AbuseIPDB

JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

User grassyloki joined AbuseIPDB in May 2024 and has reported 1,953 IP addresses.

Standing (weight) is good.

ACTIVE USER

IP	Date	Comment	Categories
🇩🇴 186.6.94.184	29 Oct 2026	Attack traffic from this IP. Target: Paths /invoker/JMXInvokerServlet and /jmx-console/HtmlAdaptor ( ... show more Attack traffic from this IP. Target: Paths /invoker/JMXInvokerServlet and /jmx-console/HtmlAdaptor (.jboss system) Seen: 2026-10-29 03:58-03:59 EDT - 03:58:32 IDS [1:2011696:6] 'Possible JBoss JMX Console Beanshell Deployer WAR Upload and Deployment Exploit Attempt' - 186.6.94.184:63894 -> port 80 - 03:58:32 IDS [1:2014017:4] 'ET WEB_SERVER JBoss jmx-console Probe' - 186.6.94.184 -> port 80 show less	Web App Attack
🇸🇬 161.118.209.40	29 Oct 2026	Known WordPress scanner/brute-forcer hitting a WordPress site with admin, plugin-exploit, and login ... show more Known WordPress scanner/brute-forcer hitting a WordPress site with admin, plugin-exploit, and login probes; all requests rejected (403/400). Target: HTTP WordPress app — /wp-admin/admin-ajax.php wdpsso_step1 exploit, /wp-json, /wp-login.php Seen: 2026-10-29 02:13 EDT - 02:13:21 GET /wp-admin/admin-ajax.php?action=wdpsso_step1&redirect= 400 from 161.118.209.40 - 02:13:20 POST /wp-json/batch/v1 207 from 161.118.209.40 - 02:13:23 POST /wp-admin/admin-ajax.php?meta-box-loader=1 403 from 161.118.209.40 show less	Web App Attack Brute-Force
🇳🇱 195.178.110.155	29 Oct 2026	Web-application scanner hammering a WordPress site with rapid admin/login-page probes. Target: HTTP/ ... show more Web-application scanner hammering a WordPress site with rapid admin/login-page probes. Target: HTTP/HTTPS web app login and admin pages Seen: 2026-10-29 02:26-02:27 EDT - 02:26:53 GET /wp-login.php HTTP/2.0 403 from 195.178.110.155 - 02:26:57 GET /register HTTP/2.0 404 from 195.178.110.155 - 02:26:58 GET /forgot-password HTTP/2.0 404 from 195.178.110.155 - 02:26:59 GET /a host/register HTTP/2.0 404 from 195.178.110.155, triggering IDS alert 'Sustained web attack from known-hostile source' - Rush of ~15 requests between 02:26:53 and 02:26:59 including /login, /admin/login, /login/livewire/update, /register/livewire/update show less	Web App Attack Bad Web Bot
🇩🇪 85.155.15.20	29 Oct 2026	Scanner probed our web host for leaked secrets across ~40 sensitive-file paths (.env, .git/config, . ... show more Scanner probed our web host for leaked secrets across ~40 sensitive-file paths (.env, .git/config, .aws/config, .npmrc, .netrc, .kube/config) in a single-second burst; all responses were blocked (403/404). Target: Host kimberlymackdesignstudio.com), path sweep including /.env, /.git/config, /.aws/config, /.npmrc, /.netrc, /.kube/config Seen: 2026-10-28 23:01-23:02 EDT - 2026-10-28 23:02:11 - GET /.env, /.git/config, /.aws/config, /.npmrc, /.netrc, /.env.production, /.docker/config.json returned 403 - 2026-10-28 23:02:11 - ~40 sensitive-file paths (.env.* variants, .kube/config, .pypirc, %2eenv, %2f%2eaws%2fcredentials) requested within one second, all 403 or 404 - 2026-10-28 23:01:49 - preceding GET /previous-work.html (200) then immediate file-probe sweep, consistent recon pattern show less	Web App Attack
