JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

81.57.59.22

Recent Activity

Abuse Confidence Score

100% Critical

55 reports

38 reporters · latest 17 hours ago

ISP: Iliad / Free SAS
Usage Type: Fixed Line ISP
ASN: AS29447
Domain Name: free.fr
Country: 🇮🇹 Italy
City: Milan, Lombardy

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Example preview

Account required for the enhanced features Log in Sign up

Abuse Reports

Export reports CSV

Total reports

55 from 38 distinct reporters

First reported

August 16th 2026

Most recent report

17 hours ago

Last 60 days

Top reporter locations 🇺🇸 United States of America 18 🇩🇪 Germany 8 🇮🇹 Italy 6

Most common categories Web App Attack 28 Brute-Force 21 Bad Web Bot 20 Hacking 6 Exploited Host 5

Recent reports We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇬🇧 andypiper	2026-11-14 02:01:49 UTC · (17 hours ago)	CrowdSec ban for AbuseIPDB Top List	Brute-Force Web App Attack
🇩🇪 big-cloud.nl	2026-11-14 01:12:06 UTC · (18 hours ago)	Try to access /xmlrpc.php	Web App Attack
Anonymous	2026-11-13 00:33:38 UTC · (1 day ago)	WordPress login / XML-RPC brute-force.	Brute-Force Web App Attack
🇮🇹 CoreTech srl	2026-11-12 22:33:55 UTC · (1 day ago)	[DC: IP:151.1.252.27] ntopng alert: blacklisted_server_contact	Hacking
🇮🇹 sssrit	2026-11-12 18:48:52 UTC · (2 days ago)	81.57.59.22 - - [12/Nov/2026:19:48:51 +0100] "POST /api/graphql HTTP/1.1" 404 12235 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36" 81.57.59.22 - - [12/Nov/2026:19:48:51 +010 ... show more 81.57.59.22 - - [12/Nov/2026:19:48:51 +0100] "POST /api/graphql HTTP/1.1" 404 12235 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36" 81.57.59.22 - - [12/Nov/2026:19:48:51 +0100] "GET /wp-json/ldlms/v2/users?_fields=user_login&per_page=100&page=1 HTTP/1.1" 404 126 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36" 81.57.59.22 - - [12/Nov/2026:19:48:51 +0100] "GET /wp-json/ldlms/v1/users?_fields=user_login&per_page=100&page=1 HTTP/1.1" 404 126 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36" ... show less	Brute-Force
🇺🇸 ersei.net	2026-11-12 02:02:12 UTC · (2 days ago)	Web app exploiting	Web App Attack
🇧🇷 ICS Labs	2026-11-11 17:16:14 UTC · (3 days ago)	ICS Labs threat intelligence (ICS Feeds): Brute-Force, Exploited Host. Last observed 2026-11-11 UTC.	Brute-Force Exploited Host
🇺🇸 consti.art	2026-11-11 15:15:25 UTC · (3 days ago)	Web vulnerability scanning (1 probes), looking for CMS admin and login pages, WordPress components, PHP scripts and web shells User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/155.0.0.0 Mobile Safari/537.36 ... show more Web vulnerability scanning (1 probes), looking for CMS admin and login pages, WordPress components, PHP scripts and web shells User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/155.0.0.0 Mobile Safari/537.36 1 HTTP requests at 2026-11-11 15:15 UTC show less	Bad Web Bot
🇧🇷 radardatelecom	2026-11-10 16:55:04 UTC · (4 days ago)	Blocked by Radar da Telecom firewall — abuseipdb	Bad Web Bot Web App Attack
🇩🇰 ScamAware	2026-11-10 15:30:38 UTC · (4 days ago)	Detected by Cloudflare Security Events via WordPress automation. Detection: user_enumeration (WordPress user enumeration). Hits from same IP in last 60 minutes: 4. Unique request paths counted internally: 2. Cloudflare action: block. Cloudflare sourc ... show more Detected by Cloudflare Security Events via WordPress automation. Detection: user_enumeration (WordPress user enumeration). Hits from same IP in last 60 minutes: 4. Unique request paths counted internally: 2. Cloudflare action: block. Cloudflare source: firewallCustom. show less	Brute-Force Web App Attack
🇩🇪 ghostwarriors	2026-11-10 08:20:29 UTC · (4 days ago)	Attempts against non-existent wp-login	Brute-Force Web App Attack
🇩🇪 throny	2026-11-10 08:06:51 UTC · (4 days ago)	Web app exploit probe on a honeypot: requested known vulnerability paths (wp-login.php, .env, .git ...). Requests within an hour: 1 on 1 host(s) User agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0 ... show more Web app exploit probe on a honeypot: requested known vulnerability paths (wp-login.php, .env, .git ...). Requests within an hour: 1 on 1 host(s) User agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Sa Requested, e.g.: - shop.[REDACTED]/xmlrpc.php show less	Web App Attack
🇦🇺 FireGuard Server	2026-11-10 07:36:04 UTC · (4 days ago)	Blocked by os-abuseipdb; 4 hits, proto=tcp, ports=443	Port Scan Hacking
🇫🇮 inlink.ltd	2026-11-10 07:22:51 UTC · (4 days ago)	Known malicious PHP file or CMS probe	Web App Attack
Anonymous	2026-11-09 18:08:29 UTC · (5 days ago)	WordPress login / XML-RPC brute-force: POST /wp-login.php x3. [09/Nov/2026:21:08:25 +0300] "POST /wp-login.php HTTP/2" 200 UA="Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome" [09/Nov/2026:21:08:26 +0300] "POST /wp-lo ... show more WordPress login / XML-RPC brute-force: POST /wp-login.php x3. [09/Nov/2026:21:08:25 +0300] "POST /wp-login.php HTTP/2" 200 UA="Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome" [09/Nov/2026:21:08:26 +0300] "POST /wp-login.php HTTP/2" 200 UA="Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome" [09/Nov/2026:21:08:27 +0300] "POST /wp-login.php HTTP/2" 200 UA="Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome" show less	Brute-Force Web App Attack

Showing 1 to 15 of 55 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇨🇳 124.74.97.18

🇨🇳 222.210.35.197

🇩🇴 152.166.58.122

🇺🇸 147.185.132.156

🇹🇼 122.100.110.7

🇨🇳 47.102.137.237

🇵🇱 45.138.12.19

🇺🇸 34.34.225.143

🇺🇸 3.83.245.221

🇫🇷 2001:41d0:33a:a00::40f

🇺🇸 192.253.209.95

🇸🇬 188.166.247.226

🇺🇸 152.163.251.218

🇸🇬 150.109.16.200

🇧🇬 79.124.58.194

🇺🇸 52.45.15.233

🇮🇷 5.22.62.236

🇳🇱 195.178.110.227

🇮🇷 185.112.149.185

🇵🇱 172.64.198.164