A user received an email with a URL which then downloaded Wave Browser - 2026-04-17T172513.328.exe ( ...
show moreA user received an email with a URL which then downloaded Wave Browser - 2026-04-17T172513.328.exe (AppData\Local\Temp\Wave\SWUpdaterSetup.exe).
During the execution, the application process ran a DNS query for api.wavebrowserbase.com which was this IP 54.197.90.92.
Wave Browser is a browser hijacker that adds unwanted components to the user's browser.
show less
Cisco Meraki reporting SERVER-OTHER limited RSA ciphersuite list - possible Bleichenbacher SSL attac ...
show moreCisco Meraki reporting SERVER-OTHER limited RSA ciphersuite list - possible Bleichenbacher SSL attack attempt
show less
CrowdStrike: There was a third-party detection received by CRWD NGSIEM (not correlation rule based). ...
show moreCrowdStrike: There was a third-party detection received by CRWD NGSIEM (not correlation rule based). Name: SERVER-OTHER limited RSA ciphersuite list - possible Bleichenbacher SSL attack attempt -- meraki:intrusion/snort/GID/1/SID/45200
show less
209.46.121.78 was the Sender IP address to send an email that appeared as RingCentral Voice Mail. Us ...
show more209.46.121.78 was the Sender IP address to send an email that appeared as RingCentral Voice Mail. User then opens up attachment that presents Microsoft 365 sign-in page where the user enters credentials. It's a Man in the middle attack.
show less
Source IP attempted a method on port 443 to deploy Korplug Command and Control Traffic Detection.
G ...
show moreSource IP attempted a method on port 443 to deploy Korplug Command and Control Traffic Detection.
Google the IP owner which is Eonix Corporation. You'll find numerous negative comments going back 4+ years.
show less
the IP address "193.111.248.54 (spectrum.com)" as a medium-risk entity due to traffic activity on po ...
show morethe IP address "193.111.248.54 (spectrum.com)" as a medium-risk entity due to traffic activity on port 500, which has activated the offense indicator "SERVER-WEBAPP Zyxel unauthenticated IKEv2 overflow attempt". Upon further examination, it is noted that this IP has a history of being marked as a scanning IP and is currently triggering alerts for both "SERVER-WEBAPP Zyxel unauthenticated IKEv2 overflow attempt" and "SERVER-WEBAPP Zyxel unauthenticated IKEv2 command injection attempt". Evidence indicates that this activity has been permitted by Meraki's configuration.
show less
Detected ssh: Server version string overflow sourcing '172.234.96.249', which is located Stockholm, ...
show moreDetected ssh: Server version string overflow sourcing '172.234.96.249', which is located Stockholm, Sweden and has a risk score 100% and has categorized as Port Scan, Hacking, Brute-Force, SQL Injection and Web App Attack.
Source Details:
IP: 172.234.96.249
Hostname: 172-234-96-249.ip.linodeusercontent.com
Username: N/A
Destination Details:
IP: 76.8.204.50
Hostname:
show less
Mar 13, 2024, 8:52:48 PM - 10 attempts on port 443
SERVER-WEBAPP Facade Ignition remote code exec ...
show moreMar 13, 2024, 8:52:48 PM - 10 attempts on port 443
SERVER-WEBAPP Facade Ignition remote code execution attempt
show less
Detected SERVER-WEBAPP Zyxel unauthenticated IKEv2 overflow attempt sourcing from IP:'98.194.65.92' ...
show moreDetected SERVER-WEBAPP Zyxel unauthenticated IKEv2 overflow attempt sourcing from IP:'98.194.65.92' towards destination IP:'<Public IP>' over port 500 on log source 'Cisco Meraki @ <Private IP>'. We can see that the source IP has a risk score of 100% according to AbuseIPDB and was reported 34 times for Exploited Host, Port Scan, VPN IP, Hacking.
show less
Brute-Force
By clicking โAccept allโ, you agree to the storing of cookies on your device to remember preferences and
analyze site usage.
Read more
- Required to log into your AbuseIPDB account, and store these cookie preferences.