AbuseIPDB

JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

User grassyloki joined AbuseIPDB in May 2024 and has reported 1,936 IP addresses.

Standing (weight) is good.

ACTIVE USER

IP	Date	Comment	Categories
🇧🇩 103.159.2.113	31 Oct 2026	Bangladesh IP (BdREN/Skymax, abuse 100) flagged by IDS as compromised/hostile traffic, probing our S ... show more Bangladesh IP (BdREN/Skymax, abuse 100) flagged by IDS as compromised/hostile traffic, probing our SSH service on port 22. Target: SSH 22 Seen: 2026-10-31 18:17 EDT - TCP SYN from 103.159.2.113:37374 to port 22 at 2026-10-31 18:17:43, matched IDS ET COMPROMISED Known Compromised or Hostile Host Traffic group 1 - Blocked at the firewall (TCP SYN to port 22) show less	SSH Port Scan
🇨🇳 8.163.69.40	31 Oct 2026	Alibaba Cloud (Guangzhou) IP with an abuse-100 reputation that sent a single malicious-fingerprinted ... show more Alibaba Cloud (Guangzhou) IP with an abuse-100 reputation that sent a single malicious-fingerprinted flow to our internet-facing HTTPS service on port 443. Target: HTTPS 443, internet-facing web service Seen: 2026-10-31 18:18 EDT - TCP SYN from 8.163.69.40:45386 to port 443 at 2026-10-31 18:18:33 - The flow from 8.163.69.40 to port 443 was flagged with a malicious fingerprint on the wire at 2026-10-31 18:18:41 show less	Port Scan
🇱🇹 77.90.185.239	31 Oct 2026	Sent ~169 sustained web app recon requests against the public WordPress, probing for .env files, doc ... show more Sent ~169 sustained web app recon requests against the public WordPress, probing for .env files, docker-compose.yml and theme JS with path-traversal payloads; all sensitive paths were blocked by the web server. Target: HTTPS 443; probes for /.env, /.env.dev, /docker-compose.yml, /wp-content/themes/techengage/js/* and path-traversal payloads Seen: 2026-10-31 16:05-16:17 EDT - 2026-10-31 16:05:00-16:05:10: GET /server/.env -> 403 and GET /web/.env -> 403 - 2026-10-31 16:05:18: GET /.env.dev -> 403, GET /docker-compose.yml -> 404, GET /env -> 404 - 2026-10-31 16:15:55-16:17:35: ~120 rapid GET /wp-content/themes/techengage/js/<bootstrap class names> -> 404/403 - 2026-10-31 16:16:54: GET /wp-includes/js/jquery/jquery.min.js?<backslash path-traversal> HTTP/2.0 -> 200 - All requests used scanner UA 'Mozilla/5.0 (Android 5.0.2; Tablet; rv:42.0) Gecko/42.0 Firefox/42.0' show less	Web App Attack
🇺🇸 15.204.218.198	31 Oct 2026	Single-flow Malicious Fingerprint hit from an OVH US data-center host (abuse 100, port-scan history) ... show more Single-flow Malicious Fingerprint hit from an OVH US data-center host (abuse 100, port-scan history) probing our internet-facing HTTPS service on port 443. Target: HTTPS 443 Seen: 2026-10-31 15:25 EDT - Flow engine flagged a Malicious Fingerprint (Critical severity) from 15.204.218.198:30032 to our internet-facing service on port 443 at 2026-10-31 15:25:13 - Firewall showed a TCP SYN pass from 15.204.218.198:30032 to port 443 at 2026-10-31 15:25:08 show less	Port Scan
🇩🇪 217.154.9.93	31 Oct 2026	Single-flow Malicious Fingerprint hit from an IONOS (Frankfurt, abuse 100, port-scan history) data-c ... show more Single-flow Malicious Fingerprint hit from an IONOS (Frankfurt, abuse 100, port-scan history) data-center host probing our internet-facing HTTPS service on port 443. Target: HTTPS 443 Seen: 2026-10-31 15:25 EDT - Flow engine flagged a Malicious Fingerprint (Critical severity) from 217.154.9.93:30137 to our internet-facing service on port 443 at 2026-10-31 15:25:09 - Firewall showed a TCP SYN pass from 217.154.9.93:30137 to port 443 at 2026-10-31 15:25:03 show less	Port Scan
