SCARD

Suspicious activity by IP address 119.96.223.148

Below is a list of the last 500 suspicious interactions with this IP.

Last observed Tue, 14 Jul 2026 09:22:09 (Australia/Brisbane)

Back to main list

Summary of suspicious activity by IP address 119.96.223.148

Description Count
ET WEB_SPECIFIC_APPS MVPower CCTV DVR /shell JAWS Webserver Unauthenticated Remote Command Execution (CVE-2016-20016) 16
ET EXPLOIT MVPower DVR Shell UCE 16
ET HUNTING Suspicious Chmod Usage in URI (Inbound) 16
ET EXPLOIT D-Link DSL-2750B - OS Command Injection 10
ET EXPLOIT D-Link DSL-2750B Command Injection Attempt (CVE-2016-20017) 10
SERVER-WEBAPP D-Link DSL-2750B routers login.cgi command injection attempt 10
ET SCAN JAWS Webserver Unauthenticated Shell Command Execution 7
SURICATA HTTP URI terminated by non-compliant character 4
ET WEB_SERVER ThinkPHP RCE Exploitation Attempt 4
ET WEB_SPECIFIC_APPS Linksys E-Series OS Command Injection (CVE-2025-34037) M1 3
ET EXPLOIT Linksys E-Series Device RCE Attempt 3
ET WORM TheMoon.linksys.router 2 3
ET WEB_SERVER WebShell Generic - wget http - POST 2

