ET EXPLOIT HackingTrio UA (Hello, World) TCP 80
2026-08-03 02:07:12 ET SCAN Mirai Variant User-Agent (Inbound) TCP 80
2026-08-03 01:41:08 ET EXPLOIT HackingTrio UA (Hello, World) TCP 80
2026-08-03 01:41:08 ET WEB_SERVER WebShell Generic - wget http - POST TCP 80
2026-08-03 01:41:08 ET WEB_SERVER WebShell Generic - wget http - POST TCP 80
2026-08-03 01:41:08 ET SCAN Mirai Variant User-Agent (Inbound) TCP 80
2026-08-03 01:41:08 ET SCAN Mirai Variant User-Agent (Inbound) TCP 80
2026-08-03 01:41:08 ET EXPLOIT HackingTrio UA (Hello, World) TCP 80
2026-08-03 00:05:36 SERVER-WEBAPP Netgear DGN1000 series routers authentication bypass attempt TCP 80
2026-08-03 00:05:36 SERVER-WEBAPP Netgear DGN1000 series routers authentication bypass attempt TCP 80
2026-08-03 00:05:36 ET WEB_SERVER WebShell Generic - wget http - POST TCP 80
2026-08-03 00:05:36 ET WEB_SPECIFIC_APPS GeoVision DateSetting.cgi szSrvIpAddr Parameter Command Injection Attempt TCP 80
2026-08-03 00:05:36 ET WEB_SERVER WebShell Generic - wget http - POST TCP 80
2026-08-03 00:05:36 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-03 00:05:36 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-03 00:05:36 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-03 00:05:36 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-03 00:05:36 ET WEB_SPECIFIC_APPS GeoVision DateSetting.cgi szSrvIpAddr Parameter Command Injection Attempt TCP 80
2026-08-02 23:11:38 ET WEB_SPECIFIC_APPS TBK DVR-4104/4216 Command Injection Attempt (CVE-2024-3721) TCP 80
2026-08-02 23:11:38 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-02 23:11:38 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-02 22:26:02 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-02 22:26:02 ET WEB_SPECIFIC_APPS GeoVision DateSetting.cgi szSrvIpAddr Parameter Command Injection Attempt TCP 80
2026-08-02 22:26:02 ET WEB_SERVER WebShell Generic - wget http - POST TCP 80
2026-08-02 22:26:02 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-02 22:26:02 ET WEB_SPECIFIC_APPS GeoVision DateSetting.cgi szSrvIpAddr Parameter Command Injection Attempt TCP 80
2026-08-02 22:26:02 ET WEB_SERVER WebShell Generic - wget http - POST TCP 80
2026-08-02 21:19:20 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-02 21:19:20 ET WEB_SPECIFIC_APPS GeoVision DateSetting.cgi szSrvIpAddr Parameter Command Injection Attempt TCP 80
2026-08-02 21:19:20 ET WEB_SERVER WebShell Generic - wget http - POST TCP 80
2026-08-02 21:19:20 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-02 21:19:20 ET WEB_SPECIFIC_APPS GeoVision DateSetting.cgi szSrvIpAddr Parameter Command Injection Attempt TCP 80
2026-08-02 21:19:20 ET WEB_SERVER WebShell Generic - wget http - POST TCP 80
2026-08-02 20:57:48 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-02 20:57:48 ET WEB_SERVER WebShell Generic - wget http - POST TCP 80
2026-08-02 20:57:48 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-02 20:57:48 ET WEB_SPECIFIC_APPS TBK DVR-4104/4216 Command Injection Attempt (CVE-2024-3721) TCP 80
2026-08-02 20:57:48 ET WEB_SPECIFIC_APPS GeoVision DateSetting.cgi szSrvIpAddr Parameter Command Injection Attempt TCP 80
2026-08-02 20:57:48 ET WEB_SERVER WebShell Generic - wget http - POST TCP 80
2026-08-02 20:57:48 ET WEB_SPECIFIC_APPS TBK DVR-4104/4216 Command Injection Attempt (CVE-2024-3721) TCP 80
2026-08-02 20:57:48 ET WEB_SPECIFIC_APPS GeoVision DateSetting.cgi szSrvIpAddr Parameter Command Injection Attempt TCP 80
2026-08-02 19:47:20 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-02 19:47:20 ET WEB_SERVER WebShell Generic - wget http - POST TCP 80
