AbuseIPDB

JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

User sandfield_secops joined AbuseIPDB in November 2026 and has reported 8 IP addresses.

Standing (weight) is Unknown.

ACTIVE USER

IP	Date	Comment	Categories
🇺🇸 136.65.170.66	13 Nov 2026	Crowdstrike detection. Name: Generic - Web - Node.js Remote Code Execution Description: This rule de ... show more Crowdstrike detection. Name: Generic - Web - Node.js Remote Code Execution Description: This rule detects potential Node.js remote code execution (RCE) attacks through web applications by identifying Node.js function calls in HTTP requests. The detection covers multiple attack vectors including require() function calls targeting dangerous modules (child_process, fs, os, etc.), process object manipulation, global object access, and execution functions like execSync, spawn, and fork. The rule analyzes URL paths, user agent header, and request body for JavaScript injection patterns, which are commonly used in attacks like CVE-2025-55182 (React2Shell) targeting React Server Components and similar Node.js applications. Note: This rule requires customization before production use. Please select the appropriate vendors for your CID, evaluate for potential false positives, and apply necessary tuning based on your environment's characteristics. show less	Web App Attack
🇺🇸 136.69.180.179	09 Nov 2026	Crowdstrike detection. Name: Generic - Web - Node.js Remote Code Execution Description: This rule de ... show more Crowdstrike detection. Name: Generic - Web - Node.js Remote Code Execution Description: This rule detects potential Node.js remote code execution (RCE) attacks through web applications by identifying Node.js function calls in HTTP requests. The detection covers multiple attack vectors including require() function calls targeting dangerous modules (child_process, fs, os, etc.), process object manipulation, global object access, and execution functions like execSync, spawn, and fork. The rule analyzes URL paths, user agent header, and request body for JavaScript injection patterns, which are commonly used in attacks like CVE-2025-55182 (React2Shell) targeting React Server Components and similar Node.js applications. Note: This rule requires customization before production use. Please select the appropriate vendors for your CID, evaluate for potential false positives, and apply necessary tuning based on your environment's characteristics. show less	Web App Attack
🇸🇮 102.220.161.89	09 Nov 2026	Crowdstrike detection. Name: Generic - Network - IP Address IOC Match Description: This rule identif ... show more Crowdstrike detection. Name: Generic - Network - IP Address IOC Match Description: This rule identifies network traffic involving suspicious IP addresses by using a lookup in CrowdStrike's database of IOCs. The rule considers IOCs with a confidence level of 'unverified' or higher. Note that the confidence level threshold can be adjusted as necessary. For more information about the ioc:lookup() function, see https://library.humio.com/data-analysis/functions-ioc-lookup.html. show less	Web App Attack
🇺🇸 136.64.140.209	09 Nov 2026	Crowdstrike detection. Name: Generic - Web - Node.js Remote Code Execution Description: This rule de ... show more Crowdstrike detection. Name: Generic - Web - Node.js Remote Code Execution Description: This rule detects potential Node.js remote code execution (RCE) attacks through web applications by identifying Node.js function calls in HTTP requests. The detection covers multiple attack vectors including require() function calls targeting dangerous modules (child_process, fs, os, etc.), process object manipulation, global object access, and execution functions like execSync, spawn, and fork. The rule analyzes URL paths, user agent header, and request body for JavaScript injection patterns, which are commonly used in attacks like CVE-2025-55182 (React2Shell) targeting React Server Components and similar Node.js applications. Note: This rule requires customization before production use. Please select the appropriate vendors for your CID, evaluate for potential false positives, and apply necessary tuning based on your environment's characteristics. show less	Web App Attack
🇺🇸 35.227.72.242	09 Nov 2026	Crowdstrike detection. Name: Generic - Web - Node.js Remote Code Execution Description: This rule de ... show more Crowdstrike detection. Name: Generic - Web - Node.js Remote Code Execution Description: This rule detects potential Node.js remote code execution (RCE) attacks through web applications by identifying Node.js function calls in HTTP requests. The detection covers multiple attack vectors including require() function calls targeting dangerous modules (child_process, fs, os, etc.), process object manipulation, global object access, and execution functions like execSync, spawn, and fork. The rule analyzes URL paths, user agent header, and request body for JavaScript injection patterns, which are commonly used in attacks like CVE-2025-55182 (React2Shell) targeting React Server Components and similar Node.js applications. Note: This rule requires customization before production use. Please select the appropriate vendors for your CID, evaluate for potential false positives, and apply necessary tuning based on your environment's characteristics. show less	Web App Attack
🇸🇬 34.126.114.217	09 Nov 2026	Crowdstrike detection. Name: Generic - Web - Node.js Remote Code Execution Description: This rule de ... show more Crowdstrike detection. Name: Generic - Web - Node.js Remote Code Execution Description: This rule detects potential Node.js remote code execution (RCE) attacks through web applications by identifying Node.js function calls in HTTP requests. The detection covers multiple attack vectors including require() function calls targeting dangerous modules (child_process, fs, os, etc.), process object manipulation, global object access, and execution functions like execSync, spawn, and fork. The rule analyzes URL paths, user agent header, and request body for JavaScript injection patterns, which are commonly used in attacks like CVE-2025-55182 (React2Shell) targeting React Server Components and similar Node.js applications. Note: This rule requires customization before production use. Please select the appropriate vendors for your CID, evaluate for potential false positives, and apply necessary tuning based on your environment's characteristics. show less	Web App Attack
🇹🇼 35.201.218.155	09 Nov 2026	Crowdstrike detection. Name: Generic - Web - Node.js Remote Code Execution Description: This rule de ... show more Crowdstrike detection. Name: Generic - Web - Node.js Remote Code Execution Description: This rule detects potential Node.js remote code execution (RCE) attacks through web applications by identifying Node.js function calls in HTTP requests. The detection covers multiple attack vectors including require() function calls targeting dangerous modules (child_process, fs, os, etc.), process object manipulation, global object access, and execution functions like execSync, spawn, and fork. The rule analyzes URL paths, user agent header, and request body for JavaScript injection patterns, which are commonly used in attacks like CVE-2025-55182 (React2Shell) targeting React Server Components and similar Node.js applications. Note: This rule requires customization before production use. Please select the appropriate vendors for your CID, evaluate for potential false positives, and apply necessary tuning based on your environment's characteristics. show less	Web App Attack
🇸🇬 34.124.183.55	09 Nov 2026	Crowdstrike detection. Name: Generic - Web - Node.js Remote Code Execution Description: This rule de ... show more Crowdstrike detection. Name: Generic - Web - Node.js Remote Code Execution Description: This rule detects potential Node.js remote code execution (RCE) attacks through web applications by identifying Node.js function calls in HTTP requests. The detection covers multiple attack vectors including require() function calls targeting dangerous modules (child_process, fs, os, etc.), process object manipulation, global object access, and execution functions like execSync, spawn, and fork. The rule analyzes URL paths, user agent header, and request body for JavaScript injection patterns, which are commonly used in attacks like CVE-2025-55182 (React2Shell) targeting React Server Components and similar Node.js applications. Note: This rule requires customization before production use. Please select the appropriate vendors for your CID, evaluate for potential false positives, and apply necessary tuning based on your environment's characteristics. show less	Web App Attack