🇫🇷 141.94.245.246	28 Oct 2026	HIT the site's WordPress vhosts with a wlwmanifest.xml recon sweep across many path variants plus an ... show more HIT the site's WordPress vhosts with a wlwmanifest.xml recon sweep across many path variants plus an xmlrpc.php?rsd check, all returning 404. Target: HTTP/HTTPS, GET //wp-includes/wlwmanifest.xml (site, cms, wp1, wp2, media, shop, blog, wordpress, news, 2018, 2019 variants) and //xmlrpc.php?rsd Seen: 2026-10-28 03:17 EDT - 03:17:24-03:17:27 - 24 requests for //wp-includes/wlwmanifest.xml across variants (//site, //cms, //wp1, //wp2, //media, //shop, //blog, //wordpress, //news, //2018, //2019), each HTTP 404, user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/78.0.3904.108 - 03:17:25 - GET //xmlrpc.php?rsd returned HTTP 404 show less	Web App Attack
🇨🇱 190.20.127.133	28 Oct 2026	Brute-forced WordPress /wp-login.php (POST and GET, blocked 403 at the edge) and enumerated users vi ... show more Brute-forced WordPress /wp-login.php (POST and GET, blocked 403 at the edge) and enumerated users via /wp-json/wp/v2/users/me (unauthenticated, 401). Target: HTTPS 443, POST and GET /wp-login.php and GET /wp-json/wp/v2/users/me Seen: 2026-10-28 03:08 EDT - 03:08:14-03:08:16 - POST /wp-login.php and GET /wp-login.php each returned HTTP 403 (3 attempts each), user-agent Mozilla/5.0 (X11; Linux x86_64; rv:148.0) Firefox/148.0 - 03:08:12-03:08:17 - GET /wp-json/wp/v2/users/me returned HTTP 401 (3 attempts, un authenticated) show less	Web App Attack
🇳🇱 45.148.10.15	28 Oct 2026	Sustained WordPress/Next.js path-recon sweep of 190+ distinct paths across HTTP/HTTPS; requests at t ... show more Sustained WordPress/Next.js path-recon sweep of 190+ distinct paths across HTTP/HTTPS; requests at the edge returned mostly 404. Target: HTTPS 443 and HTTP 80; paths /wp/ /wp-json/ /cms/ /blog/ /news/ /site/ /wordpress/ /press/ with ?rest_route=/ and wp-login.php Seen: 2026-10-28 00:06 EDT - 2026-10-28 00:06:43 attacker sent HTTP/1.1 GET /cms/ — returned 404 - 2026-10-28 00:06:48 attacker sent HTTP/1.1 GET /wp/ — returned 404 - 2026-10-28 00:06:47 attacker sent HTTP/1.1 GET /login — returned 200 - 2026-10-28 00:06:50 attacker sent HTTP/1.1 GET /press/?rest_route=/ — returned 404 show less	Web App Attack Port Scan
🇷🇴 193.32.162.73	28 Oct 2026	GET /.git/HEAD returned 403 at the edge. Target: GET /.git/HEAD Seen: 2026-10-28 00:33 EDT - 2026-10 ... show more GET /.git/HEAD returned 403 at the edge. Target: GET /.git/HEAD Seen: 2026-10-28 00:33 EDT - 2026-10-28 00:33:56 attacker sent HTTP/2.0 GET /.git/HEAD — returned 403 - 2026-10-28 00:33:56 attacker request User-Agent 'Mozilla/5.0 (Windows NT 6.3; Win64; x64) Chrome/83.0.4103.106' — aged browser string typical of automated secret-file sweeps show less	Web App Attack
🇺🇸 34.31.120.130	28 Oct 2026	403/404 at the edge. Target: HTTPS/HTTP 443/80 vhost, /.env /.git / .aws/credentials and CI dotfiles ... show more 403/404 at the edge. Target: HTTPS/HTTP 443/80 vhost, /.env /.git / .aws/credentials and CI dotfiles Seen: 2026-10-27 23:48-23:49 EDT - 2026-10-27 23:48:58 GET /.env HTTP/2.0 -> 403, /.env.production -> 403 (env-file sweep) - 2026-10-27 23:48:58 GET /.git/config -> 403, /.git-credentials -> 403, /.aws/credentials -> 403 (git/AWS credential sweep) - 2026-10-27 23:49:00 GET /.travis.yml -> 403, /.npmrc -> 403, /.netrc -> 403, /docker-compose.yml -> 404 show less	Web App Attack Bad Web Bot