2026-08-02 19:47:20 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-02 19:47:20 ET WEB_SERVER WebShell Generic - wget http - POST TCP 80
2026-08-02 19:47:20 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-02 19:47:20 ET WEB_SPECIFIC_APPS TBK DVR-4104/4216 Command Injection Attempt (CVE-2024-3721) TCP 80
2026-08-02 19:47:20 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-02 19:47:20 ET WEB_SPECIFIC_APPS TBK DVR-4104/4216 Command Injection Attempt (CVE-2024-3721) TCP 80
2026-08-02 19:47:20 ET WEB_SPECIFIC_APPS GeoVision DateSetting.cgi szSrvIpAddr Parameter Command Injection Attempt TCP 80
2026-08-02 19:47:20 ET WEB_SPECIFIC_APPS GeoVision DateSetting.cgi szSrvIpAddr Parameter Command Injection Attempt TCP 80
2026-08-02 19:47:20 SERVER-WEBAPP Netgear DGN1000 series routers authentication bypass attempt TCP 80
2026-08-02 19:47:20 SERVER-WEBAPP Netgear DGN1000 series routers authentication bypass attempt TCP 80
2026-08-02 19:33:49 ET WEB_SPECIFIC_APPS GeoVision DateSetting.cgi szSrvIpAddr Parameter Command Injection Attempt TCP 80
2026-08-02 19:33:49 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-02 19:33:49 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-02 19:33:49 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-02 19:33:49 ET WEB_SPECIFIC_APPS TBK DVR-4104/4216 Command Injection Attempt (CVE-2024-3721) TCP 80
2026-08-02 19:20:03 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-02 19:20:03 SERVER-WEBAPP Netgear DGN1000 series routers authentication bypass attempt TCP 80
2026-08-02 19:20:03 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-02 19:20:03 ET WEB_SPECIFIC_APPS TBK DVR-4104/4216 Command Injection Attempt (CVE-2024-3721) TCP 80
2026-08-02 19:20:03 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-02 19:20:03 ET WEB_SERVER WebShell Generic - wget http - POST TCP 80
2026-08-02 19:20:03 ET WEB_SPECIFIC_APPS GeoVision DateSetting.cgi szSrvIpAddr Parameter Command Injection Attempt TCP 80
2026-08-02 19:20:03 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-02 19:20:03 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-02 19:20:03 ET WEB_SPECIFIC_APPS TBK DVR-4104/4216 Command Injection Attempt (CVE-2024-3721) TCP 80
2026-08-02 19:20:03 ET WEB_SPECIFIC_APPS GeoVision DateSetting.cgi szSrvIpAddr Parameter Command Injection Attempt TCP 80
2026-08-02 19:20:03 SERVER-WEBAPP Netgear DGN1000 series routers authentication bypass attempt TCP 80
2026-08-02 19:20:03 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-02 19:20:03 ET WEB_SERVER WebShell Generic - wget http - POST TCP 80
2026-08-02 16:52:29 ET WEB_SERVER WebShell Generic - wget http - POST TCP 80
2026-08-02 16:52:29 ET WEB_SERVER WebShell Generic - wget http - POST TCP 80
2026-08-02 16:52:29 ET WEB_SPECIFIC_APPS GeoVision DateSetting.cgi szSrvIpAddr Parameter Command Injection Attempt TCP 80
2026-08-02 16:52:29 ET WEB_SPECIFIC_APPS GeoVision DateSetting.cgi szSrvIpAddr Parameter Command Injection Attempt TCP 80
2026-08-02 16:52:20 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-02 16:52:20 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-02 16:52:20 ET WEB_SPECIFIC_APPS TBK DVR-4104/4216 Command Injection Attempt (CVE-2024-3721) TCP 80
2026-08-02 16:52:20 SERVER-WEBAPP Netgear DGN1000 series routers authentication bypass attempt TCP 80
2026-08-02 16:52:20 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-02 16:52:20 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-02 16:52:20 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-02 16:52:20 SERVER-WEBAPP Netgear DGN1000 series routers authentication bypass attempt TCP 80
