By Johannes B. Ullrich, Ph.D. Mirai Variant Scanning Port 5555 and 7547 For TR-069/SOAP Vulnerability
https://isc.sans.edu/forums/diary/Port+7547+SOAP+Remote+Code+Execution+Attack+Against+DSL+Modems/21759/
Paypal OAuth Vulnerability
http://blog.intothesymmetry.com/2016/11/all-your-paypal-tokens-belong-to-me.html
More Here