🇪🇸 158.158.121.152	31 Oct 2026	Scanned public WordPress for .php webshell/receiver files with many 404s, matching known malicious . ... show more Scanned public WordPress for .php webshell/receiver files with many 404s, matching known malicious .php recon from the same operator. Target: HTTPS 443, .php webshell/receiver paths (wp_filemanager.php-style, /pvde.php, /buy.php, /fling.php) Seen: 2026-10-31 13:38 EDT - 13:38:18 GET /pvde.php HTTP/2.0 404 - 13:38:14 GET /buy.php and /sm.php HTTP/2.0 404 - 13:38:14 GET /fling.php?p= HTTP/1.1 404 and 13:38:13 GET /bro.php HTTP/1.1 404 - 13:38:16 GET /ebkid.php and 13:38:17 GET /z70.php HTTP/1.1 404 show less	Web App Attack Bad Web Bot
🇺🇸 23.99.228.58	31 Oct 2026	All requests denied (404). Target: HTTP :80, GET /wp-content/plugins/hellopress/wp_filemanager.php S ... show more All requests denied (404). Target: HTTP :80, GET /wp-content/plugins/hellopress/wp_filemanager.php Seen: 2026-10-31 05:47 EDT - 05:47 23.99.228.58:26566 -> :80 GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1 returned 404 with empty User-Agent - Four GET /wp-content/plugins/hellopress/wp_filemanager.php requests from 23.99.228.58 within 05:47–05:48, all returning 404 (denied) show less	Web App Attack
🇫🇷 85.204.70.90	31 Oct 2026	Sustained WordPress/OpenCart path recon: ~11 automated GETs to sensitive paths in a ~20s burst, all ... show more Sustained WordPress/OpenCart path recon: ~11 automated GETs to sensitive paths in a ~20s burst, all denied (404/403), on a public blog vhost. Target: HTTP 80/HTTPS 443; WordPress and OpenCart paths /wordpress/, /wp-includes/widgets, /wp-includes/assets, /template/, /admin/uploads/, OpenCart controller/extension Seen: 2026-10-31 03:19 EDT - 03:19:47 GET /wp-includes/widgets/ HTTP/2.0 -> 403 on a public blog HTTPS vhost - 03:19:45 GET /wp-includes/assets/ HTTP/2.0 -> 403 on the same public blog HTTPS vhost - 03:19:50 GET /admin/controller/extension/extension/ HTTP/1.1 -> 404 (OpenCart path scan) show less	Web App Attack
🇳🇱 85.11.167.20	31 Oct 2026	Scanned the public WordPress blog a host, probing /wp-admin/install.php and /wp-admin/setup-config.p ... show more Scanned the public WordPress blog a host, probing /wp-admin/install.php and /wp-admin/setup-config.php (both denied 403). categories web-attack/bad-bot. Target: WordPress admin install paths (HTTPS :443); paths /wp-admin/install.php and /wp-admin/setup-config.php Seen: 2026-10-31 00:47 EDT - 00:47:30 85.11.167.20 -> a host GET /wp-admin/install.php HTTP/2.0 = 403 (146 bytes) over HTTPS :443 - 00:47:30 85.11.167.20 -> a host GET /wp-admin/setup-config.php HTTP/2.0 = 403 (146 bytes) over HTTPS :443 - 00:47:28 85.11.167.20 -> a host GET / HTTP/2.0 = 200 (15674 bytes) as the same install/config probe burst, empty User-Agent show less	Web App Attack
🇺🇸 144.172.105.154	31 Oct 2026	Cloudzy data-center host (abuse reputation 100, 660 reports) probing an internet-facing site for exp ... show more Cloudzy data-center host (abuse reputation 100, 660 reports) probing an internet-facing site for exposed Git configuration files and hitting the site's port 80. Target: HTTP 80, GET /.git/config Seen: 2026-10-30 23:51 EDT - 23:51:12 — GET /.git/config HTTP/1.1 sent to the site on port 80 (User-Agent Mozilla/5.0 X11; Linux x86_64); the server answered 301 - 23:51:13 — flagged the flow 144.172.105.154:50300 -> :80 as Possible Exploit (Emergency) show less	Web App Attack Bad Web Bot
