✅ Echter Angriff wäre:
hunderte Login-Versuche pro Minute
gültiger Benutzername
Exploit-Sig ...
show more✅ Echter Angriff wäre:
hunderte Login-Versuche pro Minute
gültiger Benutzername
Exploit-Signaturen
erfolgreiche Anmeldung
Payload-Download
➡️ Davon sieht man hier nichts
show less
This IP address (13.107.213.45) belongs to Microsoft infrastructure and is used by Minecraft (Micros ...
show moreThis IP address (13.107.213.45) belongs to Microsoft infrastructure and is used by Minecraft (Microsoft / Mojang) for official servers and online services.
The traffic is legitimate and does not represent spam, attacks, or any abusive activity.
Please do not block or blacklist this IP, as doing so may cause connectivity issues with Minecraft servers and Microsoft services.
show less
The IP address 5.189.141.190 generated extremely high volumes of unsolicited
TCP traffic toward my ...
show moreThe IP address 5.189.141.190 generated extremely high volumes of unsolicited
TCP traffic toward my network over an extended period (approx. 20 hours).
A total of more than 2.5 million packets and around 837 MB of data were observed
from this source.
The host repeatedly contacted multiple uncommon and non-standard ports
(26285, 10191, 14706, 18612, 20293, 3111), which strongly indicates a
port scan, vulnerability probing, or automated attack behavior commonly
associated with botnets.
Only 8 flows were established, yet millions of packets were transmitted,
which is characteristic of flooding or aggressive scanning activity.
No legitimate services operate on these ports in my network.
This traffic is clearly malicious or suspicious.
Please investigate this host for compromise or abusive activity.
show less
Sehr geehrtes Team,
ich möchte einen Sicherheitsvorfall melden. Mehrere Versuche wurden aufgezeic ...
show moreSehr geehrtes Team,
ich möchte einen Sicherheitsvorfall melden. Mehrere Versuche wurden aufgezeichnet, bei denen Angreifer versuchten, mit Shellcode über Port 80 auf unsere Ziel-IP 192.168.178.155 zuzugreifen. Die Quell-IP-Adressen sind hauptsächlich 137.221.64.4, 137.221.64.7, 137.221.64.8 und 95.100.146.98.
Die Alarme beinhalten:
INDICATOR-SHELLCODE x86 NOOP
INDICATOR-SHELLCODE x86 inc ecx NOOP
INDICATOR-SHELLCODE x86 setgid 0
Diese Versuche wurden blockiert, aber ich möchte sicherstellen, dass zusätzliche Maßnahmen ergriffen werden, um zukünftige Angriffe zu verhindern. Bitte bestätigen Sie die Untersuchung und mögliche Sicherheitsmaßnahmen.
Vielen Dank für Ihre Unterstützung.
show less
Dear Abuse Team,
I would like to report repeated suspicious Command & Control (C2) traffic origin ...
show moreDear Abuse Team,
I would like to report repeated suspicious Command & Control (C2) traffic originating from one of your IP addresses.
Our network monitoring system Maltrail detected multiple connections to the following host:
Destination IP: 185.111.111.157
Destination Port: 443 (HTTPS)
Source IPs (internal):
192.168.13.188 → Source Ports: 62989, 62990, 63610, 63615, 64411
192.168.13.190 → Source Port: 80 (HTTP)
First Seen: 2025-08-16
Last Seen: 2025-08-18
Detection: Adaptix C2 (malicious)
Reference: Maltrail threat intelligence
The activity was observed yesterday and today, not only as a single incident.
Due to the repeated malicious behavior, I have manually blocked this IP in our firewall.
Please investigate this issue and take the necessary action. I can provide the full Maltrail logs if needed.
show less
This host appears to be associated with “Adaptix C2”, a known Command-and-Control (C2) malware frame ...
show moreThis host appears to be associated with “Adaptix C2”, a known Command-and-Control (C2) malware framework.
Such malware is typically used by attackers to establish a covert remote connection to an infected system, enabling them to spy on user activity, exfiltrate sensitive data, and deploy additional malicious payloads.
Detection indicates that my system may be actively compromised and controlled by a remote attacker via this C2 server. This poses a serious risk of data theft and privacy breach.
Please investigate and take immediate action to shut down this malicious activity.
show less
Zeitstempel 2025-08-02T16:50:07.488718+0200
Alarm ET SHELLCODE Common 0a0a0a0a Heap Spray String
A ...
show moreZeitstempel 2025-08-02T16:50:07.488718+0200
Alarm ET SHELLCODE Common 0a0a0a0a Heap Spray String
Alarm SID 2012252
Protokoll TCP
Quell-IP 146.75.118.172
Ziel IP 192.168.178.155
Quellport 80
Zielport 11235
Schnittstelle WAN
show less
Port ScanHackingExploited Host
By clicking “Accept all”, you agree to the storing of cookies on your device to remember preferences and
analyze site usage.
Read more
- Required to log into your AbuseIPDB account, and store these cookie preferences.