This IP (93.123.109.229) is conducting an automated scan using l9explore/1.2.2 (a known security scanning tool) to hunt for: .env files (containing credentials, API keys, database passwords) and .git/config (exposed Git repositories can leak source code & secrets) show less
134.209.58.98 - - [17/May/2025:21:08:35 +0300] "GET /%67%61%74%65%77%61%79/%61%63%74%75%61%74%6f%72/ ... show more134.209.58.98 - - [17/May/2025:21:08:35 +0300] "GET /%67%61%74%65%77%61%79/%61%63%74%75%61%74%6f%72/%65%6e%76 HTTP/1.1" 404 682 "-" "Mozilla/5.0 (ZZ; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36"
This IP (134.209.58.98) is conducting an aggressive automated attack targeting sensitive .env files using URL encoding, path traversal, and obfuscation techniques. All requests returned 404 (good), but this is a high-risk reconnaissance attempt for credential theft. show less
This IP (138.68.245.6) is conducting an automated attack attempting to access sensitive .env files (containing credentials, API keys, and configurations) using URL-encoded paths and path traversal tricks. show less
An automated attack from IP 38.22.104.231 attempting to steal sensitive .env** files (which often contain database credentials, API keys, and other secrets) from multiple common web directories (/app/, /laravel/, /public/, /admin/`, etc.) show less
An automated scanning activity from IP 45.121.218.43, where an attacker probed for phpMyAdmin and other database admin interfaces (/phpmyadmin/, /mysql/admin/, etc.) within seconds, using a spoofed Chrome user agent show less
A targeted phpMyAdmin reconnaissance attack from IP 89.116.220.31, where the attacker systematically scanned for database administration interfaces across multiple paths within 5 seconds show less
WordPress reconnaissance attack from IP 159.223.57.202, where the attacker systematically probed for WordPress installations across multiple directories within 2 seconds. The scan targeted a WordPress fingerprinting: checked for wlwmanifest.xml (Windows Live Writer manifest file), and tested 10 different directory paths (/shop/, /wp1/, /2019/, etc.) show less
systematic phpMyAdmin reconnaissance attack from IP 80.82.156.184, where the attacker scanned for database administration interfaces across multiple paths within 2 seconds. Targeted Scanning: 11 different phpMyAdmin paths checked, Version-specific probes (/phpMyAdmin-5.2.1/, /phpMyAdmin-latest/), and the common alternative names (/MyAdmin/, /phppma/,...) show less
A targeted Telerik UI vulnerability scan from IP 185.254.195.5, where the attacker systematically probed for the vulnerable Telerik.Web.UI.DialogHandler.aspx component across multiple paths within 2 seconds show less
A systematic credential harvesting attack from IP 54.91.200.16, where the attacker scanned for sensitive configuration files across multiple directories. show less
A directory traversal attack from IP 66.228.53.37, where the attacker tried to exploit a path vulnerability to access the system's /etc/passwd file. show less
This IP (159.89.197.238) conducted a systematic WordPress scan within 4 seconds, checking for: wlwmanifest.xml in 9 directories (testing /test/, /shop/, /wordpress/, etc.), license.txt in ID3 module and xmlrpc.php endpoint. show less
A targeted phpMyAdmin reconnaissance scan from IP 85.26.186.179, where the attacker systematically checked for database administration interfaces across multiple paths within 11 seconds. show less
A systematic phpMyAdmin reconnaissance attack from IP 36.92.88.90, where the attacker scanned for database management interfaces across multiple paths within 5 seconds. show less
A targeted phpMyAdmin reconnaissance scan from IP 109.121.136.24, where the attacker systematically checked for 11 different phpMyAdmin installation paths within 3 seconds. show less
A distinct web application attacks from IP 13.231.153.70, demonstrating multiple exploitation attempts like XSS Injection, SQL Time-Based Blind Injection, and more show less
A WordPress reconnaissance attack from IP 157.245.109.127, where the attacker systematically probed for WordPress installations across multiple directories (/test/, /shop/, /wordpress/,..) within 2 seconds show less
An automated backup file discovery scan from IP 122.51.242.63, where the attacker used Python's Requests library to systematically check for sensitive archive files (.tar.gz) via lightweight HEAD requests. show less
A WordPress reconnaissance attack from IP 159.89.197.238, where the attacker systematically probed for WordPress installations across dozens of different directories (/test/, /shop/, /wordpress/,...) within 4 seconds show less
A targeted Telerik UI exploit scan from IP 91.107.166.37, where the attacker systematically checked for dozens of different paths to Telerik.Web.UI.DialogHandler.aspx within 2 seconds - a known vulnerable component that could allow remote code execution (CVE-2017-11317, CVE-2017-11357) if unpatched show less
159.253.120.209 - - [08/May/2025:04:01:47 +0000] "GET /phpmyadmin/scripts/setup.php HTTP/1.1" 404 16 ... show more159.253.120.209 - - [08/May/2025:04:01:47 +0000] "GET /phpmyadmin/scripts/setup.php HTTP/1.1" 404 162 "-" "Mozilla/4.0 (compatible; MSIE 6.0; MSIE 5.5; Windows NT 5.1) Opera 7.01 [en]"
A targeted attack attempt from IP 159.253.120.209, where the attacker specifically probed for a known phpMyAdmin vulnerability (CVE-2018-12613) by attempting to access /phpmyadmin/scripts/setup.php - a file that could allow remote code execution in vulnerable phpMyAdmin versions. show less
A brute-force attack was attempted from IP 88.214.50.14 using NTLM authentication. This attacker tri ... show moreA brute-force attack was attempted from IP 88.214.50.14 using NTLM authentication. This attacker tried logging into [REDACTED] server dozens of times with an invalid username, triggering multiple failed logins show less
Brute-Force
By clicking “Accept all”, you agree to the storing of cookies on your device to remember preferences and
analyze site usage.
Read more
- Required to log into your AbuseIPDB account, and store these cookie preferences.
84.31.137.84