🇩🇪 85.192.38.175	31 Oct 2026	AEZA (Berlin) IP probing OpenCart controller paths (/admin/controller/extension/extension/Not_Found. ... show more AEZA (Berlin) IP probing OpenCart controller paths (/admin/controller/extension/extension/Not_Found.php) with a Chrome browser UA; returned 404. Target: HTTPS 443, OpenCart path probe (/admin/controller/extension/extension/Not_Found.php?ok) Seen: 2026-10-30 19:14 EDT - 2026-10-30 19:14:04-19:14:42: repeated GET /admin/controller/extension/extension/Not_Found.php?ok and related OpenCart extension paths with user-agent Chrome 151 - Each request returned 404, confirming the reconnaissance probe was denied show less	Web App Attack
🇸🇬 129.221.192.30	31 Oct 2026	Automated WordPress PHP-file scan from an Oracle (Singapore) IP, probing ~80 admin/config/php paths ... show more Automated WordPress PHP-file scan from an Oracle (Singapore) IP, probing ~80 admin/config/php paths on :443 with Go-http-client/2.0; all returned 404/403, no success. Target: HTTPS 443, WordPress .php path scan (wp-includes/config.php, wp-content/core.php, wp-admin/admin.php, wp-cron.php, xmlrpc.php) Seen: 2026-10-30 19:27-19:30 EDT - 2026-10-30 19:27:39-19:30:00: ~80 sequential GET requests to :443 probing WordPress .php files (wp-includes/config.php, wp-content/core.php, wp-admin/admin.php, wp-content/uploads/upload.php, xmlrpc.php) with user-agent Go-http-client/2.0 - Every request returned 404 or 403; no request received a 200 response, confirming the scans were denied show less	Web App Attack
🇺🇸 132.196.59.85	31 Oct 2026	All responses were 444 (denied). Target: HTTP 80, wp_filemanager.php file upload path probe (/wp-con ... show more All responses were 444 (denied). Target: HTTP 80, wp_filemanager.php file upload path probe (/wp-content/plugins/hellopress/wp_filemanager.php) Seen: 2026-10-30 19:19 EDT - 2026-10-30 19:19:36-19:19:37: repeated GET /wp-content/plugins/hellopress/wp_filemanager.php from 132.196.59.85 on port 80 with empty User-Agent - Every request returned 444 (connection closed), confirming the probe was denied show less	Web App Attack
🇮🇳 46.202.160.99	30 Oct 2026	Hostinger IP probed a WordPress Gravity SMTP plugin unauthenticated REST API endpoint using a CVE-20 ... show more Hostinger IP probed a WordPress Gravity SMTP plugin unauthenticated REST API endpoint using a CVE-2026-4020 signature, returning connection-closed. Target: HTTP 80, /wp-json/gravitysmtp/v1/tests/mock-data (Gravity SMTP unauthenticated REST API, CVE-2026-4020) Seen: 2026-10-30 17:27 EDT - IDS matched 'WordPress Plugin Gravity SMTP Unauthenticated REST API (CVE-2026-4020)' at 2026-10-30 17:27:27, TCP 46.202.160.99:53530 to port 80 - HTTP request GET /wp-json/gravitysmtp/v1/tests/mock-data?page=gravitysmtp-settings HTTP/1.1 returned status 444 (connection closed) at 2026-10-30 17:27:27 show less	Web App Attack
🇩🇪 147.78.240.83	30 Oct 2026	Swept sensitive .env configuration files on a public WordPress site via a batch of GET requests; all ... show more Swept sensitive .env configuration files on a public WordPress site via a batch of GET requests; all returned 403. Target: HTTP sensitive-file sweep on .env* paths Seen: 2026-10-30 16:21 EDT - 16:21:26 GET /.env.production HTTP/2.0 returned 403 from the attacker - 16:21:26 GET /.env.prod HTTP/2.0 returned 403 - 16:21:26 GET /.env.dev HTTP/2.0 returned 403 - 16:21:26 GET /.a host HTTP/2.0 returned 403 - 16:21:26 GET /.env.bak HTTP/2.0 returned 403 - 16:21:26 GET /.env HTTP/2.0 returned 403 show less	Web App Attack
🇦🇪 20.46.43.126	30 Oct 2026	Scanned the public WordPress blog with ~25 failed .php path probes (admin.php, c.php, f.php, 66.php, ... show more Scanned the public WordPress blog with ~25 failed .php path probes (admin.php, c.php, f.php, 66.php, 222.php, xda.php, wp-mail.php, wp-includes/) over ~2 minutes, all returning 404. Target: HTTPS 443 HTTP 80, WordPress blog, arbitrary .php paths (admin.php, c.php, 66.php, wp-mail.php, wp-includes/) Seen: 2026-10-30 14:47-14:48 EDT - 2026-10-30 14:47:56 GET /1.php HTTP/1.1 returned 404 from 20.46.43.126 - 2026-10-30 14:47:47 GET /admin.php → 404 and GET /wp-includes/js/codemirror/about.php → 404 from 20.46.43.126 - 2026-10-30 14:47-14:48: ~25 distinct .php probe paths from 20.46.43.126 against the WordPress vhost, all 404 show less	Web App Attack Port Scan
