LIT-BR0169 - AbuseIPDB User Profile

JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

User LIT-BR0169 joined AbuseIPDB in December 2025 and has reported 27 IP addresses.

Standing (weight) is good.

ACTIVE USER

IP	Date	Comment	Categories
🇺🇸 54.240.8.62	02 Jun 2026	Credential Harvesting behavior, phishing hosting.	Phishing
🇺🇸 162.240.162.190	19 Apr 2026	Spam. E-mails quarantined.	Email Spam
🇺🇸 74.207.235.70	19 Apr 2026	Malicious repository http://74.207.235.70/promotion.php	Hacking Web App Attack
🇵🇰 223.123.38.36	02 Mar 2026	IP meets block IP policy to Mitrotik devices (network sniffing device) tcp/16150	Port Scan
🇨🇳 81.70.136.146	23 Jan 2026	P2P connexion via BitTorrent.	Port Scan
🇧🇷 170.78.119.172	08 Jan 2026	Attempt succeeded to connect via SSH to one of our client's host	SSH
🇺🇸 66.175.211.202	03 Jan 2026	Request a predictable resource using the string hostxxxxx/administrator/manifests/files/joomla.xml	Web App Attack
🇺🇸 40.83.53.97	29 Dec 2025	site hosts a malicious payload. Found this file hash associated 3B86B8E3E2B3B2C5B1B958136DF5569C4165 ... show more site hosts a malicious payload. Found this file hash associated 3B86B8E3E2B3B2C5B1B958136DF5569C41652CAE show less	Hacking
🇺🇸 209.126.5.94	26 Dec 2025	Path transversal attempt by using the command "lang=../../../../../../../../tmp/index1 lang=../../.. ... show more Path transversal attempt by using the command "lang=../../../../../../../../tmp/index1 lang=../../../../../../../../usr/local/lib/php/pearcmd&+config-create+/&/<?echo(md5(\"hi\"));?>+/tmp/index1.php" show less	Web App Attack
🇺🇸 50.49.206.242	19 Dec 2025	Path transversal attempt using the command lang=../../../../../../../../usr/local/lib/php/pearcmd&+c ... show more Path transversal attempt using the command lang=../../../../../../../../usr/local/lib/php/pearcmd&+config-create+/&/<?echo(md5("hi"));?>+/tmp/index1.php show less	Web App Attack
🇺🇸 198.160.6.4	16 Dec 2025	Requesting parameters that violates policies, using the following commando: /channel/online/lrsa- ... show more Requesting parameters that violates policies, using the following commando: /channel/online/lrsa-bff-app/v22/recommendation/tracking?locale show less	Web App Attack
🇺🇸 207.90.244.19	16 Dec 2025	tcp port scan up to 1000 different ports.	Port Scan
🇺🇸 23.19.231.99	16 Dec 2025	Attempt to exploit the CVE-2025-55182 NextJS Vulnerability	Web App Attack
🇺🇸 206.41.72.116	16 Dec 2025	Attempt to exploit the CVE-2025-55182 NextJS Vulnerability	Web App Attack
🇺🇸 34.44.222.88	14 Dec 2025	Path Transversal attempt to one of our clients, requests made: chemin=../../../../../../etc/passw ... show more Path Transversal attempt to one of our clients, requests made: chemin=../../../../../../etc/passwd&nomgif=0ZbX chemin=../../../../../../etc/passwd&nomgif=tarik content=../../../../../../../../etc/passwd down&dbPath=../../../../../../etc/passwd file=../../../../../../../../../../etc/passwd file=../../../../../../../../etc/passwd file=/../../../../../../etc/passwd file=/etc/./passwd filename=../../../../../../../../../../../../../../etc/passwd filename=../../../../etc/passwd flag=save&realFileType=../../../../ApacheJetspeed/webapps/ROOT/8UmzUb.jsp&fileId=2 fn=../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../etc/passwd g=sys_dia_data_down&file_name=../../../../../../../../../../../../etc/passwd id=../../../../../myoa/attach/approve_center/2510/%3E%3E%3E%3E%3E%3E%3E%3E%3E%3E%3E.fb6790f4 id=50&file=../../../../../../../../../etc/passwd show less	Web App Attack
🇺🇸 34.58.169.33	14 Dec 2025	Path Transversal attempt using these commands: FILE=../../../../../../../../../../windows/win.ini ... show more Path Transversal attempt using these commands: FILE=../../../../../../../../../../windows/win.ini FILE=../../../../../../../../../../windows/win.ini?FILE=../../../../../../../../../../boot.ini FILE=../../../../../../../../../../windows/win.ini?FILE=../../../../../../../../../../boot.ini?FILE=../../../../../../../../../../winnt/win.ini FILE=../../../../../../../../../../windows/win.ini?FILE=../../../../../../../../../../boot.ini?FILE=../../../../../../../../../../winnt/win.ini?FILE=../../../../../../../../../../etc/passwd F_notini=&T_note=&nomentreprise=blah&filenote=../../etc/passwd F_notini=&T_note=&nomentreprise=blah&filenote=../../winnt/win.ini show less	Web App Attack
🇺🇸 160.153.176.241	13 Dec 2025	I am reporting the IP 160.153.176.241 for hosting malicious content accessible via https://241.176. ... show more I am reporting the IP 160.153.176.241 for hosting malicious content accessible via https://241.176.153.160.host.secureserver.net/15172247171026/151722471710264537382161 . This resource appears to be used for malicious activity. Reported by Julio at Logical IT. show less	Phishing
🇺🇸 150.241.206.248	13 Dec 2025	Path transversal attempt, using the syntax "lang=../../../../../../../../tmp/index1" ~Reported by ... show more Path transversal attempt, using the syntax "lang=../../../../../../../../tmp/index1" ~Reported by SOC - Logical IT show less	Web App Attack
🇺🇸 50.35.69.30	11 Dec 2025	Attempt to exploit the next.js vulnerability to one of our clients.	Hacking
🇺🇸 96.250.84.167	11 Dec 2025	Tor Node.	DNS Compromise
🇧🇷 181.191.9.80	10 Dec 2025	Connection to a TOR destination port (9050 or 9051).	DNS Compromise
🇺🇸 34.59.175.189	09 Dec 2025	Path transversal attempt, by requesting these args "lang=../../../../../../../../tmp/index1" AND lan ... show more Path transversal attempt, by requesting these args "lang=../../../../../../../../tmp/index1" AND lang=../../../../../../../../usr/local/lib/php/pearcmd&+config-create+/&/<?echo(md5("hi"));?>+/tmp/index1.php. show less	Web App Attack
🇸🇬 139.59.101.238	06 Dec 2025	Multiple requests to subdomains xxxxxx.mattosfilho.com.br	Port Scan
🇺🇸 194.54.144.89	06 Dec 2025	Multiple requests to the same corp. destination IP: 104.xx.190.17x	DDoS Attack Web App Attack
🇺🇸 162.241.63.14	05 Dec 2025	The IP is hosting a malicious landing page used to serve malware payloads. Connection attempts wer ... show more The IP is hosting a malicious landing page used to serve malware payloads. Connection attempts were detected from an internal asset when accessing the URL www[.]fabrikadeeventos[.]com[.]br. Timestamp (UTC): 2025-12-05 12:43. Reported by Logical IT (SOC). show less	Web App Attack