161.97.110.112

SAYOR honeypot: observed attack /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh

web attack, shell attempt

list.rtbh.com.tr report: tcp/0

POST /cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh HTTP/1.1 POST /hello.world?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1 POST /cgi-bin/.%2e/.%2e/ ... show more POST /cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh HTTP/1.1 POST /hello.world?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1 POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh HTTP/1.1 show less

161.97.110.112 - - [08/Feb/2026:15:24:27 +0200] "POST /cgi-bin/../../../../../../../../../../bin/sh HTTP/1.1" 400 266 "-" "libredtail-http"

Apache.HTTP.Server.cgi-bin.Path.Traversal

[AUTORAVALT][[09/02/2026 - 03:54:14 -03:00 UTC] Attack from [RIPE Network Coordination Centre] [161.97.110.112][vmi3065457.contaboserver.net] Action: BLocKed FTP Brute-Force -> Running brute force credentials on the FTP server. Brute-Force -> Crede ... show more [AUTORAVALT][[09/02/2026 - 03:54:14 -03:00 UTC] Attack from [RIPE Network Coordination Centre] [161.97.110.112][vmi3065457.contaboserver.net] Action: BLocKed FTP Brute-Force -> Running brute force credentials on the FTP server. Brute-Force -> Credential brute-force attacks on webpage logins and services like SSH, FTP, SIP, SMTP, RDP, etc. ] ... show less

[AUTORAVALT][[09/02/2026 - 03:17:49 -03:00 UTC] Attack from [RIPE Network Coordination Centre] [161.97.110.112][vmi3065457.contaboserver.net] Action: BLocKed FTP Brute-Force -> Running brute force credentials on the FTP server. Brute-Force -> Crede ... show more [AUTORAVALT][[09/02/2026 - 03:17:49 -03:00 UTC] Attack from [RIPE Network Coordination Centre] [161.97.110.112][vmi3065457.contaboserver.net] Action: BLocKed FTP Brute-Force -> Running brute force credentials on the FTP server. Brute-Force -> Credential brute-force attacks on webpage logins and services like SSH, FTP, SIP, SMTP, RDP, etc. ] ... show less

Webpage scraping

The IP 161.97.110.112 tried multiple SSH_BRUTE_FORCE logins

AUTOMATED REPORT: Trying to access /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php

Fail2Ban Ban Triggered

Client sent invalid (non-HTTP) message to honeypot web server: 161.97.110.112 - - [08/Feb/2026:10:31:17 -0600] "POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh HTTP/1.1" 400 166 "-" "-" "-" ""

161.97.110.112 - - [08/Feb/2026:17:29:17 +0100] "POST /hello.world?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 404 153 "-" "libredtail-http" 161.97.110.112 - - [08/Feb/2026:17:29:17 +0100] "GET /vendor/phpunit/phpunit/sr ... show more 161.97.110.112 - - [08/Feb/2026:17:29:17 +0100] "POST /hello.world?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 404 153 "-" "libredtail-http" 161.97.110.112 - - [08/Feb/2026:17:29:17 +0100] "GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 404 153 "-" "libredtail-http" 161.97.110.112 - - [08/Feb/2026:17:29:17 +0100] "GET /vendor/phpunit/phpunit/Util/PHP/eval-stdin.php HTTP/1.1" 404 153 "-" "libredtail-http" 161.97.110.112 - - [08/Feb/2026:17:29:17 +0100] "GET /vendor/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 404 153 "-" "libredtail-http" 161.97.110.112 - - [08/Feb/2026:17:29:17 +0100] "GET /vendor/phpunit/Util/PHP/eval-stdin.php HTTP/1.1" 404 153 "-" "libredtail-http" ... show less

(sshd) Failed SSH login from 161.97.110.112 (DE/Germany/vmi3065457.contaboserver.net): 5 in the last 3600 secs; Ports: *; Direction: 1; Trigger: LF_SSHD; Logs: Feb 8 10:22:44 17576 sshd[13250]: Invalid user admin from 161.97.110.112 port 60982 Feb ... show more (sshd) Failed SSH login from 161.97.110.112 (DE/Germany/vmi3065457.contaboserver.net): 5 in the last 3600 secs; Ports: *; Direction: 1; Trigger: LF_SSHD; Logs: Feb 8 10:22:44 17576 sshd[13250]: Invalid user admin from 161.97.110.112 port 60982 Feb 8 10:22:45 17576 sshd[13250]: Failed password for invalid user admin from 161.97.110.112 port 60982 ssh2 Feb 8 10:23:16 17576 sshd[13447]: Invalid user orangepi from 161.97.110.112 port 46300 Feb 8 10:23:18 17576 sshd[13447]: Failed password for invalid user orangepi from 161.97.110.112 port 46300 ssh2 Feb 8 10:23:49 17576 sshd[13502]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=161.97.110.112 user=root show less