🇩🇪
138.199.19.160
29 Nov 2023
Observed 209 web app attacks in 10 minutes.
Brute-Force
Web App Attack
🇸🇬
84.17.39.179
29 Nov 2023
Observed 133 web app attacks over 10 minutes.
Brute-Force
Web App Attack
🇩🇪
156.146.33.88
29 Nov 2023
Observed 106 web app attacks over the last 10 minutes.
Brute-Force
Web App Attack
🇩🇪
149.102.230.133
29 Nov 2023
104 web app attacks over the last 10 minutes.
Brute-Force
Web App Attack
🇩🇪
188.95.65.41
29 Nov 2023
103 web app attacks over the last 10 minutes.
Brute-Force
Web App Attack
🇺🇸
18.223.54.53
05 Jul 2023
Cross-site Scripting + Directory Traversal attacks against WordPress sites.
Hacking
Web App Attack
🇸🇬
149.129.50.37
29 Jun 2023
Jun 27 21:36:59,2023/06/27 21:36:58,010108010589,THREAT,spyware,2561,2023/06/27 21:36:58,149.129.50. ...
show more
Jun 27 21:36:59,2023/06/27 21:36:58,010108010589,THREAT,spyware,2561,2023/06/27 21:36:58,149.129.50.37,REDACTED.,2023/06/27 21:36:58,80,tcp,alert,"index.php",OfficePackager Command and Control Traffic Detection(85907),computer-and-internet-info,client-to-server,Singapore,United States,command-and-control,AppThreat-8725-8125,2023-06-27T21:36:59.917-04:00,proxy,networking,browser-based,"evasive-behavior,used-by-malware,able-to-transfer-file,has-known-vulnerability,tunnel-other-application,prone-to-misuse,pervasive-use",http-proxy,no,no
show less
Hacking
Web App Attack
🇸🇪
185.213.154.244
29 Jun 2023
Reporting IP abuse.
Hacking
SQL Injection
Web App Attack
🇸🇬
54.179.156.160
27 Jun 2023
Jun 27 04:17:47,2023/06/27 04:17:46,THREAT,spyware,54.179.156.160,HTTP In,web-browsing,49750,80,tcp, ...
show more
Jun 27 04:17:47,2023/06/27 04:17:46,THREAT,spyware,54.179.156.160,HTTP In,web-browsing,49750,80,tcp,reset-server,,Suspicious PHP Traffic Detection(18845),medium,client-to-server,Singapore,United States,webshell,AppThreat-8725-8125,0x4,0,4294967295,8137e8a9-5e47-4cdc-9d45-c7328ba74183,2023-06-27T04:17:47.246-04:00,internet-utility,general-internet,browser-based,4,"used-by-malware,able-to-transfer-file,has-known-vulnerability,tunnel-other-application,pervasive-use",web-browsing
Jun 27 04:16:50,2023/06/27 04:16:50,THREAT,vulnerability,54.179.156.160,HTTP In,web-browsing,65344,80,tcp,drop,"eval-stdin.php",phpunit Remote Code Execution Vulnerability(55852),client-to-server,Singapore,United States,N/A,code-execution,AppThreat-8725-8125,0x0,0,4294967295,8137e8a9-5e47-4cdc-9d45-c7328ba74183,0,0,2023-06-27T04:16:50.835-04:00,internet-utility,general-internet,browser-based,4,"used-by-malware,able-to-transfer-file,has-known-vulnerability,tunnel-other-application,pervasive-use",web-browsing
show less
Hacking
Web App Attack
🇬🇧
109.228.36.218
26 Jun 2023
Attack against WordPress sites.
Hacking
Web App Attack
🇳🇱
5.34.180.205
30 May 2023
{"timestamp":"2023-05-28T16:07:00.525061+0000","event_type":"alert","src_ip":"REDACTED","src_port":4 ...
show more
{"timestamp":"2023-05-28T16:07:00.525061+0000","event_type":"alert","src_ip":"REDACTED","src_port":443,"dest_ip":"5.34.180.205","dest_port":51232,"proto":"TCP","alert":{"action":"allowed","signature":"ET EXPLOIT Possible OpenSSL HeartBleed Large HeartBeat Response from Common SSL Port (Outbound from Server)","category":"Potentially Bad Traffic"
show less
Hacking
🇳🇱
23.83.114.131
23 Mar 2023
FOR AWARENESS: IP listed as a command and control IOC for BlackGuard stealer 03/23/2023 in https://c ...
show more
FOR AWARENESS: IP listed as a command and control IOC for BlackGuard stealer 03/23/2023 in https://cybersecurity.att.com/blogs/labs-research/blackguard-stealer-extends-its-capabilities-in-new-variant
show less
Hacking
Exploited Host
🇺🇸
5.161.127.136
13 Mar 2023
POST /wp-admin/admin-ajax.php HTTP/1.1 User-Agent: Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/N ...
