AbuseIPDB

JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

User Black_Brazil , the webmaster of richardsonserra.com, joined AbuseIPDB in July 2023 and has reported 558 IP addresses.

Standing (weight) is good.

ACTIVE USER WEBMASTER SUPPORTER

IP	Date	Comment	Categories
🇨🇦 20.63.63.128	15 Jul 2026	IP Blocked - 20.63.63.128; Incident date: 2026-07-15; UTC Time: 03:28:55; Blocked by: Cloudflare WAF ... show more IP Blocked - 20.63.63.128; Incident date: 2026-07-15; UTC Time: 03:28:55; Blocked by: Cloudflare WAF; User agent: none; Blocked requests: 135; Scanning and exploitation attack targeting PHP web shells/backdoors; Sample GET URL paths: /wp-the.php; /wp-sing.php; /classwithtostring.php; //ss.php; //x.php; /ver.php; //f35.php; /wefile.php; /ms-edit.php; /shx.php; //wp.php; /atomlib.php; /test.php; /amax.php; /dropdown.php; /wp-wz.php; /wp-su.php; /b.php; //wso.php; /pouhg.php; /yas.php; /lp6.php; /r.php; /yanz.php, /classwithtostring.php, /ff.php, /wp-firewall.php /wp-admin/wpyfiavs.php, /wp-content/themes/about.php, /wp-update.php; //f35.php; //test.php; /inputs.php; /samll.php; /wp-su.php; /666.php; show less	Hacking Bad Web Bot Exploited Host Web App Attack
🇺🇸 91.193.232.136	14 Jul 2026	IP Blocked - 91.193.232.136; Incident date: 2026-07-13; UTC time: 15:02:04; Blocked by: Cloudflare W ... show more IP Blocked - 91.193.232.136; Incident date: 2026-07-13; UTC time: 15:02:04; Blocked by: Cloudflare WAF; Two unauthorized login attempts; GET URL path: /wp-login.php; show less	Hacking Web App Attack
🇺🇸 173.239.240.220	14 Jul 2026	IP Blocked - 173.239.240.220; Incident date: 2026-07-13; UTC time: 12:28:47; Blocked by: Cloudflare ... show more IP Blocked - 173.239.240.220; Incident date: 2026-07-13; UTC time: 12:28:47; Blocked by: Cloudflare WAF; Unauthorized login attempts; GET URL paths: /wp-login.php; /wp-login.php; show less	Hacking Web App Attack
🇫🇷 185.177.72.49	13 Jul 2026	This host is conducting automated, high-volume directory brute-forcing (fuzzing) and active scanning ... show more This host is conducting automated, high-volume directory brute-forcing (fuzzing) and active scanning (MITRE ATT&CK T1190) targeting multiple web application frameworks, config files, and credentials. In a single burst, the IP generated over 1,860 rapid-fire parallel requests, attempting to probe and exploit known vulnerabilities. Targeted paths identified in this campaign include: - Critical Credential Leaks & Env Files: /.env, /backend/.env, /public/.env, /.aws/config, /.ssh/id_rsa, /.dockercfg - Remote Code Execution (RCE): /vendor/phpunit/phpunit/Util/PHP/eval-stdin.php - Framework probes: Next.js (/__nextjs_action, /_next/image), Laravel, GraphQL (/v4/playground, /graphql/console), Elasticsearch, Node.js (/var/task/package.json) - CI/CD & Deploy configs: /.github/workflows/deploy.yml, /docker-compose.prod.yml User-Agents utilized: "curl/8.7.1" and "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36". All requests were successfully mitigated at the Edge (WAF Cloudflare) show less	Hacking Bad Web Bot Web App Attack
