AbuseIPDB

JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

User sniffer12 joined AbuseIPDB in February 2022 and has reported 108 IP addresses.

Standing (weight) is good.

ACTIVE USER WEBMASTER

IP	Date	Comment	Categories
🇻🇳 103.245.236.120	05 May 2024	ET WEB_SPECIFIC_APPS D-Link NAS devices Backdoor Account Access and Command Injection Attempt (CVE-2 ... show more ET WEB_SPECIFIC_APPS D-Link NAS devices Backdoor Account Access and Command Injection Attempt (CVE-2024-3273) [**] [Classification: Attempted Administrator Privilege Gain] [Priority: 1] {TCP} 103.245.236.120:55134 -> x.x.x.x:443 show less	Hacking
🇻🇳 103.245.236.120	30 Apr 2024	ET WEB_SPECIFIC_APPS D-Link NAS devices Backdoor Account Access and Command Injection Attempt (CVE-2 ... show more ET WEB_SPECIFIC_APPS D-Link NAS devices Backdoor Account Access and Command Injection Attempt (CVE-2024-3273) [**] [Classification: Attempted Administrator Privilege Gain] [Priority: 1] {TCP} 103.245.236.120:46076 -> x.x.x.x:443 show less	Hacking
🇭🇰 165.154.41.152	20 Apr 2024	Below two times: ET POLICY External Oracle T3 Requests Inbound [] [Classification: Potential Corp ... show more Below two times: ET POLICY External Oracle T3 Requests Inbound [] [Classification: Potential Corporate Privacy Violation] [Priority: 1] {TCP} 165.154.41.152:42712 -> x.x.x.x:25 show less	Hacking
🇳🇱 45.128.232.213	07 Apr 2024	ET WEB_SPECIFIC_APPS Possible Apache Struts OGNL Expression Injection (CVE-2017-5638) [] [Classifi ... show more ET WEB_SPECIFIC_APPS Possible Apache Struts OGNL Expression Injection (CVE-2017-5638) [] [Classification: Web Application Attack] [Priority: 1] {TCP} 45.128.232.213:61740 -> x.x.x.x:443 This 3 times show less	Hacking Web App Attack
🇩🇪 193.35.18.40	22 Mar 2024	ET WEB_SPECIFIC_APPS ConnectWise ScreenConnect - Attempted SetupWizard Auth Bypass CWE-288 (CVE-2024 ... show more ET WEB_SPECIFIC_APPS ConnectWise ScreenConnect - Attempted SetupWizard Auth Bypass CWE-288 (CVE-2024-1709) [**] [Classification: Attempted Administrator Privilege Gain] [Priority: 1] {TCP} 193.35.18.40:55424 -> 0.0.0.0:443 show less	Web App Attack
🇺🇸 104.219.236.169	20 Mar 2024	ET WEB_SPECIFIC_APPS Possible Apache Struts OGNL Expression Injection (CVE-2017-5638) [] [Classifi ... show more ET WEB_SPECIFIC_APPS Possible Apache Struts OGNL Expression Injection (CVE-2017-5638) [] [Classification: Web Application Attack] [Priority: 1] {TCP} 104.219.236.169:20546 -> 0.0.0.0:443 ET WEB_SPECIFIC_APPS Possible Apache Struts OGNL Expression Injection (CVE-2017-5638) M2 [] [Classification: Web Application Attack] [Priority: 1] {TCP} 104.219.236.169:20546 -> 0.0.0.0:443 ET WEB_SPECIFIC_APPS Possible Apache Struts OGNL Expression Injection (CVE-2017-5638) M3 [] [Classification: Web Application Attack] [Priority: 1] {TCP} 104.219.236.169:20546 -> 0.0.0.0:443 show less	Web App Attack
