AbuseIPDB

JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

User Leah Tibbets joined AbuseIPDB in November 2023 and has reported 39 IP addresses.

Standing (weight) is good.

INACTIVE USER

IP	Date	Comment	Categories
🇻🇬 204.11.56.48	13 Nov 2023	This IP is one of 3 C&C center IPs for the ransomware group BlackMatter. They carry out DDoSing, Ran ... show more This IP is one of 3 C&C center IPs for the ransomware group BlackMatter. They carry out DDoSing, Ransomware attacks, and a lot more and are VERY dangerous. This IP is a callback for BlackMatter ransomware called DarkSide. Here is the Any.Run analysis: https://app.any.run/tasks/d3f6f861-fece-4161-a600-5931b231a5d1, the SHA-256 hash for ransomware is: f3474589cafa855a73d0830883b9909095f82c28aa468e999940faf85beca4c1 and this host resolves to: paymenthacks.com, ASN: ULTRADDOS, country: VG show less	DDoS Attack Phishing Email Spam Hacking Exploited Host
🇺🇦 31.133.81.110	13 Nov 2023	Fraud / Email Spam / Phishing	Fraud Orders Phishing Email Spam
🇺🇸 141.98.5.56	13 Nov 2023	Fraud / Phishing / Email Spam	Fraud Orders Phishing Email Spam
🇺🇸 104.21.30.197	13 Nov 2023	Spam mail / Phishing -https://www.virustotal.com/gui/url/3fa0eb2035d3b7a3282a14031cf4da3fa9940331261 ... show more Spam mail / Phishing -https://www.virustotal.com/gui/url/3fa0eb2035d3b7a3282a14031cf4da3fa99403312617df00fa18bb00bbb68704/details show less	Phishing
🇳🇱 146.70.169.164	11 Nov 2023	Callback IP for PovertyStealer malware (network trojan). Connects to port 2227, check live analysis ... show more Callback IP for PovertyStealer malware (network trojan). Connects to port 2227, check live analysis here: https://app.any.run/tasks/5661add5-3845-473f-ba46-cf0ff5ca0441, MD5 of PovertyStealer: b8303120c1bf50b01dbc9f8d6fea45d8 show less	Phishing Web Spam Hacking
🇩🇪 168.119.243.238	11 Nov 2023	Vidar malware callback IP, malware analysis: https://app.any.run/tasks/3435941b-f426-4c54-b3f1-eca4f ... show more Vidar malware callback IP, malware analysis: https://app.any.run/tasks/3435941b-f426-4c54-b3f1-eca4f1fc4dc9 show less	Hacking
🇺🇸 104.21.65.188	11 Nov 2023	Associated with a popup on chrome that is malicious. Analysis is here: https://app.any.run/tasks/7f3 ... show more Associated with a popup on chrome that is malicious. Analysis is here: https://app.any.run/tasks/7f3b63d7-ac3f-40e7-baad-1179dbebe12f show less	Phishing Hacking
🇺🇸 198.48.55.244	11 Nov 2023	VirusTotal: https://www.virustotal.com/gui/url/980d92f446838b530688fedc5c1289b3d69cde02690b950c1cc4a ... show more VirusTotal: https://www.virustotal.com/gui/url/980d92f446838b530688fedc5c1289b3d69cde02690b950c1cc4ae1cf27b3398/detection, related to Phishing & Malware / Adult Content show less	Phishing Hacking Exploited Host
🇺🇸 208.100.26.245	11 Nov 2023	Emotet Trojan related, VT: https://www.virustotal.com/gui/url/2c87d7e2aa0ba5f7553de71d80f1d7fadf0057 ... show more Emotet Trojan related, VT: https://www.virustotal.com/gui/url/2c87d7e2aa0ba5f7553de71d80f1d7fadf00574a72b0ff6a6b5c299c3c658c37/ show less	Hacking Exploited Host
🇺🇸 104.237.62.212	11 Nov 2023	Mallox Ransomware Sample tried to connect to this IP, view analysis here: https://app.any.run/tasks/ ... show more Mallox Ransomware Sample tried to connect to this IP, view analysis here: https://app.any.run/tasks/fd70abbd-2aad-402a-bdd0-1bdac28ad266, MD5: b54d7da0fe6869006ffd3b9b470f0dc4 show less	Hacking Exploited Host
🇷🇺 91.215.85.142	11 Nov 2023	Mallox Ransomware sample attempted to connect to this IP, view analysis here https://app.any.run/tas ... show more Mallox Ransomware sample attempted to connect to this IP, view analysis here https://app.any.run/tasks/fd70abbd-2aad-402a-bdd0-1bdac28ad266 show less	Hacking Exploited Host
🇺🇸 104.21.4.159	11 Nov 2023	Lokibot Trojan Callback IP. Domain: evil22.dhabigroup.top, MD5 Hash: 95A4A7D736C24E87886E30C0D4728EF ... show more Lokibot Trojan Callback IP. Domain: evil22.dhabigroup.top, MD5 Hash: 95A4A7D736C24E87886E30C0D4728EFD show less	Hacking Exploited Host
239.255.255.250	11 Nov 2023	Conti / Zusy Attack Callback IP, Analyzed in sandbox here: https://app.any.run/tasks/97dab8dd-f35a-4 ... show more Conti / Zusy Attack Callback IP, Analyzed in sandbox here: https://app.any.run/tasks/97dab8dd-f35a-4e91-b2e7-a37243013b0a show less	Hacking