🇧🇷 20.226.26.5	13 Jul 2026	Cloudflare custom firewall blocked an aggressive automated vulnerability scan from 20.226.26.5 ; The ... show more Cloudflare custom firewall blocked an aggressive automated vulnerability scan from 20.226.26.5 ; The host generated multiple rapid GET requests in a 4-second window, scanning the root directory for potential PHP backdoors, web shells, and malicious entry points (e.g., /wp-cliner.php, /wp-firewall.php, /666.php, /reyna.php, /ma1.php). All malicious requests were strictly blocked by the WAF. Log Sample: - 2026-07-13T13:10:07Z \| GET /wp-cliner.php \| Action: block - 2026-07-13T13:10:07Z \| GET /reyna.php \| Action: block - 2026-07-13T13:10:06Z \| GET /w1px.php \| Action: block - 2026-07-13T13:10:04Z \| GET /wp-firewall.php \| Action: block - 2026-07-13T13:10:03Z \| GET /666.php \| Action: block show less	Hacking Bad Web Bot Exploited Host Web App Attack
🇶🇦 185.200.234.1	13 Jul 2026	IP Blocked: 185.200.234.1; Incident Date - 2026-07-13; Blocked by: Cloudflare WAF - managed challeng ... show more IP Blocked: 185.200.234.1; Incident Date - 2026-07-13; Blocked by: Cloudflare WAF - managed challenge; UTC Time - 09:34:29; Access attempt to xml-rpc: POST "clientRequestPath": "/xmlrpc.php"; show less	Web App Attack
🇨🇦 20.104.50.116	09 Jul 2026	IP Blocked: 20.104.50.116; 2027-07-07; UTC Time - 15:09:46; Blocked by: Cloudflare WAF; Blocked Requ ... show more IP Blocked: 20.104.50.116; 2027-07-07; UTC Time - 15:09:46; Blocked by: Cloudflare WAF; Blocked Requests - 41; Scanning attack targeting typical names for webshells, backdoor panels, exfiltration scripts, and malware artifacts. URL Paths: GET - /ant.php; /forx.php; /domvf.php; /wp-su.php; /oiitmfgw.php; /skr.php; /error_log.php; /class-db.php; /log.php; /mj2.php; Threatfox listing for this IP; ClearFake and DCRat dated 2026-07-09. show less	Bad Web Bot Exploited Host Web App Attack
🇫🇷 104.28.211.186	09 Jul 2026	IP Blocked: 104.28.211.186; 2027-07-07; UTC Time - 23:32:55 - 23:33:15; User agents - Mozilla/5.0 Ap ... show more IP Blocked: 104.28.211.186; 2027-07-07; UTC Time - 23:32:55 - 23:33:15; User agents - Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot; Mozilla/5.0 (compatible; cohere-ai/1.0; +https://cohere.com); Mozilla/5.0 (compatible; Applebot/0.1; +http://www.apple.com/go/applebot); Mozilla/5.0 (compatible; Bytespider; [email protected]); Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot; CCBot/2.0 (https://commoncrawl.org/faq/); Mozilla/5.0 (compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot); Blocked by - Cloudflare WAF; User-agent rotation, User-Agent spoofing, scanning for credentials and system variables, searching for Private Keys and Cryptographic Certificates, searching for Debug Endpoints; URL path - /.env.old, /.env.dev, /.env.php.bak, /.env.swp, /firebase-adminsdk.json, /keys/service-account.json, /key.json, /secrets.yml, /application.yml; show less	Bad Web Bot Exploited Host Web App Attack
🇮🇩 45.251.75.102	09 Jul 2026	IP Blocked: 45.251.75.102; 2027-07-09; UTC Time - 03:30:34; User Agent - Mozilla/5.0 (Windows NT 10. ... show more IP Blocked: 45.251.75.102; 2027-07-09; UTC Time - 03:30:34; User Agent - Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.43 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 OPR/121.0.0.0; Blocked by - Cloudflare WAF; unauthorized login attempt: URL path - POST /wp-login.php; show less	Web App Attack
