Black_Brazil - AbuseIPDB User Profile

JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

User Black_Brazil , the webmaster of richardsonserra.com, joined AbuseIPDB in July 2023 and has reported 537 IP addresses.

Standing (weight) is good.

ACTIVE USER WEBMASTER SUPPORTER

IP	Date	Comment	Categories
🇺🇸 132.196.11.13	6 hours ago	IP blocked - 132.196.11.13; Incident date: 2026-07-17; UTC time: 19:18:59; Blocked requests: 148; Bl ... show more IP blocked - 132.196.11.13; Incident date: 2026-07-17; UTC time: 19:18:59; Blocked requests: 148; Blocked by - Cloudflare WAF; Vulnerability scanning attack; search for webshells and backdoors blocked at the firewall edge; Sample GET URL paths: /X7ROOT.PHP; /sf.php; /lock360.php; /leafmailer2.8.php; /4price.php; /alexus-mailer.php; /ups.php; /leaf.php; /haxor.php; /symlink.php; /xxx.php; /send.php; /t.php; /3index.php; /input.php; /spip.php; /wp-content/plugins/hellopress/wp_filemanager.php; /wp-check.php; /root.php; show less	Hacking Bad Web Bot Exploited Host Web App Attack
🇳🇱 95.140.158.207	11 hours ago	Blocked IP: 95.140.158.207; Incident Date: 2026-07-17; UTC Time: 00:39:44; RCE (Remote Code Executio ... show more Blocked IP: 95.140.158.207; Incident Date: 2026-07-17; UTC Time: 00:39:44; RCE (Remote Code Execution) attempt attack via REST API: Sample GET URL paths - /wp-json/gutenkit/v1/install-active-plugin; /wp-content/plugins/background-image-cropper/accesson.php; /wp-content/plugins/background-image-cropper/03d28168c751.php; show less	Hacking Web App Attack
🇸🇬 187.15.101.141	13 hours ago	Blocked IP: 187.15.101.141; Incident Date: 2026-07-16; UTC Time: 10:44:16; Directory reconnaissance ... show more Blocked IP: 187.15.101.141; Incident Date: 2026-07-16; UTC Time: 10:44:16; Directory reconnaissance and XML-RPC attack: Sample GET URL paths - /wp-includes/ID3/license.txt; /xmlrpc.php; /shop/wp-includes/wlwmanifest.xml; /cms/wp-includes/wlwmanifest.xml; show less	Hacking Web App Attack
🇦🇺 45.134.20.167	16 hours ago	Blocked IP - 45.134.20.167; Incident Date; 2026-07-16; UTC Time: 04:43:01; Blocked Requests: 1000; B ... show more Blocked IP - 45.134.20.167; Incident Date; 2026-07-16; UTC Time: 04:43:01; Blocked Requests: 1000; Blocked by - Cloudflare WAF; User agent and operating system rotation, file and directory enumeration scan, webshell and backdoor searches, known vulnerability scan; Sample GET URL Paths: /upload/install.php; /vendor/phpunit/phpunit/src/Util/PHP/admin-footer.php; /wp-content/plugins/pwnd/install.php; /wp-admin/css/colors/blue/navi.php; /wp-content/autoload_classmap.php; /xp.php%20; /wp-content/bypass_1.php; /wp-admin/maint/repairs.php; /.well-known/pki-validation/xmrlpc.php; /file.php%20; /adminfusm.php; /js/js1.php; /wp-includes/IXR/class-IXR-cilent.php; /about/function.php%20; /wp-content/uploads/wp-cert.phtml; /gm.php; /wp-includes/widgets/security.php; /wp-includes/assets/db.php; /file/function.php; /wp-includes/class-wp-network-query-stat.php; /wp-admin/js/load.php; /images/firewall.php7; /wp-includes/customize/db.php; /css/fan.php; /wp-includes/js/thickbox/about.php; /wsax.php; /css/as.php; show less	Hacking Bad Web Bot Exploited Host Web App Attack
