PURPLE TEAM MAXIMA SEGURIDAD CORP - AbuseIPDB User Profile

JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

User PURPLE TEAM MAXIMA SEGURIDAD CORP joined AbuseIPDB in September 2021 and has reported 171 IP addresses.

Standing (weight) is good.

INACTIVE USER

IP	Date	Comment	Categories
🇻🇳 103.167.199.55	21 Nov 2023	targeted phishing attack, server C2. Received: from [103.167.199.55] (port=54360 helo=103.167.199.55 ... show more targeted phishing attack, server C2. Received: from [103.167.199.55] (port=54360 helo=103.167.199.55) show less	Phishing Hacking
🇦🇷 181.119.48.146	21 Nov 2023	spear phishing attack, redirects from C2 sender in Vietnam 103.167.199.55	Phishing Email Spam Hacking
🇵🇪 161.132.163.158	10 Nov 2023	A user account was identified from the corporate email service of a public entity used to send the c ... show more A user account was identified from the corporate email service of a public entity used to send the cloned site link to steal administrator credentials show less	Phishing
🇺🇸 162.240.12.167	09 Nov 2023	elitehealthgroupllc.com domain used in targeted phishing attacks	Phishing Email Spam
🇵🇱 185.16.38.41	06 Oct 2023	C2 server distributes powershell payloads with 3LOSH RAT encoder	Hacking
🇺🇸 74.208.105.80	06 Oct 2023	c2 rat server, compressed payloads in image, powershell and bat	Hacking
🇷🇺 109.248.206.11	30 Sep 2023	C2 command and control	Hacking
🇺🇸 65.99.225.98	10 Aug 2023	Server compromised by Redline Stealer Malware variant 2, the web service of this IP is used for malw ... show more Server compromised by Redline Stealer Malware variant 2, the web service of this IP is used for malware distribution to website visitors, The hacker cyber-offensive in hunter mode targeting advanced threats in cyberspace. show less	Hacking Exploited Host Web App Attack
🇩🇪 51.89.12.10	01 Aug 2023	C2 server for distribution of 2 payloads: cc.txt, hm.jpg for running powershell.exe on target host	Hacking
🇷🇺 185.106.93.175	22 Jul 2023	Distribution C2 server with 21 payloads between .txt, .png and .jpg files with obfuscated code for p ... show more Distribution C2 server with 21 payloads between .txt, .png and .jpg files with obfuscated code for powershell.exe execution on target host show less	Hacking
🇳🇱 185.81.114.175	19 Jul 2023	C2 payload distribution server 1.txt, 2.txt and moealalah.jpg for powershell.exe execution on target ... show more C2 payload distribution server 1.txt, 2.txt and moealalah.jpg for powershell.exe execution on target host show less	Hacking
🇫🇷 109.238.12.146	29 Jun 2023	Server compromised by Redline stealer Malware variant 2, web service of this IP is used for malware ... show more Server compromised by Redline stealer Malware variant 2, web service of this IP is used for malware distribution to website visitors via powershell injection, Cyberspace Threat Hunting detection of advanced targeted threats show less	Hacking Exploited Host Web App Attack
🇮🇩 103.102.148.37	29 Jun 2023	Server compromised by Redline stealer Malware variant 2, web service of this IP is used for malware ... show more Server compromised by Redline stealer Malware variant 2, web service of this IP is used for malware distribution to website visitors, Cyberspace Threat Hunting detection of advanced targeted threats show less	Hacking Exploited Host Web App Attack
🇺🇸 157.245.134.31	29 Jun 2023	Server compromised by Redline stealer Malware variant 2, web service of this IP is used for malware ... show more Server compromised by Redline stealer Malware variant 2, web service of this IP is used for malware distribution to website visitors, Cyberspace Threat Hunting detection of advanced targeted threats show less	Hacking Exploited Host Web App Attack
🇩🇪 45.15.157.131	09 Jun 2023	Redline stealer malware, call an API on TCP port 36457 using applaunch.exe, our Threat Hunter operat ... show more Redline stealer malware, call an API on TCP port 36457 using applaunch.exe, our Threat Hunter operator (a Senior Hacker) discovers that C2 hosted on GNU/Linux Ubuntu Operating System with NAT on Windows server 2016 show less	Hacking Web App Attack
🇺🇸 72.21.91.29	28 Dec 2022	IP associated with TLAUNCHER where it uses backdoors that open the processes gamebar.exe for persist ... show more IP associated with TLAUNCHER where it uses backdoors that open the processes gamebar.exe for persistence and SearchApp.exe to execute malicious operations show less	Hacking Exploited Host
🇬🇧 109.151.65.80	13 Dec 2022	exploit request http variant 2	Hacking Web App Attack
🇬🇧 37.9.62.28	13 Dec 2022	exploit request http variant 2	Hacking Web App Attack
🇦🇷 181.239.184.21	03 Mar 2022	Remote Code Execution Exploit - HTTP (Request)	Hacking Web App Attack
🇺🇸 206.125.152.97	03 Mar 2022	Remote Code Execution Exploit - HTTP (Request)	Hacking Web App Attack
🇨🇴 192.144.113.26	03 Mar 2022	Remote Code Execution Exploit - HTTP (Request)	Hacking Web App Attack
🇳🇱 185.239.242.76	03 Mar 2022	C2 Injection - JAWS Remote Code Execution Exploit - HTTP (Request)	Hacking Web App Attack
🇫🇷 45.90.162.98	03 Mar 2022	C2 Injection - JAWS Remote Code Execution Exploit - HTTP (Request)	Hacking Web App Attack
🇺🇸 18.234.161.205	03 Mar 2022	Remote Code Execution Exploit - HTTP (Request)	Hacking Web App Attack
🇺🇸 44.203.0.3	03 Mar 2022	Remote Code Execution Exploit - HTTP (Request)	Hacking Web App Attack