2026-08-02 16:52:20 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-02 16:52:20 ET WEB_SPECIFIC_APPS TBK DVR-4104/4216 Command Injection Attempt (CVE-2024-3721) TCP 80
2026-08-02 16:28:40 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-02 16:28:40 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-02 16:28:40 ET WEB_SPECIFIC_APPS TBK DVR-4104/4216 Command Injection Attempt (CVE-2024-3721) TCP 80
2026-08-02 16:28:40 SERVER-WEBAPP Netgear DGN1000 series routers authentication bypass attempt TCP 80
2026-08-02 16:28:40 SERVER-WEBAPP Netgear DGN1000 series routers authentication bypass attempt TCP 80
2026-08-02 16:28:40 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-02 16:28:40 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-02 16:28:40 ET WEB_SPECIFIC_APPS TBK DVR-4104/4216 Command Injection Attempt (CVE-2024-3721) TCP 80
2026-08-02 16:28:40 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-02 16:28:40 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-02 16:08:10 ET WEB_SERVER WebShell Generic - wget http - POST TCP 80
2026-08-02 16:08:10 ET WEB_SPECIFIC_APPS GeoVision DateSetting.cgi szSrvIpAddr Parameter Command Injection Attempt TCP 80
2026-08-02 16:08:10 ET WEB_SERVER WebShell Generic - wget http - POST TCP 80
2026-08-02 16:08:10 ET WEB_SPECIFIC_APPS GeoVision DateSetting.cgi szSrvIpAddr Parameter Command Injection Attempt TCP 80
2026-08-02 16:08:09 SERVER-WEBAPP Netgear DGN1000 series routers authentication bypass attempt TCP 80
2026-08-02 16:08:09 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-02 16:08:09 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-02 16:08:09 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-02 16:08:09 SERVER-WEBAPP Netgear DGN1000 series routers authentication bypass attempt TCP 80
2026-08-02 16:08:09 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-02 15:43:18 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-02 15:43:18 SERVER-WEBAPP Netgear DGN1000 series routers authentication bypass attempt TCP 80
2026-08-02 15:43:18 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-02 15:43:18 SERVER-WEBAPP Netgear DGN1000 series routers authentication bypass attempt TCP 80
2026-08-02 15:43:18 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-02 15:43:18 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-02 15:26:43 ET WEB_SPECIFIC_APPS TBK DVR-4104/4216 Command Injection Attempt (CVE-2024-3721) TCP 80
2026-08-02 15:26:43 ET WEB_SPECIFIC_APPS GeoVision DateSetting.cgi szSrvIpAddr Parameter Command Injection Attempt TCP 80
2026-08-02 15:26:43 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-02 15:26:43 ET WEB_SPECIFIC_APPS GeoVision DateSetting.cgi szSrvIpAddr Parameter Command Injection Attempt TCP 80
2026-08-02 15:26:43 SERVER-WEBAPP Netgear DGN1000 series routers authentication bypass attempt TCP 80
2026-08-02 15:26:43 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-02 15:26:43 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-02 15:26:43 ET WEB_SERVER WebShell Generic - wget http - POST TCP 80
2026-08-02 15:26:43 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-02 15:26:43 SERVER-WEBAPP Netgear DGN1000 series routers authentication bypass attempt TCP 80
2026-08-02 15:26:43 ET WEB_SERVER WebShell Generic - wget http - POST TCP 80
2026-08-02 15:26:43 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-02 15:26:43 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-02 15:26:43 ET WEB_SPECIFIC_APPS TBK DVR-4104/4216 Command Injection Attempt (CVE-2024-3721) TCP 80
