2 exploit attempts against Gitea CVE-2026-60004 (POST /api/v1/repos/*/diffpatch, arbitrary file writ ...
show more2 exploit attempts against Gitea CVE-2026-60004 (POST /api/v1/repos/*/diffpatch, arbitrary file write via git hook injection); 1 automated account registrations. Observed 2026-08-01 23:38 to 2026-08-01 23:39 UTC on a self-hosted Gitea instance. Goal: deploying an XMRig Monero cryptominer and a remote-control backdoor.
show less
2024-12-08T11:00:35.348241voip.dilenatech.com sshd[21066]: pam_unix(sshd:auth): authentication failu ...
show more2024-12-08T11:00:35.348241voip.dilenatech.com sshd[21066]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=13.60.40.84
2024-12-08T11:00:37.188358voip.dilenatech.com sshd[21066]: Failed password for invalid user test from 13.60.40.84 port 33640 ssh2
2024-12-08T11:00:37.434179voip.dilenatech.com sshd[21068]: Invalid user oracle from 13.60.40.84 port 33654
...
show less
2024-12-08T10:37:19.751351+01:00 mordor sshd[2447050]: Connection closed by 13.60.40.84 port 49332
2 ...
show more2024-12-08T10:37:19.751351+01:00 mordor sshd[2447050]: Connection closed by 13.60.40.84 port 49332
2024-12-08T10:37:19.925107+01:00 mordor sshd[2447051]: Invalid user test from 13.60.40.84 port 49336
2024-12-08T10:37:19.965261+01:00 mordor sshd[2447051]: Connection closed by invalid user test 13.60.40.84 port 49336 [preauth]
...
show less
Dec 8 06:37:58 eltispisrv01 sshd[442536]: Invalid user oracle from 13.60.40.84 port 57230
Dec 8 06 ...
show moreDec 8 06:37:58 eltispisrv01 sshd[442536]: Invalid user oracle from 13.60.40.84 port 57230
Dec 8 06:37:58 eltispisrv01 sshd[442536]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=13.60.40.84
Dec 8 06:37:58 eltispisrv01 sshd[442536]: Invalid user oracle from 13.60.40.84 port 57230
Dec 8 06:38:00 eltispisrv01 sshd[442536]: Failed password for invalid user oracle from 13.60.40.84 port 57230 ssh2
Dec 8 06:38:01 eltispisrv01 sshd[442543]: Invalid user prometheus from 13.60.40.84 port 34662
...
show less
Brute-Force
SSH
Showing 1 to
10
of 10 reports
Think this IP has been falsely reported? You may request to have the associated
reports reviewed and removed.
Request Takedown 🚩