🇸🇬 152.42.186.76	19 Mar 2024	ET WEB_SPECIFIC_APPS Jenkins Chained Exploits CVE-2018-1000861 and CVE-2019-1003000 M1 [] [Classif ... show more ET WEB_SPECIFIC_APPS Jenkins Chained Exploits CVE-2018-1000861 and CVE-2019-1003000 M1 [] [Classification: Web Application Attack] [Priority: 1] {TCP} 152.42.186.76:30344 -> x.x.x.x:443 ET EXPLOIT Jenkins Plugin Script RCE Exploit Attempt (CVE-2019-1003001) [] [Classification: Attempted Administrator Privilege Gain] [Priority: 1] {TCP} 152.42.186.76:30344 -> x.x.x.x:443 ET WEB_SPECIFIC_APPS Possible Apache Struts OGNL Expression Injection (CVE-2017-5638) [] [Classification: Web Application Attack] [Priority: 1] {TCP} 152.42.186.76:30358 -> x.x.x.x:443 (2 times) ET WEB_SPECIFIC_APPS Possible Apache Struts OGNL Expression Injection (CVE-2017-5638) M3 [**] [Classification: Web Application Attack] [Priority: 1] {TCP} 152.42.186.76:30358 -> x.x.x.x:443 show less	Hacking Web App Attack
🇺🇸 54.240.48.118	09 Mar 2024	a48-118.smtp-out.amazonses.com lure you to click on malicious link	Phishing Email Spam
🇩🇪 118.193.59.4	01 Mar 2024	ET POLICY External Oracle T3 Requests Inbound [] [Classification: Potential Corporate Privacy Viol ... show more ET POLICY External Oracle T3 Requests Inbound [] [Classification: Potential Corporate Privacy Violation] [Priority: 1] {TCP} 118.193.59.4:58774 -> x.x.x.x:25 show less	Hacking
🇺🇸 152.32.148.140	28 Feb 2024	ET POLICY External Oracle T3 Requests Inbound [] [Classification: Potential Corporate Privacy Viol ... show more ET POLICY External Oracle T3 Requests Inbound [] [Classification: Potential Corporate Privacy Violation] [Priority: 1] {TCP} 152.32.148.140:37670 -> x.x.x.x:25 show less	Hacking
🇹🇭 118.193.57.218	22 Feb 2024	ET POLICY External Oracle T3 Requests Inbound [] [Classification: Potential Corporate Privacy Viol ... show more ET POLICY External Oracle T3 Requests Inbound [] [Classification: Potential Corporate Privacy Violation] [Priority: 1] {TCP} 118.193.57.218:18320 -> x.x.x.x:25 two times show less	Hacking
🇺🇸 54.240.8.242	20 Feb 2024	Fake email about netflix expiring and renew contract	Email Spam
🇳🇬 152.32.141.208	20 Feb 2024	ET POLICY External Oracle T3 Requests Inbound [] [Classification: Potential Corporate Privacy Viol ... show more ET POLICY External Oracle T3 Requests Inbound [] [Classification: Potential Corporate Privacy Violation] [Priority: 1] {TCP} 152.32.141.208:50808 -> x.x.x.x:25 show less	Hacking
🇲🇰 46.217.109.182	06 Feb 2024	Kind of blackmail phishing for bitcoin Received: from [46.217.109.182] (unknown [46.217.109.182]) ... show more Kind of blackmail phishing for bitcoin Received: from [46.217.109.182] (unknown [46.217.109.182]) by xxxxxxx.xx (Postfix) with ESMTP id show less	Phishing Email Spam
🇫🇷 51.91.148.28	25 Jan 2024	Trying to get bitcoins via fake email.	Email Spam
🇳🇱 185.224.128.191	24 Jan 2024	Possible CVE-2014-6271 Attempt in Headers [] [Classification: Attempted Administrator Privilege Ga ... show more Possible CVE-2014-6271 Attempt in Headers [] [Classification: Attempted Administrator Privilege Gain] [Priority: 1] {TCP} 185.224.128.191:41220 -> x.x.x.x:443 WGET Command Specifying Output in HTTP Headers [**] [Classification: Attempted Administrator Privilege Gain] [Priority: 1] {TCP} 185.224.128.191:41220 -> x.x.x.x:443 show less	Hacking