2026-08-02 14:59:00 ET WEB_SPECIFIC_APPS TBK DVR-4104/4216 Command Injection Attempt (CVE-2024-3721) TCP 80
2026-08-02 14:59:00 ET WEB_SPECIFIC_APPS TBK DVR-4104/4216 Command Injection Attempt (CVE-2024-3721) TCP 80
2026-08-02 14:59:00 ET WEB_SPECIFIC_APPS GeoVision DateSetting.cgi szSrvIpAddr Parameter Command Injection Attempt TCP 80
2026-08-02 14:59:00 ET WEB_SERVER WebShell Generic - wget http - POST TCP 80
2026-08-02 14:59:00 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-02 14:59:00 ET WEB_SPECIFIC_APPS GeoVision DateSetting.cgi szSrvIpAddr Parameter Command Injection Attempt TCP 80
2026-08-02 14:59:00 ET WEB_SERVER WebShell Generic - wget http - POST TCP 80
2026-08-02 14:59:00 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-02 11:06:38 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-02 11:06:38 ET WEB_SPECIFIC_APPS TBK DVR-4104/4216 Command Injection Attempt (CVE-2024-3721) TCP 80
2026-08-02 11:06:38 ET WEB_SPECIFIC_APPS GeoVision DateSetting.cgi szSrvIpAddr Parameter Command Injection Attempt TCP 80
2026-08-02 11:06:38 ET WEB_SERVER WebShell Generic - wget http - POST TCP 80
2026-08-02 11:06:38 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-02 11:06:38 ET WEB_SPECIFIC_APPS GeoVision DateSetting.cgi szSrvIpAddr Parameter Command Injection Attempt TCP 80
2026-08-02 11:06:38 ET WEB_SPECIFIC_APPS TBK DVR-4104/4216 Command Injection Attempt (CVE-2024-3721) TCP 80
2026-08-02 11:06:38 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-02 11:06:38 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-02 11:06:38 ET WEB_SERVER WebShell Generic - wget http - POST TCP 80
2026-08-02 09:38:53 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-02 09:38:53 ET WEB_SPECIFIC_APPS GeoVision DateSetting.cgi szSrvIpAddr Parameter Command Injection Attempt TCP 80
2026-08-02 09:38:53 SERVER-WEBAPP Netgear DGN1000 series routers authentication bypass attempt TCP 80
2026-08-02 09:38:53 ET WEB_SPECIFIC_APPS TBK DVR-4104/4216 Command Injection Attempt (CVE-2024-3721) TCP 80
2026-08-02 09:38:53 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-02 09:38:53 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-02 09:38:53 SERVER-WEBAPP Netgear DGN1000 series routers authentication bypass attempt TCP 80
2026-08-02 09:38:53 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-02 09:38:53 ET WEB_SERVER WebShell Generic - wget http - POST TCP 80
2026-08-02 09:38:53 ET WEB_SERVER WebShell Generic - wget http - POST TCP 80
2026-08-02 09:38:53 ET WEB_SPECIFIC_APPS TBK DVR-4104/4216 Command Injection Attempt (CVE-2024-3721) TCP 80
2026-08-02 09:38:53 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-02 09:38:53 ET WEB_SPECIFIC_APPS GeoVision DateSetting.cgi szSrvIpAddr Parameter Command Injection Attempt TCP 80
2026-08-02 09:38:53 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-02 07:08:09 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-02 07:08:09 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-02 07:08:09 ET WEB_SPECIFIC_APPS TBK DVR-4104/4216 Command Injection Attempt (CVE-2024-3721) TCP 80
2026-08-02 07:08:09 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-02 07:08:09 ET WEB_SPECIFIC_APPS TBK DVR-4104/4216 Command Injection Attempt (CVE-2024-3721) TCP 80
2026-08-02 07:08:09 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-02 06:38:41 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-08-02 06:38:41 SERVER-WEBAPP Netgear DGN1000 series routers authentication bypass attempt TCP 80
2026-08-02 06:38:41 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80

 

Back to top