JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

130.131.227.119

Recent Activity

Abuse confidence score ?

100% Critical

377 reports

276 reporters · latest 2 minutes ago

ISP	Microsoft Limited
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇺🇸 United States of America
City	Des Moines, Iowa

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Reports Activity

Example preview

Report Categories (Last 60 Days)

Example preview

Top Reporter Countries (Last 60 Days)

Example preview

Account required for the enhanced features Log in Sign up

IP Abuse Reports for 130.131.227.119

This IP address has been reported a total of 377 times from 276 distinct sources. 130.131.227.119 was first reported on September 28th 2026, and the most recent report was 2 minutes ago. In the last 60 days, the top reporter locations were: Germany with 87 reports; United States of America with 74 reports; France with 31 reports. The most common categories in these recent reports were: Web App Attack 288 times; Bad Web Bot 94 times; Brute-Force 84 times; Hacking 81 times; Port Scan 37 times; Other 51 times.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇧🇪 Saec	2026-09-29 07:42:40 (2 minutes ago)	Honeypot caught: /wp-login.php via prof.saec.me. UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Apple ... show more Honeypot caught: /wp-login.php via prof.saec.me. UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36. show less	Port Scan Brute-Force Bad Web Bot Web App Attack IoT Targeted
Anonymous	2026-09-29 07:41:48 (3 minutes ago)	Fail2Ban Log Report 130.131.227.119 - - [29/Sep/2026:09:41:46 +0200] "GET /inputs.php HTTP/2.0" 444 ... show more Fail2Ban Log Report 130.131.227.119 - - [29/Sep/2026:09:41:46 +0200] "GET /inputs.php HTTP/2.0" 444 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" "130.131.227.119" 130.131.227.119 - - [29/Sep/2026:09:41:46 +0200] "GET /baxa1.php HTTP/2.0" 444 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" "130.131.227.119" 130.131.227.119 - - [29/Sep/2026:09:41:46 +0200] "GET /baxa1.php HTTP/2.0" 444 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" "130.131.227.119" ... show less	Hacking Brute-Force Web App Attack
🇺🇸 ambor	2026-09-29 07:35:28 (10 minutes ago)	L0ss Honeypot: Admin panel access attempt. Path: /admin.php	Brute-Force Web App Attack
🇹🇭 thaizone.com	2026-09-29 07:32:10 (13 minutes ago)	Hacking attempts against websites (D1) #3	Web App Attack Hacking
🇩🇪 macrob	2026-09-29 07:30:13 (15 minutes ago)	2026/09/29 07:30:11 [error] 611559#611559: 48115354 access forbidden by rule, client: 130.131.227.1 ... show more 2026/09/29 07:30:11 [error] 611559#611559: 48115354 access forbidden by rule, client: 130.131.227.119, server: finami.mx, request: "GET /wp-admin/css/colors/modern/ HTTP/2.0", host: "finami.mx" 2026/09/29 07:30:11 [error] 611561#611561: 48121638 access forbidden by rule, client: 130.131.227.119, server: finami.mx, request: "GET /wp-admin/css/admin.php HTTP/2.0", host: "finami.mx" 2026/09/29 07:30:12 [error] 611559#611559: 48124154 access forbidden by rule, client: 130.131.227.119, server: finami.mx, request: "GET /wp-includes/interactivity-api/index.php HTTP/2.0", host: "finami.mx" ... show less	Web App Attack
🇩🇪 Skyrider	2026-09-29 07:27:06 (18 minutes ago)	crowdsecurity/http-backdoors-attempts	Web App Attack
🇳🇱 Mangelot Hosting	2026-09-29 07:25:06 (20 minutes ago)	(upload_shell) srv101 PHP Shell Upload 130.131.227.119 (US/United States/-): 1 in the last 3600 secs ... show more (upload_shell) srv101 PHP Shell Upload 130.131.227.119 (US/United States/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: show less	Web App Attack
🇩🇪 spam.must.die	2026-09-29 07:20:16 (25 minutes ago)	Fail2Ban jail [apache-auth]: Web App Attack - [Tue Sep 29 07:20:12.487427 2026] [access_compat:error ... show more Fail2Ban jail [apache-auth]: Web App Attack - [Tue Sep 29 07:20:12.487427 2026] [access_compat:error] [pid 114123:tid 114123] [client 130.131.227.119:0] AH01797: client denied by server configuration: /var/www/html/wordpress/wp-includes/block-supports/index.php[Tue Sep 29 07:20:15.236767 2026] [access_compat:error] [pid 114116:tid 114116] [client 130.131.227.119:0] AH01797: client denied by server configuration: /var/www/html/wordpress/wp-includes/js/index.php show less	Web App Attack