🇺🇸 50.186.240.41	24 Jan 2024	Phising mail tries to lure you into malicious bank (rabobank) website X-AntiAbuse: This header was ... show more Phising mail tries to lure you into malicious bank (rabobank) website X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - cpanel201.servidoresdns3.net X-AntiAbuse: Original Domain - mydomain.nl X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - capellades.net show less	Phishing
🇩🇪 77.90.185.160	21 Jan 2024	TP-Link TL-WR840N/TL-WR841N - Authentication Bypass (GET conf.bin) [] [Classification: Attempted U ... show more TP-Link TL-WR840N/TL-WR841N - Authentication Bypass (GET conf.bin) [] [Classification: Attempted User Privilege Gain] [Priority: 1] {TCP} 77.90.185.160:38762 -> x.x.x.x:443 show less	Hacking
🇳🇬 152.32.143.206	19 Jan 2024	Oracle T3 Requests Inbound [] [Classification: Potential Corporate Privacy Violation] [Priority: 1 ... show more Oracle T3 Requests Inbound [] [Classification: Potential Corporate Privacy Violation] [Priority: 1] {TCP} 152.32.143.206:47224 -> x.x.x.x:25 show less	Hacking
🇺🇸 173.44.63.126	15 Jan 2024	U hebt nog 2 dagen de tijd! Wegens de vernieuwde Europese privacywetgeving zijn al onze klanten ver ... show more U hebt nog 2 dagen de tijd! Wegens de vernieuwde Europese privacywetgeving zijn al onze klanten verplicht hun meest recente contactgegevens bij te werken in ons klantensysteem. Wij verzoeken u daarom om uw gegevens bij te werken. U heeft nog 2 dagen om te voldoen aan deze verplichting. Als u verzuimt dit te doen voor de gestelde datum dan zijn wij verplicht een cryptoslot op uw Bitvavo account in te stellen. Click here button -> Bijwerken show less	Phishing
🇳🇱 185.224.128.191	11 Jan 2024	ET EXPLOIT Fortigate VPN - Repeated POST Requests to /remote/hostcheck_validate (CVE-2023-27997) M2 ... show more ET EXPLOIT Fortigate VPN - Repeated POST Requests to /remote/hostcheck_validate (CVE-2023-27997) M2 [] [Classification: Attempted Administrator Privilege Gain] [Priority: 1] {TCP} 185.224.128.191:37208 -> x.x.x.x:443 01/11/2024-17:02:07.940559 [] [1:2009363:10] ET HUNTING Suspicious Chmod Usage in URI (Inbound) [**] [Classification: Attempted Administrator Privilege Gain] show less	Hacking
🇻🇳 116.105.70.233	08 Jan 2024	signature": "ET SCAN Nmap Scripting Engine User-Agent Detected (Nmap Scripting Engine)", "categ ... show more signature": "ET SCAN Nmap Scripting Engine User-Agent Detected (Nmap Scripting Engine)", "category": "Web Application Attack", show less	Web App Attack
🇺🇸 89.190.156.153	30 Dec 2023	Attemp to lure you to a malicious web site Received: from mx.expertnews.nl (mx.expertnews.nl [89. ... show more Attemp to lure you to a malicious web site Received: from mx.expertnews.nl (mx.expertnews.nl [89.190.156.153]) show less	Phishing Email Spam
🇺🇸 54.240.8.31	29 Dec 2023	Received: from a8-31.smtp-out.amazonses.com (a8-31.smtp-out.amazonses.com [54.240.8.31]) Tries to ... show more Received: from a8-31.smtp-out.amazonses.com (a8-31.smtp-out.amazonses.com [54.240.8.31]) Tries to trick you into a payment website show less	Phishing
🇺🇸 162.222.201.214	26 Oct 2023	Blackmail spam	Email Spam