🇨🇦 20.63.63.128	15 Jul 2026	IP Blocked - 20.63.63.128; Incident date: 2026-07-15; UTC Time: 03:28:55; Blocked by: Cloudflare WAF ... show more IP Blocked - 20.63.63.128; Incident date: 2026-07-15; UTC Time: 03:28:55; Blocked by: Cloudflare WAF; User agent: none; Blocked requests: 135; Scanning and exploitation attack targeting PHP web shells/backdoors; Sample GET URL paths: /wp-the.php; /wp-sing.php; /classwithtostring.php; //ss.php; //x.php; /ver.php; //f35.php; /wefile.php; /ms-edit.php; /shx.php; //wp.php; /atomlib.php; /test.php; /amax.php; /dropdown.php; /wp-wz.php; /wp-su.php; /b.php; //wso.php; /pouhg.php; /yas.php; /lp6.php; /r.php; /yanz.php, /classwithtostring.php, /ff.php, /wp-firewall.php /wp-admin/wpyfiavs.php, /wp-content/themes/about.php, /wp-update.php; //f35.php; //test.php; /inputs.php; /samll.php; /wp-su.php; /666.php; show less	Hacking Bad Web Bot Exploited Host Web App Attack
🇺🇸 91.193.232.136	14 Jul 2026	IP Blocked - 91.193.232.136; Incident date: 2026-07-13; UTC time: 15:02:04; Blocked by: Cloudflare W ... show more IP Blocked - 91.193.232.136; Incident date: 2026-07-13; UTC time: 15:02:04; Blocked by: Cloudflare WAF; Two unauthorized login attempts; GET URL path: /wp-login.php; show less	Hacking Web App Attack
🇺🇸 173.239.240.220	14 Jul 2026	IP Blocked - 173.239.240.220; Incident date: 2026-07-13; UTC time: 12:28:47; Blocked by: Cloudflare ... show more IP Blocked - 173.239.240.220; Incident date: 2026-07-13; UTC time: 12:28:47; Blocked by: Cloudflare WAF; Unauthorized login attempts; GET URL paths: /wp-login.php; /wp-login.php; show less	Hacking Web App Attack
🇫🇷 185.177.72.49	13 Jul 2026	This host is conducting automated, high-volume directory brute-forcing (fuzzing) and active scanning ... show more This host is conducting automated, high-volume directory brute-forcing (fuzzing) and active scanning (MITRE ATT&CK T1190) targeting multiple web application frameworks, config files, and credentials. In a single burst, the IP generated over 1,860 rapid-fire parallel requests, attempting to probe and exploit known vulnerabilities. Targeted paths identified in this campaign include: - Critical Credential Leaks & Env Files: /.env, /backend/.env, /public/.env, /.aws/config, /.ssh/id_rsa, /.dockercfg - Remote Code Execution (RCE): /vendor/phpunit/phpunit/Util/PHP/eval-stdin.php - Framework probes: Next.js (/__nextjs_action, /_next/image), Laravel, GraphQL (/v4/playground, /graphql/console), Elasticsearch, Node.js (/var/task/package.json) - CI/CD & Deploy configs: /.github/workflows/deploy.yml, /docker-compose.prod.yml User-Agents utilized: "curl/8.7.1" and "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36". All requests were successfully mitigated at the Edge (WAF Cloudflare) show less	Hacking Bad Web Bot Web App Attack
🇧🇷 20.226.26.5	13 Jul 2026	Cloudflare custom firewall blocked an aggressive automated vulnerability scan from 20.226.26.5 ; The ... show more Cloudflare custom firewall blocked an aggressive automated vulnerability scan from 20.226.26.5 ; The host generated multiple rapid GET requests in a 4-second window, scanning the root directory for potential PHP backdoors, web shells, and malicious entry points (e.g., /wp-cliner.php, /wp-firewall.php, /666.php, /reyna.php, /ma1.php). All malicious requests were strictly blocked by the WAF. Log Sample: - 2026-07-13T13:10:07Z \| GET /wp-cliner.php \| Action: block - 2026-07-13T13:10:07Z \| GET /reyna.php \| Action: block - 2026-07-13T13:10:06Z \| GET /w1px.php \| Action: block - 2026-07-13T13:10:04Z \| GET /wp-firewall.php \| Action: block - 2026-07-13T13:10:03Z \| GET /666.php \| Action: block show less	Hacking Bad Web Bot Exploited Host Web App Attack
🇶🇦 185.200.234.1	13 Jul 2026	IP Blocked: 185.200.234.1; Incident Date - 2026-07-13; Blocked by: Cloudflare WAF - managed challeng ... show more IP Blocked: 185.200.234.1; Incident Date - 2026-07-13; Blocked by: Cloudflare WAF - managed challenge; UTC Time - 09:34:29; Access attempt to xml-rpc: POST "clientRequestPath": "/xmlrpc.php"; show less	Web App Attack