🇺🇸 ruusvuu	2026-09-29 07:10:14 (35 minutes ago)	Automated abuse report: 15 attack/probe requests from Microsoft Corporation / US. Targeted paths: /w ... show more Automated abuse report: 15 attack/probe requests from Microsoft Corporation / US. Targeted paths: /wk/index.php, /inputs.php, /function/function.php, /admin.php, /wp-content/uploads/index.php. Sample log lines: [helpdesk] 9/29/2026 00:10:14 130.131.227.119 GET /god4m.php 404 148 1.0 ms [helpdesk] 9/29/2026 00:10:14 130.131.227.119 GET /moon.php 404 147 1.1 ms [helpdesk] 9/29/2026 00:10:14 130.131.227.119 GET /o.php 404 144 1.8 ms Detected by an automated web-server log monitor. show less	Web App Attack
🇩🇪 patrisei	2026-09-29 07:06:53 (38 minutes ago)	You are now banned for 10 years by Schiffdorf-West Patrol. Trigger: crowdsecurity/http-admin-interfa ... show more You are now banned for 10 years by Schiffdorf-West Patrol. Trigger: crowdsecurity/http-admin-interface-probing show less	Port Scan Web App Attack
🇺🇸 ambor	2026-09-29 07:06:11 (39 minutes ago)	Attack type: wordpress_attack_attempt \| Target: /admin.php \| UA: Mozilla/5.0 (Windows NT 10.0; Win64 ... show more Attack type: wordpress_attack_attempt \| Target: /admin.php \| UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWeb \| Country: US show less	Web App Attack Brute-Force
🇪🇸 robotstxt	2026-09-29 07:04:29 (41 minutes ago)	130.131.227.119 - - [29/Sep/2026:07:03:33 +0000] "GET /wp-cron.php HTTP/2.0" 403 10935 "-" "Mozilla/ ... show more 130.131.227.119 - - [29/Sep/2026:07:03:33 +0000] "GET /wp-cron.php HTTP/2.0" 403 10935 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" "-" edge="130.131.227.119" 130.131.227.119 - - [29/Sep/2026:07:03:41 +0000] "GET /wp-config-sample.php HTTP/2.0" 403 10935 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" "-" edge="130.131.227.119" 130.131.227.119 - - [29/Sep/2026:07:03:47 +0000] "GET /wp-mail.php HTTP/2.0" 403 1126 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" "-" edge="130.131.227.119" 130.131.227.119 - - [29/Sep/2026:07:03:48 +0000] "GET /xmlrpc.php HTTP/2.0" 403 10935 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" "-" edge="130.131.227.119" 130.131.227.119 - - [29/Sep/2026:07:03:55 +0000] "GET /config.php ... show less	Web App Attack
🇩🇪 Blexyel	2026-09-29 07:03:54 (41 minutes ago)	130.131.227.119 - - [29/Sep/2026:09:03:53 +0200] "GET /wp-includes/IXR/wp-login.php HTTP/1.1" 404 55 ... show more 130.131.227.119 - - [29/Sep/2026:09:03:53 +0200] "GET /wp-includes/IXR/wp-login.php HTTP/1.1" 404 555 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" "pingusmc.org" ... show less	Brute-Force Web App Attack
🇬🇧 Andrew	2026-09-29 06:54:37 (51 minutes ago)	130.131.227.119 - - [29/Sep/2026:07:54:35 +0100] "GET /admin.php HTTP/1.1" 404 18359 "-" "Mozilla/5. ... show more 130.131.227.119 - - [29/Sep/2026:07:54:35 +0100] "GET /admin.php HTTP/1.1" 404 18359 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 130.131.227.119 - - [29/Sep/2026:07:54:35 +0100] "GET /goods.php HTTP/1.1" 404 18359 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 130.131.227.119 - - [29/Sep/2026:07:54:35 +0100] "GET /file.php HTTP/1.1" 404 18358 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 130.131.227.119 - - [29/Sep/2026:07:54:36 +0100] "GET /adminfuns.php HTTP/1.1" 404 20279 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 130.131.227.119 - - [29/Sep/2026:07:54:36 +0100] "GET /404.php HTTP/1.1" 404 18357 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 ... show less	Hacking Web App Attack
🇦🇺 paulshipley.com.au	2026-09-29 06:48:05 (57 minutes ago)	underconstruction.paulshipley.info:443 130.131.227.119 - - [29/Sep/2026:16:48:03 +1000] "GET /admin. ... show more underconstruction.paulshipley.info:443 130.131.227.119 - - [29/Sep/2026:16:48:03 +1000] "GET /admin.php HTTP/1.1" 404 521 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" ... show less	Web App Attack

Showing 1 to 15 of 377 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 50.84.211.204

🇱🇹 194.165.16.161

🇷🇺 185.169.100.190

🇹🇼 113.196.195.151

🇮🇩 103.186.1.158

🇨🇮 102.209.220.62

🇫🇷 91.231.89.208

🇺🇦 91.214.136.57

🇷🇴 81.196.179.31

🇷🇺 46.191.197.143

🇵🇱 45.138.12.24

🇨🇳 27.207.241.176

🇲🇾 27.125.240.242

🇧🇷 187.36.152.5

🇵🇱 177.177.23.220

🇩🇪 167.172.181.185

🇩🇪 167.94.146.63

🇮🇳 122.187.173.86

🇲🇬 102.16.125.52

🇮🇷 85.198.19.242