Detailed activity by IP address 119.96.223.148

Timestamp Description Protocol Destination Port
2026-07-14 09:22:09 ET EXPLOIT Linksys E-Series Device RCE Attempt TCP 8080
2026-07-14 09:22:09 ET WORM TheMoon.linksys.router 2 TCP 8080
2026-07-14 09:22:09 ET WEB_SPECIFIC_APPS Linksys E-Series OS Command Injection (CVE-2025-34037) M1 TCP 8080
2026-07-12 16:10:04 ET WEB_SPECIFIC_APPS Linksys E-Series OS Command Injection (CVE-2025-34037) M1 TCP 8080
2026-07-12 16:10:04 ET EXPLOIT Linksys E-Series Device RCE Attempt TCP 8080
2026-07-12 16:10:04 ET WORM TheMoon.linksys.router 2 TCP 8080
2026-07-12 16:10:04 ET EXPLOIT Linksys E-Series Device RCE Attempt TCP 8080
2026-07-12 16:10:04 ET WEB_SPECIFIC_APPS Linksys E-Series OS Command Injection (CVE-2025-34037) M1 TCP 8080
2026-07-12 16:10:04 ET WORM TheMoon.linksys.router 2 TCP 8080
2026-07-12 16:10:04 ET WEB_SERVER WebShell Generic - wget http - POST TCP 8080
2026-07-12 16:10:04 ET WEB_SERVER WebShell Generic - wget http - POST TCP 8080
2026-07-12 12:21:19 ET WEB_SPECIFIC_APPS MVPower CCTV DVR /shell JAWS Webserver Unauthenticated Remote Command Execution (CVE-2016-20016) TCP 80
2026-07-12 12:21:19 ET EXPLOIT MVPower DVR Shell UCE TCP 80
2026-07-12 12:21:19 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-07-12 12:21:19 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-07-12 12:21:19 ET WEB_SPECIFIC_APPS MVPower CCTV DVR /shell JAWS Webserver Unauthenticated Remote Command Execution (CVE-2016-20016) TCP 80
2026-07-12 12:21:19 ET EXPLOIT MVPower DVR Shell UCE TCP 80
2026-07-11 15:23:51 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-07-11 15:23:51 ET EXPLOIT MVPower DVR Shell UCE TCP 80
2026-07-11 15:23:51 ET EXPLOIT MVPower DVR Shell UCE TCP 80
2026-07-11 15:23:51 ET WEB_SPECIFIC_APPS MVPower CCTV DVR /shell JAWS Webserver Unauthenticated Remote Command Execution (CVE-2016-20016) TCP 80
2026-07-11 15:23:51 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-07-11 15:23:51 ET WEB_SPECIFIC_APPS MVPower CCTV DVR /shell JAWS Webserver Unauthenticated Remote Command Execution (CVE-2016-20016) TCP 80
2026-07-11 10:14:02 ET EXPLOIT MVPower DVR Shell UCE TCP 80
2026-07-11 10:14:02 ET WEB_SPECIFIC_APPS MVPower CCTV DVR /shell JAWS Webserver Unauthenticated Remote Command Execution (CVE-2016-20016) TCP 80
2026-07-11 10:14:02 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-07-11 10:14:02 ET WEB_SPECIFIC_APPS MVPower CCTV DVR /shell JAWS Webserver Unauthenticated Remote Command Execution (CVE-2016-20016) TCP 80
2026-07-11 10:14:02 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-07-11 10:14:02 ET EXPLOIT MVPower DVR Shell UCE TCP 80
2026-07-11 08:57:05 ET EXPLOIT D-Link DSL-2750B - OS Command Injection TCP 80
2026-07-11 08:57:05 SERVER-WEBAPP D-Link DSL-2750B routers login.cgi command injection attempt TCP 80
2026-07-11 08:57:05 ET EXPLOIT D-Link DSL-2750B - OS Command Injection TCP 80
2026-07-11 08:57:05 ET WEB_SPECIFIC_APPS MVPower CCTV DVR /shell JAWS Webserver Unauthenticated Remote Command Execution (CVE-2016-20016) TCP 80
2026-07-11 08:57:05 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-07-11 08:57:05 ET EXPLOIT MVPower DVR Shell UCE TCP 80
2026-07-11 08:57:05 ET EXPLOIT MVPower DVR Shell UCE TCP 80
2026-07-11 08:57:05 ET EXPLOIT D-Link DSL-2750B Command Injection Attempt (CVE-2016-20017) TCP 80
2026-07-11 08:57:05 ET EXPLOIT D-Link DSL-2750B Command Injection Attempt (CVE-2016-20017) TCP 80
2026-07-11 08:57:05 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-07-11 08:57:05 ET WEB_SPECIFIC_APPS MVPower CCTV DVR /shell JAWS Webserver Unauthenticated Remote Command Execution (CVE-2016-20016) TCP 80
2026-07-11 08:57:05 SERVER-WEBAPP D-Link DSL-2750B routers login.cgi command injection attempt TCP 80
2026-07-10 22:28:29 ET WEB_SPECIFIC_APPS MVPower CCTV DVR /shell JAWS Webserver Unauthenticated Remote Command Execution (CVE-2016-20016) TCP 80
2026-07-10 22:28:29 ET EXPLOIT MVPower DVR Shell UCE TCP 80
2026-07-10 22:28:29 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-07-06 21:45:42 SURICATA HTTP URI terminated by non-compliant character TCP 80
2026-07-06 21:45:42 ET WEB_SERVER ThinkPHP RCE Exploitation Attempt TCP 80
2026-07-06 21:45:42 SURICATA HTTP URI terminated by non-compliant character TCP 80
2026-07-06 21:45:42 ET WEB_SERVER ThinkPHP RCE Exploitation Attempt TCP 80
2026-07-03 10:26:05 ET SCAN JAWS Webserver Unauthenticated Shell Command Execution TCP 80
2026-07-03 10:26:05 ET WEB_SPECIFIC_APPS MVPower CCTV DVR /shell JAWS Webserver Unauthenticated Remote Command Execution (CVE-2016-20016) TCP 80
2026-07-03 10:26:05 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-07-03 10:26:05 ET EXPLOIT MVPower DVR Shell UCE TCP 80