🇦🇺 51.161.136.177	30 Oct 2026	Sip scanner probing SIP over UDP/5060 with the friendly-scanner User-Agent, flagged by IDS ET SCAN S ... show more Sip scanner probing SIP over UDP/5060 with the friendly-scanner User-Agent, flagged by IDS ET SCAN Sipvicious signatures. Target: SIP service, UDP port 5060 Seen: 2026-10-30 14:45 EDT - 2026-10-30 14:45:16 IDS ET SCAN Sipvicious Scan [1:2008578:4] {UDP} 51.161.136.177:5060 -> :5060 - 2026-10-30 14:45:16 IDS ET SCAN Sipvicious User-Agent Detected (friendly-scanner) [1:2011716:3] {UDP} 51.161.136.177:5060 -> :5060 show less	Port Scan Fraud VoIP
🇺🇸 45.61.188.238	30 Oct 2026	Attack traffic from this IP. Target: HTTP 80, WordPress site kimberlymackdesign.com: repeated GET /w ... show more Attack traffic from this IP. Target: HTTP 80, WordPress site kimberlymackdesign.com: repeated GET /wp-content/plugins/wp_rokgpnb/wp_rokgpnb.php, POST /wp-admin/admin-ajax.php?action=updraft_central_ajaxcallback, GET /administrator/com... Seen: 2026-10-30 13:21-13:25 EDT - 13:25:45-13:25:49: repeated GET /wp-content/plugins/wp_rokgpnb/wp_rokgpnb.php from 45.61.188.238 on kimberlymackdesign.com, all 404, user-agent python-requests/2.34.2 - 13:25:41: POST /wp-admin/admin-ajax.php?action=updraft_central_ajaxcallback from 45.61.188.238, 404, python-requests/2.34.2 - 13:24:23: GET /administrator/components/com_jce/ from 45.61.188.238, 404, python-requests/2.34.2 - 13:23:35: GET /?rest_route=/ from 45.61.188.238 on kimberlymackdesign.com, returned 200 with no exploit body show less	Web App Attack
🇳🇱 195.178.110.22	30 Oct 2026	Sustained WordPress wp-config filename-disclosure enumeration; known-hostile source (abuse 100, 3k+ ... show more Sustained WordPress wp-config filename-disclosure enumeration; known-hostile source (abuse 100, 3k+ reports). Target: HTTPS 443, a host vhost, WordPress wp-config* filename enumeration Seen: 2026-10-30 12:40 EDT - 2026-10-30 12:40:49 — GET /wp-config.htm HTTP/2.0 -> 404, UA Chrome 120 - 2026-10-30 12:40:48 — GET /wp-config.inc -> 404, same host, same enumeration (a host - 2026-10-30 12:40:44 — GET /wp-configsave.php -> 403 and GET /a host.php -> 403 (a host show less	Web App Attack Bad Web Bot
🇧🇪 34.22.222.15	30 Oct 2026	Single-flow HTTP probe of the public web service using python-requests, matching a high-abuse Google ... show more Single-flow HTTP probe of the public web service using python-requests, matching a high-abuse Google Cloud scanner (abuse 100). Target: HTTP 80, GET / probe to the public web service Seen: 2026-10-30 09:46 EDT - 09:46:40 HTTP probe GET / on public port 80 returned 444 (connection dropped) with user-agent python-requests/2.34.2 - 09:46:46 flagged the connection 34.22.222.15:41206 -> port 80 as a suspicious HTTP header flow show less	Port Scan Web App Attack
🇳🇱 45.148.10.240	30 Oct 2026	Single SSH probe to port 22 flagged by IDS as known-hostile host traffic; externally reported as an ... show more Single SSH probe to port 22 flagged by IDS as known-hostile host traffic; externally reported as an SSH brute-forcer (abuse 100). Target: SSH 22, TCP SYN probe from a known-hostile address Seen: 2026-10-30 09:48 EDT - 09:48:34 IDS signature ET COMPROMISED Known Compromised or Hostile Host Traffic fired on 45.148.10.240:43262 -> port 22 (TCP SYN) - 09:48:35 firewall dropped the TCP SYN from 45.148.10.240 -> port 22 show less	SSH Port Scan
