160.250.132.238

Blocked Persistent Regular Toolkit Campaign member

Blocked since 19 Oct 2026 16:07 UTC, no end date. Our servers refuse it, web requests included, and it is in feed.txt.

Record

Score: 39/100each request counts half as much after 30 days
Worst level: Persistent
Attack-shaped requests: 82all time
Active days: 2UTC days
First seen: 19 Oct 2026
Last seen: 22 Oct 2026 15:16
Servers hit: 1
Targets: 0sites
Times blocked: 1by the evidence rules

First seen on 19 Oct 2026 16:06 UTC, most recently active on 22 Oct 2026 15:16 UTC.

Recorded 82 attack-shaped requests across 2 separate days.

Its traffic tried to run code through an exposed PHPUnit test helper (CVE-2017-9841) (39 requests); it also requested a decoy path that only a scanner would ask for (26); it also tried to abuse a local or remote file inclusion parameter such as allow_url_include (6).

Seen by our honeypot sensor.

Scored into the "Persistent" level, its highest so far. Badges: Regular, Toolkit and Campaign member.

Its busiest hour on record began 22 Oct 2026 15:00 UTC, with 49 requests.

Routed via AS150895 (EZ TECHNOLOGY COMPANY LIMITED), a home broadband network.

Surfaces: honeypot. Attack types: leaked-password reuse, known exploits, injection, scanning. Seen by: honeypot.

Activity, last 90 days

Active on 2 of the last 90 UTC days. Current block: 19 Oct 2026, with no end date.

Daily counts

Attack requests per UTC day, days with activity only
Day (UTC)	Requests
19 Oct 2026	33
22 Oct 2026	49

At least 42 requests a minute at its peak (22 Oct 2026 15:15 UTC; identical requests in the same second are stored once).
Methods: GET 68, POST 14.
The servers we watch answered: 404 72, 200 10 (totals only, from our web servers).

Evidence

Newest first, the latest 50 stored requests grouped into runs. Times are UTC. The user agent is shown as its family only.

Evidence, newest first, grouped by UTC day
Time	What happened	Request	Seen by
22 Oct 2026
15:16	requested a decoy path that only a scanner would ask for	`GET /containers/json`	honeypot
15:16	2× used a directory-traversal segment (literal or percent-encoded ../) in the request path to try to escape the web root	`GET /index.php?`	honeypot
15:16	requested a decoy path that only a scanner would ask for	`GET /public/index.php?`	honeypot
15:16	fuzzed a short, random filename looking for a forgotten script that responds	`GET /index.php?`	honeypot
15:15-15:16	23× tried to run code through an exposed PHPUnit test helper (CVE-2017-9841) (23 distinct paths)	`GET /app/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php`	honeypot
15:15	8× requested a decoy path that only a scanner would ask for (8 distinct paths)	`GET /lib/phpunit/Util/PHP/eval-stdin.php`	honeypot
15:15	tried to run code through an exposed PHPUnit test helper (CVE-2017-9841)	`GET /vendor/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php`	honeypot
15:15	4× requested a decoy path that only a scanner would ask for (4 distinct paths)	`GET /vendor/phpunit/phpunit/LICENSE/eval-stdin.php`	honeypot
15:15	tried to run code through an exposed PHPUnit test helper (CVE-2017-9841)	`GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php`	honeypot
15:15	fuzzed a short, random filename looking for a forgotten script that responds	`POST /index.php?`	honeypot
15:15	tried to abuse a local or remote file inclusion parameter such as allow_url_include	`POST /test.hello?`	honeypot
15:15	fuzzed a short, random filename looking for a forgotten script that responds	`POST /index.php?`	honeypot
15:15	2× tried to abuse a local or remote file inclusion parameter such as allow_url_include (2 distinct paths)	`POST /?`	honeypot
15:15	submitted credentials to a decoy login form designed to capture, never validate, them	`POST /cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh`	honeypot
15:15	attempted the Apache 2.4.49 cgi-bin path-traversal exploit to read or execute files outside the web root (CVE-2021-41773)	`POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh`	honeypot
19 Oct 2026
16:06	tried to run code through an exposed PHPUnit test helper (CVE-2017-9841)	`GET /api/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php`	honeypot

Network

ASN: AS150895 EZ TECHNOLOGY COMPANY LIMITED
Network type: home broadband
Reverse DNS: none
Country: Vietnam VN
Flags: none observed
Abuse contact: found in the registry
Checked: 9 Nov 2026

Elsewhere: GreyNoise, Shodan, AbuseIPDB.

Your verdict

What readers make of this address. Verdicts are opinions of signed-in Academy members. They never change blocking or reporting.

No verdicts yet.

Report history

Abuse reports sent about this address, newest first
Sent	Channel	Contact	Outcome
2026-10-21 00:00:18	email	[email protected]	pending

Campaign

Sends the same user agent (family: other) and asks for the same paths as 2 other addresses, seen together from 14 Oct 2026 to 30 Oct 2026. Paths: /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh /cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh /hello.world? /? /index.php?.