🇳🇱 194.49.94.77	11 Nov 2023	Redline Attack Callback IP, MD5 Hash: AFAABC45361E7EC8636707E81AC84F17, Check the analysis for the R ... show more Redline Attack Callback IP, MD5 Hash: AFAABC45361E7EC8636707E81AC84F17, Check the analysis for the Redline Attack here: https://app.any.run/tasks/ccadb50b-88c3-46eb-bc5a-32bf65651ba3, ASN: Enes Koken show less	Hacking
🇧🇴 200.87.164.69	11 Nov 2023	National Security Bureau Ransomware Callback IP, Analysed here: https://app.any.run/tasks/df5e1809-1 ... show more National Security Bureau Ransomware Callback IP, Analysed here: https://app.any.run/tasks/df5e1809-168c-4eac-86e1-d29e25dcf1f4, MD5 Hash for Ransomware: 29671c98a348fb110b427cef0e0a3014, Port 9999, ASN: Entel S.A. - EntelNet show less	Hacking
🇧🇬 91.139.154.107	11 Nov 2023	National Security Bureau Ransomware Callback IP, Analysed here: https://app.any.run/tasks/df5e1809-1 ... show more National Security Bureau Ransomware Callback IP, Analysed here: https://app.any.run/tasks/df5e1809-168c-4eac-86e1-d29e25dcf1f4, MD5 Hash for Ransomware: 29671c98a348fb110b427cef0e0a3014, Port 13306, ASN: Bulsatcom EOOD show less	Hacking
🇦🇷 179.38.131.7	11 Nov 2023	National Security Bureau Ransomware Callback IP, Analysed here: https://app.any.run/tasks/df5e1809-1 ... show more National Security Bureau Ransomware Callback IP, Analysed here: https://app.any.run/tasks/df5e1809-168c-4eac-86e1-d29e25dcf1f4, MD5 Hash for Ransomware: 29671c98a348fb110b427cef0e0a3014, Port 24, ASN: Telefonica de Argentina show less	Hacking
🇧🇴 200.119.204.12	11 Nov 2023	National Security Bureau Ransomware Callback IP, Analysed here: https://app.any.run/tasks/df5e1809-1 ... show more National Security Bureau Ransomware Callback IP, Analysed here: https://app.any.run/tasks/df5e1809-168c-4eac-86e1-d29e25dcf1f4, MD5 Hash for Ransomware: 29671c98a348fb110b427cef0e0a3014, Port 9999, ASN: COTAS LTDA., this ransomware came out of BO. show less	Hacking Exploited Host
🇷🇺 158.160.73.47	11 Nov 2023	Tofsee Botnet Miner Report, Sandboxed Analysis: https://app.any.run/tasks/8f5ac63e-bb69-4862-85e3-96 ... show more Tofsee Botnet Miner Report, Sandboxed Analysis: https://app.any.run/tasks/8f5ac63e-bb69-4862-85e3-96d261290293/, Malware MD5: F01168E4B610509F528BCA4D244FA0A1 this IP was a callback. show less	Hacking Exploited Host
🇻🇬 194.169.175.128	11 Nov 2023	Distributing GCleaner Ransomware, Malicious US IP, Sandboxed Analysis of Malware here: https://app.a ... show more Distributing GCleaner Ransomware, Malicious US IP, Sandboxed Analysis of Malware here: https://app.any.run/tasks/9fcad756-616e-43b5-9e73-37638f10f089/, MD5 on Malware: D0290788A3AA85B2AD7705C975E4174D show less	Hacking Exploited Host
🇳🇱 45.15.156.229	11 Nov 2023	Distributing Malware, GCleaner Ransomware, Sandboxed Analysis: https://app.any.run/tasks/9fcad756-61 ... show more Distributing Malware, GCleaner Ransomware, Sandboxed Analysis: https://app.any.run/tasks/9fcad756-616e-43b5-9e73-37638f10f089/, Russian, Port 80 show less	Hacking Exploited Host
🇫🇷 194.33.191.60	11 Nov 2023	Distributing GCleaner malware, Ransomware Callback. Malicious IP as report says: https://app.any.run ... show more Distributing GCleaner malware, Ransomware Callback. Malicious IP as report says: https://app.any.run/tasks/9fcad756-616e-43b5-9e73-37638f10f089/, Countries: France / BZ show less	Hacking Exploited Host
🇬🇧 149.154.167.99	11 Nov 2023	GCleaner attack, Ransomware / Malware Calback to Telegram (Telegram RAT), Country: GB	Hacking Exploited Host
🇳🇱 94.142.138.113	11 Nov 2023	Distributing Malware in GCleaner attacks. You can view the sandboxed version of the attack here: htt ... show more Distributing Malware in GCleaner attacks. You can view the sandboxed version of the attack here: https://app.any.run/tasks/9fcad756-616e-43b5-9e73-37638f10f089/, Country: RU, ASN Network Management Ltd show less	Hacking Exploited Host
🇷🇺 85.209.11.204	11 Nov 2023	Malicious IP from this attack: https://app.any.run/tasks/9fcad756-616e-43b5-9e73-37638f10f089/ Amad ... show more Malicious IP from this attack: https://app.any.run/tasks/9fcad756-616e-43b5-9e73-37638f10f089/ Amaday/GCleaner attack. MD5: D0290788A3AA85B2AD7705C975E4174D. ASN: LLC Baxet, Country: RU, port: 80 show less	Hacking Exploited Host