🇨🇭 107.189.14.87	09 Jul 2026	Blocked IP: 107.189.14.87; Incident date and time: 2026-07-09 12:20:43 - 12:20:51; Blocked requests ... show more Blocked IP: 107.189.14.87; Incident date and time: 2026-07-09 12:20:43 - 12:20:51; Blocked requests - 12; Source operating systems: Unknown/other - 5; Windows - 4; MacOSX - 2; Detected user agents: python-requests/2.34.2; - 5; Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0 - 5; Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 - 2 URL paths: GET: / /plugins/editors/jce/jce.xml; /administrator/components/com_jce/; /media/system/js/core.js; /media/jui/js/bootstrap.min.js; /media/vendor/jquery/js/jquery.min.js; /wp-admin/admin-ajax.php; /wp-content/plugins/wp_zjvidis/wp_zjvidis.php; /wp-content/plugins/wp_zjvidis/wp_zjvidis.php; /wp-content/plugins/wp_zjvidis/wp_zjvidis.php; /wp-content/plugins/wp_zjvidis/wp_zjvidis.php; show less	Hacking Bad Web Bot Exploited Host Web App Attack
🇧🇷 2804:1dc8:cd05:af00:9da4:967c:71a0:96a8	08 Jul 2026	IP Blocked: 2804:1dc8:cd05:af00:9da4:967c:71a0:96a8; Incident Date: 2026-07-07; UTC Time: 17:51:12; ... show more IP Blocked: 2804:1dc8:cd05:af00:9da4:967c:71a0:96a8; Incident Date: 2026-07-07; UTC Time: 17:51:12; Blocked by Cloudflare WAF; XML-RPC attack targeting brute-force: POST /xmlrpc.php; show less	Hacking Brute-Force Web App Attack
🇦🇿 31.171.101.157	08 Jul 2026	Incident Date: 2026-07-07; UTC Time: 23:32:54; Blocked by Cloudflare WAF; Unauthorized login attempt ... show more Incident Date: 2026-07-07; UTC Time: 23:32:54; Blocked by Cloudflare WAF; Unauthorized login attempt via POST method: POST /wp-login.php; show less	Web App Attack
🇰🇷 20.196.218.235	06 Jul 2026	Incident Date: 2026-07-06; UTC Time: 15:26:33; Blocked by Cloudflare WAF; Within a span of just one ... show more Incident Date: 2026-07-06; UTC Time: 15:26:33; Blocked by Cloudflare WAF; Within a span of just one second, the attacker executed rapid, automated directory discovery scans and "backdoor hunting" probes, searching for web shells, exploit traces, and sensitive paths. Key indicators of malicious activity: - Probing for generic web shells and backdoor scripts (/mini.php, /mah.php, /gg.php, /test1.php, /file56.php, /1.php). - Attempting to fingerprint core libraries and potential attack vector files (/wp-includes/PHPMailer/, /wp-includes/SimplePie/about.php, /wp-configs.php). - The host is currently flagged by Spamhaus as an active spam sender, indicating that these probes aim to compromise the server for use as a spam relay. Log excerpt: [2026-07-06 12:26:33/34 BRT] GET /mini.php [2026-07-06 12:26:33/34 BRT] GET /mah.php [2026-07-06 12:26:33/34 BRT] GET /wp-configs.php [2026-07-06 12:26:33/34 BRT] GET /wp-includes/PHPMailer/ [2026-07-06 12:26:33/34 BRT] GET /wp-content/themes/alera/alpha.php show less	Hacking Exploited Host Web App Attack
🇳🇱 34.91.94.138	06 Jul 2026	Blocked IP: 34.91.94.138; Incident date: 2026-07-05; UTC time: 11:32:07; Blocked by: Cloudflare WAF; ... show more Blocked IP: 34.91.94.138; Incident date: 2026-07-05; UTC time: 11:32:07; Blocked by: Cloudflare WAF; Blocked requests: 16 GET requests in 2 seconds; Scanning attack targeting WordPress version reconnaissance and XML-RPC attack: Log snippet: [2026-07-05 08:32:06/07 BRT] GET /xmlrpc.php [2026-07-05 08:32:06/07 BRT] GET /wp-includes/ID3/license.txt [2026-07-05 08:32:06/07 BRT] GET /blog/wp-includes/wlwmanifest.xml [2026-07-05 08:32:06/07 BRT] GET /cms/wp-includes/wlwmanifest.xml [2026-07-05 08:32:06/07 BRT] GET /test/wp-includes/wlwmanifest.xml show less	Hacking Exploited Host Web App Attack