show more
POST /wp-admin/admin-ajax.php HTTP/1.1 User-Agent: Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36 Accept-Encoding: gzip, deflate Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8 Connection: keep-alive Cache-Control: max-age=0 Upgrade-Insecure-Requests: 1 Accept-Language: en-US,en;q=0.9,fr;q=0.8 referer: www.google.com Content-Length: 810 Content-Type: multipart/form-data; boundary=67d11d3a771bb3488cbeed9cdfe120cb X-Forwarded-For: 5.161.127.136 X-Forwarded-Proto: HTTPS
show less
Hacking
Web App Attack
🇨🇳
116.1.7.245
13 Mar 2023
POST /cgi-bin/uniform.sh HTTP/1.0 Accept: */* User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) A ...
show more
POST /cgi-bin/uniform.sh HTTP/1.0 Accept: */* User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36 Edg/90.0.818.49 Content-Type: application/x-www-form-urlencoded Content-Length: 646 Connection: close Pragma: no-cache Cookie: BIGipServerwww-Standard-NewProd_HTTP_Pool=1463226796.20480.0000; TS01a3312d=017f0bb16df64ef6c9798c5c267b722244170bb986604662d996589d63467ea75a72777c2319e3a47930632bbf49bf546360ae2274 X-Forwarded-For: 116.1.7.245 X-Forwarded-Proto: HTTPS
show less
Hacking
Web App Attack
🇷🇺
185.17.0.83
13 Mar 2023
POST /xmlrpc.php HTTP/1.1 Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5. ...
show more
POST /xmlrpc.php HTTP/1.1 Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.87 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Content-Length: 204 Content-Type: application/x-www-form-urlencoded X-Forwarded-For: 185.17.0.83 X-Forwarded-Proto: HTTPS
show less
Hacking
Web App Attack
🇦🇷
190.220.22.11
13 Mar 2023
POST /_ignition/execute-solution HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:8 ...
show more
POST /_ignition/execute-solution HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:83.0) Gecko/20100101 Firefox/83.0 Content-Length: 155 Accept: */* Accept-Language: en-US,en;q=0.5 Connection: close Content-Type: application/json Accept-Encoding: gzip Connection: close X-Forwarded-For: 190.220.22.11 X-Forwarded-Proto: HTTP
show less
Hacking
Web App Attack
🇹🇷
95.183.140.254
13 Mar 2023
POST /wp-login.php?action=register HTTP/1.1 Content-Length: 443 Content-Type: application/x-www-form ...
show more
POST /wp-login.php?action=register HTTP/1.1 Content-Length: 443 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.26 Safari/537.36 Core/1.63.5083.400 QQBrowser/10.0.972.400 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate DNT: 1 Via: HTTP/1.1 forward.http.proxy:3128 Connection: keep-alive X-Forwarded-For: 95.183.140.254 X-Forwarded-Proto: HTTPS
show less
Hacking
Web App Attack
🇬🇧
80.75.64.69
13 Mar 2023
POST /xmlrpc.php HTTP/1.1 Keep-Alive: 300 Connection: keep-alive Cookie: BIGipServerwww-Standard-New ...
show more
POST /xmlrpc.php HTTP/1.1 Keep-Alive: 300 Connection: keep-alive Cookie: BIGipServerwww-Standard-NewProd_HTTP_Pool=1463226796.20480.0000; TS01a3312d=017f0bb16d70234787be3232385016c9adb17fde24b6a71a0b62be42cfe344a89826dce674480da5786c46c1f7e2db72e0735da574 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36 Content-Type: application/xml Content-Length: 494 X-Forwarded-For: 80.75.64.69 X-Forwarded-Proto: HTTPS
show less
Hacking
Web App Attack
🇪🇪
185.195.237.203
13 Mar 2023
POST /xmlrpc.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 ( ...
show more
POST /xmlrpc.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Accept: */* Content-Type: text/xml Content-Length: 217 X-Forwarded-For: 185.195.237.203 X-Forwarded-Proto: HTTPS
show less
Hacking
Web App Attack
🇸🇬
95.142.117.39
15 Feb 2023
Host seen attempting to Brute-Force + MFA Fatigue attack internal assets.
Hacking
Brute-Force
🇸🇬
95.142.117.14
15 Feb 2023
Host seen attempting to Brute-Force + MFA Fatigue attack internal assets.
Hacking
Brute-Force
🇫🇮
65.108.88.104
14 Feb 2023
Excessive POST /wp-login.php requests and login failures.
Hacking
Brute-Force
Web App Attack
🇩🇪
167.235.247.164
14 Feb 2023
WordPress /wp-includes/wlwmanifest.xml attack to port HTTP/80
Hacking
Brute-Force
Web App Attack
🇺🇸
149.28.69.44
14 Feb 2023
/wp-config.php.bak
/info.php
/.env
/config.json
Hacking
Brute-Force
Web App Attack
🇺🇸
150.136.153.201
31 Jan 2023
WordPress | Brute-force | xmlrpc attack
Hacking
Brute-Force
Web App Attack