🇳🇱 34.91.90.121	28 Oct 2026	403s at the edge. Target: HTTPS/HTTP 443/80 vhost, JS build chunks and vite.config.js Seen: 2026-10- ... show more 403s at the edge. Target: HTTPS/HTTP 443/80 vhost, JS build chunks and vite.config.js Seen: 2026-10-27 23:50 EDT - 2026-10-27 23:50:11 GET /main.js.map HTTP/1.1 -> 403 (Next.js source-map enumeration) - 2026-10-27 23:50 GET /_next/static/chunks/framework.js -> 403, /_next/static/chunks/pages/_app.js -> 403, /_next/static/chunks/webpack.js -> 403 - 2026-10-27 23:50 GET /vite.config.js -> 403, /static/js/main.js -> 403 (build/config-file sweep) show less	Web App Attack Bad Web Bot
🇳🇱 195.178.110.135	28 Oct 2026	Repeated probes of a WordPress/Next.js vhost including backend-reachable requests; flagged as C2 inf ... show more Repeated probes of a WordPress/Next.js vhost including backend-reachable requests; flagged as C2 infrastructure by IDS. Target: WordPress/Next.js vhost, GET /_next/static/ and / with benign Mozilla UA Seen: 2026-10-27 23:26 EDT - 2026-10-27 23:26:43 GET /_next/static/ HTTP/2.0 -> 404 (request reached the app backend, not blocked at edge) - 2026-10-27 23:26:44 GET / HTTP/2.0 -> 200 (backend returned 200) - 2026-10-27 22:52:30 HEAD / HTTP/2.0 -> 200 (earlier recon probe) show less	Web App Attack Bad Web Bot Hacking
🇺🇸 52.242.132.37	28 Oct 2026	Microsoft Azure path sweep against WordPress (wp-mail.php, wp-includes/test.php, file2.php); all 404 ... show more Microsoft Azure path sweep against WordPress (wp-mail.php, wp-includes/test.php, file2.php); all 404. Target: WordPress HTTP 443 path sweep: /wp-content/wp-mail.php, /wp-includes/test.php, /file2.php Seen: 2026-10-27 22:33 EDT - 2026-10-27 22:33:04: GET /wp-content/wp-mail.php from 52.242.132.37 returned 404 - 2026-10-27 22:33:03: GET /wp-includes/test.php from 52.242.132.37 returned 404 - 2026-10-27 22:33:04: GET /file2.php from 52.242.132.37 returned 404 show less	Web App Attack
🇦🇷 190.30.51.9	28 Oct 2026	WordPress brute-force from Telecom Argentina: repeated POST /wp-login.php attempts plus /wp-json/wp/ ... show more WordPress brute-force from Telecom Argentina: repeated POST /wp-login.php attempts plus /wp-json/wp/v2/users/me enumeration; all requests 403/401. Target: WordPress HTTP 443: /wp-login.php login attempts and /wp-json/wp/v2/users/me enumeration Seen: 2026-10-27 23:00 EDT - 2026-10-27 23:00:10-13: repeated POST /wp-login.php from 190.30.51.9, each returning 403 - 2026-10-27 23:00:11-14: GET /wp-json/wp/v2/users/me enumeration from 190.30.51.9, each returning 401 - 2026-10-27 23:00:15-16: GET /wp-login.php probe from 190.30.51.9 returning 403 show less	Brute-Force Web App Attack
🇨🇦 201.79.57.37	28 Oct 2026	DigitalOcean Toronto WordPress REST abuse: wp2shell RCE pattern (CVE-2026-63030/CVE-2026-60137) and ... show more DigitalOcean Toronto WordPress REST abuse: wp2shell RCE pattern (CVE-2026-63030/CVE-2026-60137) and SQLi payloads via /wp-json/batch/v1 and ?rest_route=/batch/v1; all 301/403. Target: WordPress REST /wp-json/batch/v1 and ?rest_route=/batch/v1; matched wp2shell RCE (CVE-2026-63030/CVE-2026-60137) and SQLi Seen: 2026-10-27 23:00 EDT - 2026-10-27 23:00:07: IDS [1:2071233:1] 'WordPress Core wp2shell RCE (CVE-2026-63030 & CVE-2026-60137)' matched a request from 201.79.57.37:55745 to HTTP 80 - 2026-10-27 23:00:07: IDS SQLi signatures [1:2053468:1] UNION SELECT and [1:2053465:1] SELECT CONCAT matched from 201.79.57.37:55745 - 2026-10-27 23:00:07-08: POST /wp-json/batch/v1 and GET/POST ?rest_route=/batch/v1 from 201.79.57.37, returning 301/403 show less	Web App Attack SQL Injection