2026-06-30 13:45:39 ET SCAN JAWS Webserver Unauthenticated Shell Command Execution TCP 80
2026-06-30 13:45:39 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-06-30 13:45:39 ET WEB_SPECIFIC_APPS MVPower CCTV DVR /shell JAWS Webserver Unauthenticated Remote Command Execution (CVE-2016-20016) TCP 80
2026-06-30 13:45:39 ET EXPLOIT MVPower DVR Shell UCE TCP 80
2026-06-30 13:45:39 ET EXPLOIT MVPower DVR Shell UCE TCP 80
2026-06-30 13:45:39 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-06-30 13:45:39 ET SCAN JAWS Webserver Unauthenticated Shell Command Execution TCP 80
2026-06-30 13:45:39 ET WEB_SPECIFIC_APPS MVPower CCTV DVR /shell JAWS Webserver Unauthenticated Remote Command Execution (CVE-2016-20016) TCP 80
2026-06-29 21:10:22 ET WEB_SPECIFIC_APPS MVPower CCTV DVR /shell JAWS Webserver Unauthenticated Remote Command Execution (CVE-2016-20016) TCP 80
2026-06-29 21:10:22 ET WEB_SPECIFIC_APPS MVPower CCTV DVR /shell JAWS Webserver Unauthenticated Remote Command Execution (CVE-2016-20016) TCP 80
2026-06-29 21:10:22 ET EXPLOIT MVPower DVR Shell UCE TCP 80
2026-06-29 21:10:22 ET SCAN JAWS Webserver Unauthenticated Shell Command Execution TCP 80
2026-06-29 21:10:22 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-06-29 21:10:22 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-06-29 21:10:22 ET SCAN JAWS Webserver Unauthenticated Shell Command Execution TCP 80
2026-06-29 21:10:22 ET EXPLOIT MVPower DVR Shell UCE TCP 80
2026-06-28 00:58:57 SERVER-WEBAPP D-Link DSL-2750B routers login.cgi command injection attempt TCP 80
2026-06-28 00:58:57 ET EXPLOIT D-Link DSL-2750B Command Injection Attempt (CVE-2016-20017) TCP 80
2026-06-28 00:58:57 SERVER-WEBAPP D-Link DSL-2750B routers login.cgi command injection attempt TCP 80
2026-06-28 00:58:57 ET EXPLOIT D-Link DSL-2750B - OS Command Injection TCP 80
2026-06-28 00:58:57 ET EXPLOIT D-Link DSL-2750B - OS Command Injection TCP 80
2026-06-28 00:58:57 ET EXPLOIT D-Link DSL-2750B Command Injection Attempt (CVE-2016-20017) TCP 80
2026-06-25 13:03:00 ET EXPLOIT D-Link DSL-2750B Command Injection Attempt (CVE-2016-20017) TCP 80
2026-06-25 13:03:00 ET EXPLOIT D-Link DSL-2750B - OS Command Injection TCP 80
2026-06-25 13:03:00 SERVER-WEBAPP D-Link DSL-2750B routers login.cgi command injection attempt TCP 80
2026-06-25 13:03:00 SERVER-WEBAPP D-Link DSL-2750B routers login.cgi command injection attempt TCP 80
2026-06-25 13:03:00 ET EXPLOIT D-Link DSL-2750B - OS Command Injection TCP 80
2026-06-25 13:03:00 ET EXPLOIT D-Link DSL-2750B Command Injection Attempt (CVE-2016-20017) TCP 80
2026-06-22 07:51:41 ET SCAN JAWS Webserver Unauthenticated Shell Command Execution TCP 80
2026-06-22 07:51:41 ET EXPLOIT MVPower DVR Shell UCE TCP 80
2026-06-22 07:51:41 ET SCAN JAWS Webserver Unauthenticated Shell Command Execution TCP 80
2026-06-22 07:51:41 ET WEB_SPECIFIC_APPS MVPower CCTV DVR /shell JAWS Webserver Unauthenticated Remote Command Execution (CVE-2016-20016) TCP 80
2026-06-22 07:51:41 ET EXPLOIT MVPower DVR Shell UCE TCP 80
2026-06-22 07:51:41 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-06-22 07:51:41 ET HUNTING Suspicious Chmod Usage in URI (Inbound) TCP 80
2026-06-22 07:51:41 ET WEB_SPECIFIC_APPS MVPower CCTV DVR /shell JAWS Webserver Unauthenticated Remote Command Execution (CVE-2016-20016) TCP 80
2026-06-16 02:25:23 ET WEB_SERVER ThinkPHP RCE Exploitation Attempt TCP 80
2026-06-16 02:25:23 SURICATA HTTP URI terminated by non-compliant character TCP 80
2026-06-16 02:25:23 ET WEB_SERVER ThinkPHP RCE Exploitation Attempt TCP 80
2026-06-16 02:25:23 SURICATA HTTP URI terminated by non-compliant character TCP 80
2026-06-07 07:13:06 ET EXPLOIT D-Link DSL-2750B - OS Command Injection TCP 80
2026-06-07 07:13:06 ET EXPLOIT D-Link DSL-2750B Command Injection Attempt (CVE-2016-20017) TCP 80
2026-06-07 07:13:06 SERVER-WEBAPP D-Link DSL-2750B routers login.cgi command injection attempt TCP 80
2026-06-07 07:13:05 ET EXPLOIT D-Link DSL-2750B Command Injection Attempt (CVE-2016-20017) TCP 80
2026-06-07 07:13:05 ET EXPLOIT D-Link DSL-2750B - OS Command Injection TCP 80
2026-06-07 07:13:05 SERVER-WEBAPP D-Link DSL-2750B routers login.cgi command injection attempt TCP 80
2026-06-06 16:33:08 ET EXPLOIT D-Link DSL-2750B - OS Command Injection TCP 80
2026-06-06 16:33:08 SERVER-WEBAPP D-Link DSL-2750B routers login.cgi command injection attempt TCP 80
2026-06-06 16:33:08 ET EXPLOIT D-Link DSL-2750B Command Injection Attempt (CVE-2016-20017) TCP 80
2026-06-06 16:33:08 ET EXPLOIT D-Link DSL-2750B Command Injection Attempt (CVE-2016-20017) TCP 80
2026-06-06 16:33:08 ET EXPLOIT D-Link DSL-2750B - OS Command Injection TCP 80
2026-06-06 16:33:08 SERVER-WEBAPP D-Link DSL-2750B routers login.cgi command injection attempt TCP 80

 

Back to top