🇨🇦 20.104.50.116	09 Jul 2026	IP Blocked: 20.104.50.116; 2027-07-07; UTC Time - 15:09:46; Blocked by: Cloudflare WAF; Blocked Requ ... show more IP Blocked: 20.104.50.116; 2027-07-07; UTC Time - 15:09:46; Blocked by: Cloudflare WAF; Blocked Requests - 41; Scanning attack targeting typical names for webshells, backdoor panels, exfiltration scripts, and malware artifacts. URL Paths: GET - /ant.php; /forx.php; /domvf.php; /wp-su.php; /oiitmfgw.php; /skr.php; /error_log.php; /class-db.php; /log.php; /mj2.php; Threatfox listing for this IP; ClearFake and DCRat dated 2026-07-09. show less	Bad Web Bot Exploited Host Web App Attack
🇫🇷 104.28.211.186	09 Jul 2026	IP Blocked: 104.28.211.186; 2027-07-07; UTC Time - 23:32:55 - 23:33:15; User agents - Mozilla/5.0 Ap ... show more IP Blocked: 104.28.211.186; 2027-07-07; UTC Time - 23:32:55 - 23:33:15; User agents - Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot; Mozilla/5.0 (compatible; cohere-ai/1.0; +https://cohere.com); Mozilla/5.0 (compatible; Applebot/0.1; +http://www.apple.com/go/applebot); Mozilla/5.0 (compatible; Bytespider; [email protected]); Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot; CCBot/2.0 (https://commoncrawl.org/faq/); Mozilla/5.0 (compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot); Blocked by - Cloudflare WAF; User-agent rotation, User-Agent spoofing, scanning for credentials and system variables, searching for Private Keys and Cryptographic Certificates, searching for Debug Endpoints; URL path - /.env.old, /.env.dev, /.env.php.bak, /.env.swp, /firebase-adminsdk.json, /keys/service-account.json, /key.json, /secrets.yml, /application.yml; show less	Bad Web Bot Exploited Host Web App Attack
🇮🇩 45.251.75.102	09 Jul 2026	IP Blocked: 45.251.75.102; 2027-07-09; UTC Time - 03:30:34; User Agent - Mozilla/5.0 (Windows NT 10. ... show more IP Blocked: 45.251.75.102; 2027-07-09; UTC Time - 03:30:34; User Agent - Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.43 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 OPR/121.0.0.0; Blocked by - Cloudflare WAF; unauthorized login attempt: URL path - POST /wp-login.php; show less	Web App Attack
🇨🇭 107.189.14.87	09 Jul 2026	Blocked IP: 107.189.14.87; Incident date and time: 2026-07-09 12:20:43 - 12:20:51; Blocked requests ... show more Blocked IP: 107.189.14.87; Incident date and time: 2026-07-09 12:20:43 - 12:20:51; Blocked requests - 12; Source operating systems: Unknown/other - 5; Windows - 4; MacOSX - 2; Detected user agents: python-requests/2.34.2; - 5; Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0 - 5; Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 - 2 URL paths: GET: / /plugins/editors/jce/jce.xml; /administrator/components/com_jce/; /media/system/js/core.js; /media/jui/js/bootstrap.min.js; /media/vendor/jquery/js/jquery.min.js; /wp-admin/admin-ajax.php; /wp-content/plugins/wp_zjvidis/wp_zjvidis.php; /wp-content/plugins/wp_zjvidis/wp_zjvidis.php; /wp-content/plugins/wp_zjvidis/wp_zjvidis.php; /wp-content/plugins/wp_zjvidis/wp_zjvidis.php; show less	Hacking Bad Web Bot Exploited Host Web App Attack
🇧🇷 2804:1dc8:cd05:af00:9da4:967c:71a0:96a8	08 Jul 2026	IP Blocked: 2804:1dc8:cd05:af00:9da4:967c:71a0:96a8; Incident Date: 2026-07-07; UTC Time: 17:51:12; ... show more IP Blocked: 2804:1dc8:cd05:af00:9da4:967c:71a0:96a8; Incident Date: 2026-07-07; UTC Time: 17:51:12; Blocked by Cloudflare WAF; XML-RPC attack targeting brute-force: POST /xmlrpc.php; show less	Hacking Brute-Force Web App Attack
🇦🇿 31.171.101.157	08 Jul 2026	Incident Date: 2026-07-07; UTC Time: 23:32:54; Blocked by Cloudflare WAF; Unauthorized login attempt ... show more Incident Date: 2026-07-07; UTC Time: 23:32:54; Blocked by Cloudflare WAF; Unauthorized login attempt via POST method: POST /wp-login.php; show less	Web App Attack