🇺🇸 104.28.214.112	04 Jul 2026	Incident Date/Time (UTC): 2026-07-03 — 05:12:44; Incident Summary: Blocked IP: 104.28.214.112; Au ... show more Incident Date/Time (UTC): 2026-07-03 — 05:12:44; Incident Summary: Blocked IP: 104.28.214.112; Automated PHP backdoor scanning and probing attack — a scan attempting to locate known malicious PHP files. GET URL paths: /lufix.php /wp-content/themes/txets.php /wp-includes/txets.php /wp-admin/txets.php /wp-editor.php /ioxi-o.php /wp-admin/css/index.php /wp-content/index.php /classwithtostring.php /bolt.php /dex.php /zwso.php /wp-admin/admin-ajax.php /cord.php /abcd.php /class-t.api.php /bless.php /gifclass.php /flower.php /chosen.php /file.php /ms-themes.php show less	Hacking Bad Web Bot Web App Attack
🇦🇺 45.132.224.118	04 Jul 2026	Incident Date/Time (UTC): 2026-07-04 — 07:23:41; Incident Summary: Blocked IP: 45.132.224.118; Hi ... show more Incident Date/Time (UTC): 2026-07-04 — 07:23:41; Incident Summary: Blocked IP: 45.132.224.118; High-intensity automated attack blocked by Wordfence; 707 requests blocked. Aggressive scanning for webshells and attempts to exploit known vulnerabilities in WordPress and PHP. Malicious Paths Accessed (sample): /upload/bilder/; /wp-admin/js/file/; /templates/beez5/; /wp-includes/blocks/file/; /.tmb/; /ALFA_DATA/alfacgiapi/; /wp-content/themes/wp-pridmag/; /wp-includes/Requests/Text/; /wp-content/themes/Avada/licensing/; /themes/travelscape/; /rest-api/fields/; /wp-includes/js/tinymce/utils/%20; /js/tinymce/utils/%20; show less	Hacking Bad Web Bot Web App Attack
🇦🇺 45.132.224.154	04 Jul 2026	Incident Date/Time (UTC): 2026-07-04 — 07:20:34; Incident Summary: Blocked IP: 45.132.224.154; Hi ... show more Incident Date/Time (UTC): 2026-07-04 — 07:20:34; Incident Summary: Blocked IP: 45.132.224.154; High-intensity automated attack; 1,690 requests blocked. Aggressive scanning for webshells and attempts to exploit known vulnerabilities in WordPress and PHP. Malicious Paths Accessed (sample): /lock360.php /wso.php /admin.php /wp-content/plugins/seoplugins/db.php?u /wp-content/plugins/pwnd/pwnd.php /cgi-bin/bypass.php /wp-admin/css/colors/midnight/admin.php /wp-content/plugins/core-plugin/include.php /wp-includes/style-engine/worksec.php /wp-content/plugins/elementor/wp-wjvngrh.php Additional Evidence (Cloudflare): /uploads/c99shell.php /uploads/lala.php /wp-includes/css/install.php /vendor/phpunit/phpunit/src/Util/PHP/abcd.php /retu11.PhP7 show less	Hacking Brute-Force Bad Web Bot Web App Attack
🇰🇷 52.231.68.76	03 Jul 2026	Blocked IP: 52.231.68.76; Incident Date: 2026-07-03; UTC Time: 19:13:48; Number of blocked requests: ... show more Blocked IP: 52.231.68.76; Incident Date: 2026-07-03; UTC Time: 19:13:48; Number of blocked requests: 132; Blocked by: Cloudflare WAF; Attempt to locate/install PHP backdoors, search for known vulnerabilities, search for alternative authentication paths, and mass scanning; GET URL paths: /aa.php; /9.php; /send.php; /size.php; /gifclass.php; /file56.php; /php.php; /1.php; /222.php; /mini.php; /as.php; /about.php; /wp-content/uploads/wp-login.php; /wp-content/uploads/wp-login.php; /wp-content/plugins/WordPressCore/; /wp-content/plugins/core-plugin/include.php; /wp-content/admin.php; show less	Hacking Bad Web Bot Web App Attack