🇮🇱 20.217.186.29	30 Oct 2026	Scanned the public WordPress blog a host with a batch of PHP path probes for shells and secret files ... show more Scanned the public WordPress blog a host with a batch of PHP path probes for shells and secret files, all denied (404/403). Target: HTTPS 443, PHP shell/exploit path probes (/wso.php, /class-t.api.php, /cv.php, /bolt.php, /php8.php, /elp.php, /cgi-bin/, /wp-admin/*) Seen: 2026-10-30 08:08-09:01 EDT - 2026-10-30 09:01:04 GET /wso.php returned HTTP 404 - 2026-10-30 09:01:02 GET /class-t.api.php returned HTTP 404 - 2026-10-30 09:00:56 GET /a7.php returned HTTP 404 - 2026-10-30 09:00:48 GET /php8.php returned HTTP 404 - 2026-10-30 08:09:09 GET /wp-admin/txets.php returned HTTP 403 - 2026-10-30 08:08:58 GET /wp-admin/admin-ajax.php returned HTTP 400 show less	Web App Attack
🇺🇸 143.246.215.127	30 Oct 2026	Flow engine flagged this address as a malicious fingerprint while probing our internet-facing servic ... show more Flow engine flagged this address as a malicious fingerprint while probing our internet-facing service on ports 80 and 443. Target: Port 80 and Port 443 (internet-facing web service) Seen: 2026-10-30 06:48 EDT - Flow engine flagged a Malicious Fingerprint (Critical severity) from 143.246.215.127:57284 to our internet-facing service on port 80 at 2026-10-30 06:48:15 - Flow engine flagged a Malicious Fingerprint (Critical severity) from 143.246.215.127:57284 to our internet-facing service on port 443 at 2026-10-30 06:48:14 - Two TCP SYN packets passed the edge firewall from 143.246.215.127 to ports 80 and 443 at 2026-10-30 06:48:08-09 show less	Port Scan
🇭🇰 34.92.162.185	30 Oct 2026	Flooded a basic-auth-protected vhost with ~30 one-second-apart requests probing secret/config files ... show more Flooded a basic-auth-protected vhost with ~30 one-second-apart requests probing secret/config files such as /.env, /.a host, /.env.dev, /.env_copy, /.env~ and /.git/config, each returning HTTP 401. Target: HTTPS 443, basic-auth brute force probing /.env* variants and /.git/config Seen: 2026-10-30 05:40 EDT - 05:40:26-05:40:32 — 28 sequential GET requests for /.env, /.a host, /.env.dev, /.env_prod, /.env_copy, /.env2, /.env~, /.env.swp, /.env.dist and /.env.uat, every one HTTP 401 - 05:40:24-05:41:23 — ~25 TCP SYN packets from the source to the internet-facing HTTPS endpoint at ~1/second spacing, consistent with an automated scanning tool show less	Web App Attack
🇺🇸 34.121.82.113	30 Oct 2026	Rotating spoofed AI-crawler User-Agents (MoonshotBot, Claude-User, GrokBot, DuckAssistBot, Kimi-Sear ... show more Rotating spoofed AI-crawler User-Agents (MoonshotBot, Claude-User, GrokBot, DuckAssistBot, Kimi-SearchBot) to probe for exposed secrets and version-control internals like /.env, /secrets.env, /.git/config and /.gitlab-ci.yml on two public vhosts; all requests denied (403/404). Target: HTTP 80/443 and kimberlymackdesignstudio.com probing /.env, /secrets.env, /.git/config, /.gitlab-ci.yml Seen: 2026-10-30 06:01 EDT - 06:01:03-06:01:04 — ~20 distinct requests to kimberlymackdesignstudio.com for /secrets.env, /src/.env, /config/.env.dev, /store/.env, /agent/.env, /.vscode/launch.json and /.gitconfig, returning 403/404 - 06:01:03-06:01:04 — a host requests for /.env.save, /gcp-credentials.json, /a host, /.git/config and /.gitlab-ci.yml, returning 403/404 - Same-second window — User-Agents rotated through MoonshotBot/1.0, Claude-User (Anthropic), GrokBot/1.0, DuckAssistBot/1.1 and Kimi-SearchBot/1.0, a multi-bot spoofing pattern used to evade User-Agent based blocks show less	Web App Attack