Ongoing suspicious ICMPv6 echo requests (Type 128) have been observed targeting dark nets monitored ...
show moreOngoing suspicious ICMPv6 echo requests (Type 128) have been observed targeting dark nets monitored by a network telescope across multiple /64 prefixes. The activity involves varying Traffic Class (TC) values (0, 1, 2, 3), high Hop Limits (238), and consistent use of ICMPv6 (PROTO=ICMPv6), indicating potential reconnaissance.
The probing resumed after a 19-hour pause, continuing in a methodical pattern with calculated intervals between probes. Each probe varies in traffic class and flow label, suggesting a deliberate attempt to maintain a low profile while scanning the network.
Recent Activity:
22:11:23 UTC (Aug 20, 2024) - TC: 3, Flow Label: 168716, ICMPv6 ID: 10
23:06:58 UTC (Aug 20, 2024) - TC: 3, Flow Label: 641296, ICMPv6 ID: 43
00:02:32 UTC (Aug 21, 2024) - TC: 0, Flow Label: 278323, ICMPv6 ID: 45
00:57:23 UTC (Aug 21, 2024) - TC: 2, Flow Label: 799590, ICMPv6 ID: 11
01:49:35 UTC (Aug 21, 2024) - TC: 1, Flow Label: 773160, ICMPv6 ID: 44
show less
Attempted to access //wp-content/plugins/fix/up.php, which suggests an attempt to exploit a known vu ...
show moreAttempted to access //wp-content/plugins/fix/up.php, which suggests an attempt to exploit a known vulnerability in WordPress plugins.
show less
Multiple attempts were made to access WordPress-related files, including wlwmanifest.xml and xmlrpc. ...
show moreMultiple attempts were made to access WordPress-related files, including wlwmanifest.xml and xmlrpc.php, across various directories. This suggests an automated scan targeting WordPress vulnerabilities.
show less
The IP 206.189.87.227 from DIGITALOCEAN-ASN (Singapore) repeatedly attempted to access WordPress-rel ...
show moreThe IP 206.189.87.227 from DIGITALOCEAN-ASN (Singapore) repeatedly attempted to access WordPress-related files (wlwmanifest.xml) across various directories on a protected server. These attempts are likely part of an automated scan targeting WordPress vulnerabilities. The User-Agent used was Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36.
show less
Suspicious ICMPv6 Activity.
Observed ICMPv6 echo requests (Type 128) from China Telecom IP 240e:0 ...
show moreSuspicious ICMPv6 Activity.
Observed ICMPv6 echo requests (Type 128) from China Telecom IP 240e:00c2:1800:0084:0000:0001:0001:0002, targeting dark nets monitored by a network telescope across multiple /64 prefixes. The activity involved varying Traffic Class (TC) values (0, 1, 2), high Hop Limits (238), and consistent use of ICMPv6 (PROTO=ICMPv6), indicating potential reconnaissance.
This IP address spent 14 hours, pinging a single random address on average every 53 minutes in a different /64 prefix, suggesting a conscious attempt to maintain a low profile.
Sample logs:
Aug 19 06:53:56 TC=0 HOPLIMIT=238 PROTO=ICMPv6 SRC=240e:c2:1800:84::1:1:2 DST=[REDACTED]
Aug 19 07:20:14 TC=2 HOPLIMIT=238 PROTO=ICMPv6 SRC=240e:c2:1800:84::1:1:2 DST=[REDACTED]
Aug 19 08:12:44 TC=1 HOPLIMIT=238 PROTO=ICMPv6 SRC=240e:c2:1800:84::1:1:2 DST=[REDACTED]
The detection across different /64 prefixes suggests an extensive scanning effort.
show less
Port Scan
By clicking “Accept all”, you agree to the storing of cookies on your device to remember preferences and
analyze site usage.
Read more
- Required to log into your AbuseIPDB account, and store these cookie preferences.