🇳🇱 194.26.192.129	03 Jul 2026	Incident date: 2026-07-03; UTC time: 11:55:30; Automated scanning attack blocked by Wordfence; GET U ... show more Incident date: 2026-07-03; UTC time: 11:55:30; Automated scanning attack blocked by Wordfence; GET URL paths: GET /wp-content/plugins/fix/up.php; /wp-plain.php; /wp-content/themes/seotheme/db.php?u ; /alfacgiapi/perl.alfa; show less	Bad Web Bot Web App Attack
🇸🇬 4.193.191.49	02 Jul 2026	IP found scanning for common vulnerabilities and known web shells / backdoors. Automated botnet acti ... show more IP found scanning for common vulnerabilities and known web shells / backdoors. Automated botnet activity detected (matching Andromeda/Gamarue behavior). Blocked 122 requests. Triggered WAF rules for unauthorized directory traversal and exploit attempts. Targeted paths included: - /lock360.php - /wp-content/uploads/min.php - /zoom1.php - /wp-admin/classwithtostring.php - /randkeyword.PhP7 - /sagax1.php - /NewFile.php - /abcd.php - /admin/controller/extension/ - /xleet.php - /96i.php - /155.php - /php8.php IP heavily listed as an active malware-infected device (Andromeda C2 communication reported by abuse.ch). Permanently blocked at Cloudflare edge. show less	Hacking Bad Web Bot Web App Attack
🇳🇱 2.58.56.23	01 Jul 2026	Blocked IP: 2.58.56.23; Blocked by: Cloudflare WAF; Incident Date: 2026-07-01; UTC Time: 07:32:51; N ... show more Blocked IP: 2.58.56.23; Blocked by: Cloudflare WAF; Incident Date: 2026-07-01; UTC Time: 07:32:51; Number of blocked requests: 10; Bot-executed vulnerability scanning attack; URL paths: POST /wp-plain.php; POST /ALFA_DATA/alfacgiapi/perl.alfa; GET /wp-content/themes/seotheme/db.php?u; GET /; GET /wp-content/plugins/fix/up.php; POST /alfacgiapi/perl.alfa; GET /xpefoexv.php?Fox=d3wL7; GET /wp-content/themes/seotheme/db.php; POST /wp-plain.php; GET /ufyhyfpr.php?Fox=d3wL7; show less	Hacking Bad Web Bot Web App Attack
🇺🇸 135.119.73.164	30 Jun 2026	IP Address: 135.119.73.164; Date: 2026-06-30; UTC Time: 20:18:12; Blocked by - Cloudflare WAF - bloc ... show more IP Address: 135.119.73.164; Date: 2026-06-30; UTC Time: 20:18:12; Blocked by - Cloudflare WAF - blocked via custom rules; Number of blocked requests: 97; A persistent, high-risk campaign of automated vulnerability scanning and brute-force attacks originating from IP 135.119.73.164 was detected.; GET URL paths: /wk/index.php; /inputs.php; /function/function.php; /chosen.php?p=; /wp-content/uploads/index.php; /themes.php; /wp-login.php; /wp-trackback.php; /abc.php; /xmlrpc.php; /goods.php; /class-t.api.php; /wp-includes/Requests/src/Response/about.php; /wp-includes/PHPMailer/; /.well-known/; /wp-includes/html-api/; show less	Hacking Brute-Force Web App Attack