🇧🇩 103.149.61.75	28 Oct 2026	Brute-forced WordPress a host: 3 POST /wp-login.php attempts + 3 GET /wp-json/wp/v2/users/me enumera ... show more Brute-forced WordPress a host: 3 POST /wp-login.php attempts + 3 GET /wp-json/wp/v2/users/me enumeration attempts in ~7s; all terminated at edge (403/401), never reached backend. Target: WordPress wp-login.php (POST brute force) and /wp-json/wp/v2/users/me (GET user enumeration) Seen: 2026-10-27 21:47 EDT - 21:47:34-21:47:40 POST /wp-login.php → 403 from 103.149.61.75, Chrome/151 UA - 21:47:36-21:47:41 GET /wp-json/wp/v2/users/me → 401 from 103.149.61.75, user enumeration attempt show less	Brute-Force SSH
🇭🇰 20.205.120.210	28 Oct 2026	WordPress/PHP path sweep from a Microsoft Azure IP probing admin.php, wp-includes and common web fil ... show more WordPress/PHP path sweep from a Microsoft Azure IP probing admin.php, wp-includes and common web files. Target: WordPress/PHP path enumeration: /wp-content/admin.php, /sf.php, /wp-includes/, /wp-admin/user/index.php Seen: 2026-10-27 20:10 EDT - 2026-10-27 20:10:32 - GET /wp-content/admin.php -> 404 vhost - 2026-10-27 20:10:28 - GET /sf.php -> 404 vhost - 2026-10-27 20:10:24 - GET /wp-admin/user/index.php -> 404 and GET /404.php -> 404 vhost show less	Web App Attack Port Scan
🇺🇸 35.81.39.40	28 Oct 2026	Attack traffic from this IP. Target: Port 443 HTTPS - obsolete TLS / remote-to-local insecure flow p ... show more Attack traffic from this IP. Target: Port 443 HTTPS - obsolete TLS / remote-to-local insecure flow probing Seen: 2026-10-27 20:20 EDT - 2026-10-27 20:20:32 - Remote to Local Insecure Flow: 35.81.39.40:46520 -> port 443 - 2026-10-27 20:20:32 - Obsolete TLS Version: 35.81.39.40:13846 -> port 443 show less	Port Scan Web App Attack
🇦🇷 45.239.34.97	28 Oct 2026	SSH/22 port scan of the public edge with the classic multi-port enumeration signature. Target: SSH 2 ... show more SSH/22 port scan of the public edge with the classic multi-port enumeration signature. Target: SSH 22 port scan Seen: 2026-10-27 20:36 EDT - 2026-10-27 20:36:07 - SSH scan detected (IDS: ET SCAN Potential SSH Scan, Priority 2) from 45.239.34.97:43044 to edge port 22 - 2026-10-27 20:36 - TCP SYN scan pattern from 45.239.34.97 targeting edge service 22 show less	SSH Port Scan
🇨🇦 154.80.128.148	28 Oct 2026	Attack traffic from this IP. Target: Port 80 HTTP edge - malicious-fingerprint probing with empty Us ... show more Attack traffic from this IP. Target: Port 80 HTTP edge - malicious-fingerprint probing with empty User-Agent Seen: 2026-10-27 20:09 EDT - 2026-10-27 20:09:15 - : Malicious Fingerprint flow 154.80.128.148:39551 -> port 80 - 2026-10-27 20:09:15 - Empty/missing User-Agent request to edge port 80 show less	Port Scan Web App Attack
🇺🇸 134.33.96.189	28 Oct 2026	Attack traffic from this IP. Target: HTTP 80/443 edge web service - Zmap User-Agent scan, suspicious ... show more Attack traffic from this IP. Target: HTTP 80/443 edge web service - Zmap User-Agent scan, suspicious-header probing Seen: 2026-10-27 20:46 EDT - 2026-10-27 20:46:42 - GET requests with "Zmap" User-Agent hitting edge web port 80 (IDS: ET SCAN Zmap User-Agent Inbound) - 2026-10-27 20:46:38 - HTTP request with suspicious/invalid header from 134.33.96.189 to edge port 80 - 2026-10-27 20:45:41 - Empty/missing User-Agent request from 134.33.96.189 port 80 show less	Port Scan Web App Attack
