AbuseIPDB

JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

User adamivie joined AbuseIPDB in September 2026 and has reported 7 IP addresses.

Standing (weight) is Unknown.

ACTIVE USER

IP	Date	Comment	Categories
🇺🇸 45.32.65.138	19 Sep 2026	Private Monero mining pool (:443 TLS) for cryptojacking botnet 'sparky'. Second Vultr host alongside ... show more Private Monero mining pool (:443 TLS) for cryptojacking botnet 'sparky'. Second Vultr host alongside 208.167.233.7. Fleet C2 80.74.30.4:8765. Samples on VirusTotal/MalwareBazaar. show less	Hacking Exploited Host
🇻🇳 103.249.201.108	19 Sep 2026	Malware staging (:81) for XMRig/Rigel cryptojacking payloads. Access via exposed ComfyUI (--listen), ... show more Malware staging (:81) for XMRig/Rigel cryptojacking payloads. Access via exposed ComfyUI (--listen), 2026-07..09. Samples on VirusTotal. show less	Hacking Exploited Host Web App Attack
🇫🇷 217.76.63.67	19 Sep 2026	Malware staging (:81) for XMRig/Rigel cryptojacking payloads. Access via exposed ComfyUI (--listen), ... show more Malware staging (:81) for XMRig/Rigel cryptojacking payloads. Access via exposed ComfyUI (--listen), 2026-07..09. Samples on VirusTotal. show less	Hacking Exploited Host Web App Attack
🇺🇸 165.245.138.247	19 Sep 2026	Malware staging: /private/xmrig-win.zip, rigel-win.zip. Access via exposed ComfyUI (--listen), 2026- ... show more Malware staging: /private/xmrig-win.zip, rigel-win.zip. Access via exposed ComfyUI (--listen), 2026-07..09. Samples on VirusTotal. show less	Hacking Exploited Host Web App Attack
🇺🇸 208.167.233.7	19 Sep 2026	Private Monero mining pool (TLS) for cryptojacking botnet. Access via exposed ComfyUI (--listen), 20 ... show more Private Monero mining pool (TLS) for cryptojacking botnet. Access via exposed ComfyUI (--listen), 2026-07..09. Samples on VirusTotal. show less	Hacking Exploited Host
🇩🇰 193.181.209.137	19 Sep 2026	Remote-access trojan C2 (WebSocket, 'cluster5'): shell/file/screenshot. Access via exposed ComfyUI ( ... show more Remote-access trojan C2 (WebSocket, 'cluster5'): shell/file/screenshot. Access via exposed ComfyUI (--listen), 2026-07..09. Samples on VirusTotal. show less	Hacking Exploited Host
🇳🇱 80.74.30.4	19 Sep 2026	Fleet control plane C2; +Gitea payload repo :3000. Operator 'sparky'. Access via exposed ComfyUI (-- ... show more Fleet control plane C2; +Gitea payload repo :3000. Operator 'sparky'. Access via exposed ComfyUI (--listen), 2026-07..09. Samples on VirusTotal. show less	Hacking Exploited Host