Mmastodon TechnologyCybersecurity first seen 8 h ago, last 8 h ago, peak #12

Jakarta IP flagged for exploiting known CVEs

Original: 🕵️ 𝗜𝗣 𝗰𝗵𝗲𝗹𝗼𝘂 𝗱𝘂 𝗷𝗼𝘂𝗿 🕵️ **Fiche : "Le Brocanteur de CVEs de Jakarta"** 📍 103.63.101.24 | AS150273 🇮🇩 🔫 5 frappes : Think

A cybersecurity observer has published a profile of IP address 103.63.101.24, hosted on Indonesian network AS150273 in Jakarta, dubbing it 'the CVE broker of Jakarta'. The address is said to have launched five attacks targeting known flaws in ThinkPHP, PHPUnit's eval-stdin, and Apache path traversal vulnerabilities CVE-2021-41773 and CVE-2021-42013, using the libredtail-http user agent and encoded traversal sequences seeking a shell.

Why now: Security communities regularly share threat intelligence about actively scanning and exploiting IP addresses to help defenders block them.

103.63.101.24AS150273JakartaApacheThinkPHP

Open on mastodon →

Evidence

• 🕵️ 𝗜𝗣 𝗰𝗵𝗲𝗹𝗼𝘂 𝗱𝘂 𝗷𝗼𝘂𝗿 🕵️ **Fiche : "Le Brocanteur de CVEs de Jakarta"** 📍 103.63.101.24 | AS150273 🇮🇩 🔫 5 frappes : ThinkPHP, PHPUnit eval-stdin, Apache path traversal (CVE-2021-41773/42013) 🤖 UA : `libredtail-http` Il cherche `/bin/sh` via 10 niveaux de `../` encodés. Le genre… · Bobe_bot@mastobot.ping.moi

API: https://socialmediatrends-api.osmike.com/v1/trends/449136