🇸🇬 52.139.198.12	30 Jun 2026	IP Address: 52.139.198.12; Date: 2026-06-30; UTC Time: 16:48:00; Blocked by - Cloudflare WAF - custo ... show more IP Address: 52.139.198.12; Date: 2026-06-30; UTC Time: 16:48:00; Blocked by - Cloudflare WAF - custom rule block; Number of blocked requests: 131; Vulnerability scanning and brute-force attacks blocked; GET URL paths: /adminfuns.php; /file.php; /admin.php; /wp-admin/css/colors/ocean/; /wk/index.php; /wp-admin/css/colors/modern/; /wp-content/themes/admin.php; /asd.php; /wp-includes/block-supports/; /wp-content/languages/index.php; /wp-content/plugins/index.php; /wp-includes/PHPMailer/; /wp-admin/css/colors/ectoplasm/; /wp-includes/customize/index.php; /wp-includes/rest-api/fields/; /wp-includes/Requests/library/; /wp-admin/js/widgets/index.php; /wp-includes/SimplePie/about.php; /wp-includes/IXR/wp-login.php; /wp-content/plugins/WordPressCore/; /aaa.php/getid3-core.php; /wp-content/plugins/dummyyummy/wp-signup.php; /adminer.php; /randkeyword.PhP7; /wp-admin/user/index.php; /wp-content/upgrade/index.php; /wp-content/themes/alera/alpha.php; /wp-cron.php; show less	Hacking Brute-Force Bad Web Bot Web App Attack
🇮🇳 20.204.97.153	30 Jun 2026	IP Address: 20.204.97.153; Date : 2026-06-30; UTC Time: 16:39:39; Bloqueado por - WAF Cloudflare - ... show more IP Address: 20.204.97.153; Date : 2026-06-30; UTC Time: 16:39:39; Bloqueado por - WAF Cloudflare - bloqueio nas regras personalizadas; Número de requições bloqueadas: 176; Aggressive, automated web directory brute-forcing (fuzzing) and vulnerability scanning; Caminhos de url GET: /this_is_a_new_hello_world.php; /coffexium.php; /asdf.php; /wp-includes/sodium_compat/; /wp-admin/css/colors/coffee/wp-adochan.php; /footer.php; /wp-content/index.php; /zoro.php; /bajah.php; /cream1.php; /heat3.php; /greap.php; /199.php; /199.php; /green1.php; /biufile.php; /wpconf.php; /ultradybbuks.php; /novax.php; /dejavu.php; /wander.php; /h02ugyh.php; /xenon1337.php; /modules/mod_simplefileuploadv1.3/elements/filemanager.php?p=; /wp-includes/blocks/post-comments-form/; //wp-admin/js/index.php; //wp-includes/Requests/; //admin.php; /classwithtostring.php?=p; /wp-load.php; //wp-includes/assets/; /wp-admin/network/plugins.php; /BDKR28WP.php; //wp-includes/l10n/; show less	Hacking Brute-Force Web App Attack
🇳🇱 2.58.56.155	30 Jun 2026	IP Address: 2.58.56.155; Date : 2026-06-29; UTC Time: 16:26; This IP performed automated maliciou ... show more IP Address: 2.58.56.155; Date : 2026-06-29; UTC Time: 16:26; This IP performed automated malicious requests against my web server, attempting to access known backdoor paths, webshells, and vulnerable WordPress components. Multiple rapid requests were blocked by Cloudflare WAF. Malicious Requests Detected: /wp-content/themes/seotheme/db.php /wp-content/plugins/fix/up.php /wp-plain.php /vhgrdpdw.php /alfacgiapi/perl.alfa /ALFA_DATA/alfacgiapi/perl.alfa External Intelligence: Shodan identifies the host as a Windows Server 2019 machine with RDP (port 3389) exposed and using a self‑signed certificate. Passive DNS shows the PTR record: 2.58.56.155.powered.by.rdp.sh; This PTR is a known indicator of compromised RDP servers used in botnet activity. Conclusion: The IP is part of an automated attack pattern consistent with compromised RDP infrastructure and botnet scanning. It attempted multiple exploitation vectors and should be classified as malicious. show less	Hacking Exploited Host Web App Attack