🇭🇰 20.24.222.184	28 Oct 2026	Azure scanner enumerating WordPress and secret config files (classmap, conf, 404.php, ultra.php); al ... show more Azure scanner enumerating WordPress and secret config files (classmap, conf, 404.php, ultra.php); all returned 403/404. Target: HTTP 443, WordPress and config-file enumeration (/autoload_classmap.php, /wp-conf.php, /ultra.php, /ioxi-o.php) Seen: 2026-10-27 19:49 EDT - 2026-10-27 19:49:21 GET /wp-admin/network/index.php -> 403 - 2026-10-27 19:49:27 GET /network.php -> 404 - 2026-10-27 19:49:30 GET /autoload_classmap.php -> 404 - 2026-10-27 19:49:22 GET /ultra.php -> 404 show less	Web App Attack Bad Web Bot Brute-Force
🇦🇺 20.211.122.120	28 Oct 2026	Azure scanner sweeping WordPress for hidden paths and secret PHP files (/wp-content/uploads/admin.ph ... show more Azure scanner sweeping WordPress for hidden paths and secret PHP files (/wp-content/uploads/admin.php, /wp-admin/network/, /goods.php, *.php); all returned 403/404. Target: HTTP 443, WordPress path/secret-file sweep (admin.php, wp-admin/network/, wp-includes) Seen: 2026-10-27 19:47 EDT - 2026-10-27 19:47:37 GET /wp-content/uploads/admin.php -> 403 - 2026-10-27 19:47:39 GET /wp-admin/network/index.php -> 403 - 2026-10-27 19:47:41 GET /wp-includes/ID3/index.php -> 404 - 2026-10-27 19:47:29 GET /goods.php -> 404 show less	Web App Attack Bad Web Bot Hacking
🇳🇱 101.99.75.183	28 Oct 2026	Swept for exposed config/secret files and PHP backdoors (/db.php, /wp-plain.php, /alphacgiapi/perl.a ... show more Swept for exposed config/secret files and PHP backdoors (/db.php, /wp-plain.php, /alphacgiapi/perl.alfa, *.php.suspected) on a WordPress site; all returned 404/403. Target: HTTP 443, WordPress secret-file and PHP-backdoor path sweep Seen: 2026-10-27 19:38 EDT - 2026-10-27 19:38:40 GET /wp-content/themes/seotheme/db.php?u -> 404 - 2026-10-27 19:38:40 GET /qpkrxjfz.php?Fox=d3wL7 -> 404 - 2026-10-27 19:38:40 POST /wp-plain.php -> 404 - 2026-10-27 19:38:42 POST /ALFA_DATA/alfacgiapi/perl.alfa -> 403 - 2026-10-27 19:38:44 GET /plugins/content/apismtp/apismtp.php.suspected?test=hello -> 403 show less	Web App Attack Bad Web Bot Hacking
🇵🇰 144.48.135.65	28 Oct 2026	Probed router admin login /boaform/admin/formLogin with default admin/admin credentials, empty User- ... show more Probed router admin login /boaform/admin/formLogin with default admin/admin credentials, empty User-Agent; request dropped (444). Target: HTTP 80, TP-Link style router admin login /boaform/admin/formLogin (admin/admin) Seen: 2026-10-27 19:59 EDT - 2026-10-27 19:59:59 GET /boaform/admin/formLogin?username=admin&psd=admin -> 444 - 2026-10-27 19:59:59 Same probe sent an empty User-Agent ("-") - non-browser scanner show less	Port Scan Brute-Force IoT Targeted
🇦🇷 200.123.52.65	28 Oct 2026	Attempted WordPress wp-login.php credential brute-force with REST API user-enumeration via /wp-json/ ... show more Attempted WordPress wp-login.php credential brute-force with REST API user-enumeration via /wp-json/wp/v2/users/me; all requests rejected (403/401). Target: HTTPS, WordPress /wp-login.php login attempts and /wp-json/wp/v2/users/me user enumeration Seen: 2026-10-27 19:22 EDT - 2026-10-27 19:22:32 POST /wp-login.php HTTP/2.0 -> 403 (548 bytes) - 2026-10-27 19:22:33-19:22:38 GET + POST /wp-login.php x4 -> 403 - 2026-10-27 19:22:33-19:22:38 GET /wp-json/wp/v2/users/me x3 -> 401 show less	Brute-Force Web App Attack