🇰🇷 20.196.218.235	06 Jul 2026	Incident Date: 2026-07-06; UTC Time: 15:26:33; Blocked by Cloudflare WAF; Within a span of just one ... show more Incident Date: 2026-07-06; UTC Time: 15:26:33; Blocked by Cloudflare WAF; Within a span of just one second, the attacker executed rapid, automated directory discovery scans and "backdoor hunting" probes, searching for web shells, exploit traces, and sensitive paths. Key indicators of malicious activity: - Probing for generic web shells and backdoor scripts (/mini.php, /mah.php, /gg.php, /test1.php, /file56.php, /1.php). - Attempting to fingerprint core libraries and potential attack vector files (/wp-includes/PHPMailer/, /wp-includes/SimplePie/about.php, /wp-configs.php). - The host is currently flagged by Spamhaus as an active spam sender, indicating that these probes aim to compromise the server for use as a spam relay. Log excerpt: [2026-07-06 12:26:33/34 BRT] GET /mini.php [2026-07-06 12:26:33/34 BRT] GET /mah.php [2026-07-06 12:26:33/34 BRT] GET /wp-configs.php [2026-07-06 12:26:33/34 BRT] GET /wp-includes/PHPMailer/ [2026-07-06 12:26:33/34 BRT] GET /wp-content/themes/alera/alpha.php show less	Hacking Exploited Host Web App Attack
🇳🇱 34.91.94.138	06 Jul 2026	Blocked IP: 34.91.94.138; Incident date: 2026-07-05; UTC time: 11:32:07; Blocked by: Cloudflare WAF; ... show more Blocked IP: 34.91.94.138; Incident date: 2026-07-05; UTC time: 11:32:07; Blocked by: Cloudflare WAF; Blocked requests: 16 GET requests in 2 seconds; Scanning attack targeting WordPress version reconnaissance and XML-RPC attack: Log snippet: [2026-07-05 08:32:06/07 BRT] GET /xmlrpc.php [2026-07-05 08:32:06/07 BRT] GET /wp-includes/ID3/license.txt [2026-07-05 08:32:06/07 BRT] GET /blog/wp-includes/wlwmanifest.xml [2026-07-05 08:32:06/07 BRT] GET /cms/wp-includes/wlwmanifest.xml [2026-07-05 08:32:06/07 BRT] GET /test/wp-includes/wlwmanifest.xml show less	Hacking Exploited Host Web App Attack
🇺🇸 104.28.214.112	04 Jul 2026	Incident Date/Time (UTC): 2026-07-03 — 05:12:44; Incident Summary: Blocked IP: 104.28.214.112; Au ... show more Incident Date/Time (UTC): 2026-07-03 — 05:12:44; Incident Summary: Blocked IP: 104.28.214.112; Automated PHP backdoor scanning and probing attack — a scan attempting to locate known malicious PHP files. GET URL paths: /lufix.php /wp-content/themes/txets.php /wp-includes/txets.php /wp-admin/txets.php /wp-editor.php /ioxi-o.php /wp-admin/css/index.php /wp-content/index.php /classwithtostring.php /bolt.php /dex.php /zwso.php /wp-admin/admin-ajax.php /cord.php /abcd.php /class-t.api.php /bless.php /gifclass.php /flower.php /chosen.php /file.php /ms-themes.php show less	Hacking Bad Web Bot Web App Attack
🇦🇺 45.132.224.118	04 Jul 2026	Incident Date/Time (UTC): 2026-07-04 — 07:23:41; Incident Summary: Blocked IP: 45.132.224.118; Hi ... show more Incident Date/Time (UTC): 2026-07-04 — 07:23:41; Incident Summary: Blocked IP: 45.132.224.118; High-intensity automated attack blocked by Wordfence; 707 requests blocked. Aggressive scanning for webshells and attempts to exploit known vulnerabilities in WordPress and PHP. Malicious Paths Accessed (sample): /upload/bilder/; /wp-admin/js/file/; /templates/beez5/; /wp-includes/blocks/file/; /.tmb/; /ALFA_DATA/alfacgiapi/; /wp-content/themes/wp-pridmag/; /wp-includes/Requests/Text/; /wp-content/themes/Avada/licensing/; /themes/travelscape/; /rest-api/fields/; /wp-includes/js/tinymce/utils/%20; /js/tinymce/utils/%20; show less	Hacking Bad Web Bot Web App Attack
