AbuseIPDB

JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

User Cyber_Alison joined AbuseIPDB in April 2021 and has reported 31 IP addresses.

Standing (weight) is good.

INACTIVE USER

IP	Date	Comment	Categories
🇨🇳 123.234.2.84	18 May 2023	Domain associated with cobalt strike attack kfg5szsj.slt.sched.tdnsv8[.]com	DNS Compromise Open Proxy
🇨🇳 123.234.2.86	18 May 2023	Domain associated with cobalt strike attack kfg5szsj.slt.sched.tdnsv8[.]com	DNS Compromise Open Proxy
🇺🇸 104.20.139.65	26 Feb 2023	Malicious URL tinyurl.com/3h3f7ckn Associated with Win32 Malware	Web Spam Hacking
🇺🇸 172.67.1.225	26 Feb 2023	Malicious URL tinyurl.com/3h3f7ckn Associated with Win32 malware	Hacking
🇺🇸 104.20.138.65	26 Feb 2023	Spam link tinyurl.com/3h3f7ckn Associated with Win32 malware	Web Spam Hacking
🇺🇸 104.243.35.171	10 Jan 2023	SIP Vicious Scans detected	Hacking Brute-Force
🇧🇷 201.10.26.25	30 Dec 2022	MVPower DVR Shell Unauthenticated Command Execution Vulnerability Attempt	Hacking
🇨🇳 115.236.118.54	30 Dec 2022	Linked with phishing campaign	Phishing
🇨🇳 123.58.180.8	30 Dec 2022	Linked with phishing email campaign	Phishing
🇺🇸 72.21.81.240	29 Dec 2022	Suspected NTLM Relay Attack (NTLMSSP) or SPNEGO Vulnerability Exploit. Target Domain Controller. Su ... show more Suspected NTLM Relay Attack (NTLMSSP) or SPNEGO Vulnerability Exploit. Target Domain Controller. Suspicious GET File Download Attempted. show less	Hacking Exploited Host
🇺🇸 104.21.61.196	10 Jan 2022	IP linked to site www.drivellcar.com publishing defamatory content	Web Spam
🇧🇿 179.60.150.32	30 Aug 2021	Associated with IP-179.60.150.32 URL: hxxp://179.60.150[.]31:53/init[.]exe · User agent: Microsoft ... show more Associated with IP-179.60.150.32 URL: hxxp://179.60.150[.]31:53/init[.]exe · User agent: Microsoft-CryptoAPI/6.2, CertUtil URL Agent · Destination IP: 179.60.150[.]31 · Destination port: 53 · Protocols used: TCP · HTTP · ASN: AS12586 GHOSTnet GmbH File Information · Filename: init.exe · Detected MIME type: application/x-dosexec · HTTP content type: application/octet-stream · File size: 284.67 kB · SHA1 hash: aa1d92f4b4cad394ed735f7926c23ab9771834d5 Suspicious Application · User agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; InfoPath.2; .NET4.0C; .NET4.0E) Suspicious Endpoints Contacted by Application · Hostname: 179.60.150[.]32 · ASN: AS12586 GHOSTnet GmbH · URI: /ga[.]js · Port: 443 · HTTP method: GET Suspicious Application · User agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0) Suspicious Endpoints Contacted by Application · Hostname: 179.60.150[.]31 · ASN: AS12586 GHOSTnet GmbH · URI: /dot[.]gif · Port: 53 · HTTP method: GET show less	Hacking Exploited Host SSH
🇧🇿 179.60.150.31	30 Aug 2021	This IP-179.60.150.31 is associated with an exploit attempt of Solar winds SERV-U Secure FTP and SER ... show more This IP-179.60.150.31 is associated with an exploit attempt of Solar winds SERV-U Secure FTP and SERV-U Managed File Transfer - known vulnerability Other associated IPs - 179.60.150.32 URL: hxxp://179.60.150[.]31:53/init[.]exe User agent: Microsoft-CryptoAPI/6.2, CertUtil URL Agent Destination IP: 179.60.150[.]31 Destination port: 53 Protocols used: TCP · HTTP \ASN: AS12586 GHOSTnet GmbH show less	Hacking Exploited Host SSH
129.205.113.212	20 Jul 2021	Block IP-129.205.113.212 Immediately - IP associated with Phishing email campaign using UPCmail acco ... show more Block IP-129.205.113.212 Immediately - IP associated with Phishing email campaign using UPCmail account targeting Financial Authorities. Malicious Link embedded in Phishing email. show less	Phishing Email Spam Hacking
52.242.211.89	05 May 2021	Suspected bitquatting abuse via DNS \| notify.trafficmanager.net	DNS Compromise DNS Poisoning Hacking
72.21.91.29	05 May 2021	Flagged as malicious associated with cs9.wac.phicdn.net \| Block FQDN	Hacking Exploited Host
46.30.213.199	05 May 2021	IP flagged as malicious \| Block IP	Hacking Exploited Host
54.209.56.116	28 Apr 2021	Suspicious connection requests from this IP-54.209.56.116 on TCP Port 36832 \| Attempting connection ... show more Suspicious connection requests from this IP-54.209.56.116 on TCP Port 36832 \| Attempting connection on TCP Port 53 show less	DNS Compromise Hacking
13.107.4.52	26 Apr 2021	Fake MS site \| 4-c-0003.c-msedge.net \| Block immediately	DDoS Attack Hacking Spoofing
72.21.81.240	26 Apr 2021	Indicative of compromised host on internal network \| repeated attempted outbound connection to the I ... show more Indicative of compromised host on internal network \| repeated attempted outbound connection to the IP on Port [80] \| associated with cs11.wpc.v0cdn.net \| Malicious external IP block show less	Hacking
35.205.61.67	26 Apr 2021	Suspected HTTP beaconing malware detected \| associated with addr.cx \| block IP	Hacking Exploited Host
117.50.7.159	19 Apr 2021	Malicious IP \| Attempt to exploit public facing DNS host \| Block IP-117.50.7.159 \| Port 44424 abused	DNS Compromise DNS Poisoning DDoS Attack
88.99.64.19	16 Apr 2021	IP associated with malicious sites ws8.blitzortung.org \| ws7.blitzortung.org \| ws6.blitzortung.org \| ... show more IP associated with malicious sites ws8.blitzortung.org \| ws7.blitzortung.org \| ws6.blitzortung.org \| ws5.blitzortung.org show less	Hacking Exploited Host
135.181.0.109	16 Apr 2021	IP associated with malicious sites ws8.blitzortung.org \| ws7.blitzortung.org \| ws6.blitzortung.org \| ... show more IP associated with malicious sites ws8.blitzortung.org \| ws7.blitzortung.org \| ws6.blitzortung.org \| ws5.blitzortung.org show less	Hacking Exploited Host
135.181.0.163	16 Apr 2021	IP associated with malicious sites ws8.blitzortung.org \| ws7.blitzortung.org \| ws6.blitzortung.org \| ... show more IP associated with malicious sites ws8.blitzortung.org \| ws7.blitzortung.org \| ws6.blitzortung.org \| ws5.blitzortung.org show less	Hacking Exploited Host