AbuseIPDB

JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

User raj4k joined AbuseIPDB in October 2026 and has reported 5 IP addresses.

Standing (weight) is Unknown.

ACTIVE USER

IP	Date	Comment	Categories
🇽🇰 217.60.194.116	20 Oct 2026	Malware distribution: serves a Linux shell dropper at hxxp://217.60.194.116/docker, fetched by a mal ... show more Malware distribution: serves a Linux shell dropper at hxxp://217.60.194.116/docker, fetched by a malicious .so planted on a compromised Plex Media Server via (wget\|curl ...)\|sh on 2026-10-17 15:11 UTC; it installs XMRig 6.26.0. Same IP served as mining pool ota.proxystream.st:3333 (rig-id plexdocker) from 2026-10-17 16:50 UTC. Dropper .so SHA-256 a9a309154493193c70bf6f805fe70e1bc4e9564e2f0e20cd1600c72587c7e65f show less	Exploited Host Hacking
🇱🇹 77.90.185.205	20 Oct 2026	Malware distribution: serves a Linux shell dropper at hxxp://77.90.185.205/m/sh, fetched by a malici ... show more Malware distribution: serves a Linux shell dropper at hxxp://77.90.185.205/m/sh, fetched by a malicious .so planted on a compromised Plex Media Server via (wget\|curl ...)\|sh; it installs XMRig 6.26.0. Same IP answers as mining pool ota.proxystream.st:3333 (rig-id plexdocker), seen 2026-10-17 to 2026-10-20 UTC. Dropper .so SHA-256 24a0402b5cb0b79050739683884b303fadaa8083c3aec686eb4ba65d6dc08738 show less	Exploited Host Hacking
🇺🇸 37.19.196.123	20 Oct 2026	Plex Media Server exploit attempt on TCP 32400 at 2026-10-20 13:47:34 UTC: unauthenticated SSRF requ ... show more Plex Media Server exploit attempt on TCP 32400 at 2026-10-20 13:47:34 UTC: unauthenticated SSRF request GET /player/timeline/subscribe?deviceClass=pc&protocolCapabilities=playback&protocolVersion=1&protocol=http://127.0.0.1:32400/system/... Same request chain other hosts used that week to steal the owner token and load a malicious transcoder .so (XMRig dropper). show less	Web App Attack Hacking
🇳🇱 91.92.40.202	20 Oct 2026	Exploited Plex Media Server (TCP 32400) on 2026-10-18 16:05, 2026-10-19 22:17 and 2026-10-20 16:41 U ... show more Exploited Plex Media Server (TCP 32400) on 2026-10-18 16:05, 2026-10-19 22:17 and 2026-10-20 16:41 UTC: unauthenticated SSRF via GET /player/timeline/subscribe (protocol=http://127.0.0.1:32400/system/...), stolen owner token, then PUT /:/prefs?TranscoderH264Options=dump-yuv=.../Codecs/.../zz1792514482846613302.so:qp=0 so the transcoder loaded a malicious .so that installed XMRig. Callbacks on 91-92-40-202.sslip.io ports 33329/40175/40537. show less	Exploited Host Web App Attack Hacking
🇨🇦 45.194.92.222	20 Oct 2026	Exploited Plex Media Server (TCP 32400), 10 runs 2026-10-18 12:20 to 2026-10-19 14:59 UTC: unauthent ... show more Exploited Plex Media Server (TCP 32400), 10 runs 2026-10-18 12:20 to 2026-10-19 14:59 UTC: unauthenticated SSRF via GET /player/timeline/subscribe (protocol=http://127.0.0.1:32400/system/agents/.../searchOne), stolen owner token, then PUT /:/prefs?TranscoderH264Options=dump-yuv=.../Codecs/.../zz2aab11c3.so:qp=0 so the transcoder loaded a malicious .so that installed XMRig (pool ota.proxystream.st:3333). Callbacks on 127.0.0.1.45-194-92-222.sslip.io:8952/8954/8958. show less	Exploited Host Web App Attack Hacking