🇦🇺 45.132.224.154	04 Jul 2026	Incident Date/Time (UTC): 2026-07-04 — 07:20:34; Incident Summary: Blocked IP: 45.132.224.154; Hi ... show more Incident Date/Time (UTC): 2026-07-04 — 07:20:34; Incident Summary: Blocked IP: 45.132.224.154; High-intensity automated attack; 1,690 requests blocked. Aggressive scanning for webshells and attempts to exploit known vulnerabilities in WordPress and PHP. Malicious Paths Accessed (sample): /lock360.php /wso.php /admin.php /wp-content/plugins/seoplugins/db.php?u /wp-content/plugins/pwnd/pwnd.php /cgi-bin/bypass.php /wp-admin/css/colors/midnight/admin.php /wp-content/plugins/core-plugin/include.php /wp-includes/style-engine/worksec.php /wp-content/plugins/elementor/wp-wjvngrh.php Additional Evidence (Cloudflare): /uploads/c99shell.php /uploads/lala.php /wp-includes/css/install.php /vendor/phpunit/phpunit/src/Util/PHP/abcd.php /retu11.PhP7 show less	Hacking Brute-Force Bad Web Bot Web App Attack
🇰🇷 52.231.68.76	03 Jul 2026	Blocked IP: 52.231.68.76; Incident Date: 2026-07-03; UTC Time: 19:13:48; Number of blocked requests: ... show more Blocked IP: 52.231.68.76; Incident Date: 2026-07-03; UTC Time: 19:13:48; Number of blocked requests: 132; Blocked by: Cloudflare WAF; Attempt to locate/install PHP backdoors, search for known vulnerabilities, search for alternative authentication paths, and mass scanning; GET URL paths: /aa.php; /9.php; /send.php; /size.php; /gifclass.php; /file56.php; /php.php; /1.php; /222.php; /mini.php; /as.php; /about.php; /wp-content/uploads/wp-login.php; /wp-content/uploads/wp-login.php; /wp-content/plugins/WordPressCore/; /wp-content/plugins/core-plugin/include.php; /wp-content/admin.php; show less	Hacking Bad Web Bot Web App Attack
🇳🇱 194.26.192.129	03 Jul 2026	Incident date: 2026-07-03; UTC time: 11:55:30; Automated scanning attack blocked by Wordfence; GET U ... show more Incident date: 2026-07-03; UTC time: 11:55:30; Automated scanning attack blocked by Wordfence; GET URL paths: GET /wp-content/plugins/fix/up.php; /wp-plain.php; /wp-content/themes/seotheme/db.php?u ; /alfacgiapi/perl.alfa; show less	Bad Web Bot Web App Attack
🇸🇬 4.193.191.49	02 Jul 2026	IP found scanning for common vulnerabilities and known web shells / backdoors. Automated botnet acti ... show more IP found scanning for common vulnerabilities and known web shells / backdoors. Automated botnet activity detected (matching Andromeda/Gamarue behavior). Blocked 122 requests. Triggered WAF rules for unauthorized directory traversal and exploit attempts. Targeted paths included: - /lock360.php - /wp-content/uploads/min.php - /zoom1.php - /wp-admin/classwithtostring.php - /randkeyword.PhP7 - /sagax1.php - /NewFile.php - /abcd.php - /admin/controller/extension/ - /xleet.php - /96i.php - /155.php - /php8.php IP heavily listed as an active malware-infected device (Andromeda C2 communication reported by abuse.ch). Permanently blocked at Cloudflare edge. show less	Hacking Bad Web Bot Web App Attack
🇳🇱 2.58.56.23	01 Jul 2026	Blocked IP: 2.58.56.23; Blocked by: Cloudflare WAF; Incident Date: 2026-07-01; UTC Time: 07:32:51; N ... show more Blocked IP: 2.58.56.23; Blocked by: Cloudflare WAF; Incident Date: 2026-07-01; UTC Time: 07:32:51; Number of blocked requests: 10; Bot-executed vulnerability scanning attack; URL paths: POST /wp-plain.php; POST /ALFA_DATA/alfacgiapi/perl.alfa; GET /wp-content/themes/seotheme/db.php?u; GET /; GET /wp-content/plugins/fix/up.php; POST /alfacgiapi/perl.alfa; GET /xpefoexv.php?Fox=d3wL7; GET /wp-content/themes/seotheme/db.php; POST /wp-plain.php; GET /ufyhyfpr.php?Fox=d3wL7; show less	Hacking Bad Web Bot Web App Attack