AbuseIPDB

JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

User Bete joined AbuseIPDB in January 2025 and has reported 721 IP addresses.

Standing (weight) is good.

INACTIVE USER

IP	Date	Comment	Categories
🇺🇸 156.242.125.25	10 Apr 2025	A reconnaissance scan targeting various possible directories for .env files (/auth/.env, /src/.env, ... show more A reconnaissance scan targeting various possible directories for .env files (/auth/.env, /src/.env, /private/.env, /shared/.env, /web/.env), which often contain environment variables, database credentials, API keys, and secrets. 156.242.125.25 - - [09/Apr/2025:19:23:47 +0000] "GET /master/.env HTTP/1.1" 404 196 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36" 156.242.125.25 - - [09/Apr/2025:19:23:47 +0000] "GET /src/.env HTTP/1.1" 404 196 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36" show less	Brute-Force Web App Attack
🇮🇩 103.195.30.139	10 Apr 2025	Automated reconnaissance activity from the IP 103.195.30.139. The user-agent mimics a mobile browser ... show more Automated reconnaissance activity from the IP 103.195.30.139. The user-agent mimics a mobile browser, but the behavior is very indicative of a scanner or bot looking for exposed development/debug files and misconfigurations. Here's what stands out: Targeted endpoints: phpinfo variations (php_info.php, php.php, /info.php, etc.) Symfony debug/profiler paths (/_profiler/phpinfo, /app_dev.php/_profiler/phpinfo) Config file paths (/.env.dev.local, /config/aws.yml) Other generic files (/temp.php, /linusadmin-phpinfo.php, /infos.php) show less	Brute-Force Web App Attack
🇺🇸 20.55.53.208	09 Apr 2025	20.55.53.208 - - [08/Apr/2025:14:04:46 +0000] "GET //cms/wp-includes/wlwmanifest.xml HTTP/1.1" 404 5 ... show more 20.55.53.208 - - [08/Apr/2025:14:04:46 +0000] "GET //cms/wp-includes/wlwmanifest.xml HTTP/1.1" 404 564 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0 Safari/537.36" 20.55.53.208 - - [08/Apr/2025:14:04:46 +0000] "GET //site/wp-includes/wlwmanifest.xml HTTP/1.1" 404 564 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0 Safari/537.36" These logs show classic scanning attempt, trying to detect the presence of a WordPress installation, especially older or misconfigured ones. show less	Web App Attack
🇩🇪 46.101.129.58	09 Apr 2025	46.101.129.58 - - [08/Apr/2025:17:33:08 +0300] "GET /HNAP1 HTTP/1.1" 404 682 "-" "Mozilla/5.0 (compa ... show more 46.101.129.58 - - [08/Apr/2025:17:33:08 +0300] "GET /HNAP1 HTTP/1.1" 404 682 "-" "Mozilla/5.0 (compatible; Odin; https://docs.getodin.com/)" An automated reconnaissance or scanning attempt show less	Web App Attack
🇸🇬 43.134.114.183	08 Apr 2025	43.134.114.183 - - [08/Apr/2025:03:57:17 +0000] "GET /api/actuator/env HTTP/1.1" 404 564 "-" "Mozill ... show more 43.134.114.183 - - [08/Apr/2025:03:57:17 +0000] "GET /api/actuator/env HTTP/1.1" 404 564 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1944.0 Safari/537.36" 43.134.114.183 - - [08/Apr/2025:03:57:16 +0000] "GET /actuator/;/env HTTP/1.1" 404 564 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1944.0 Safari/537.36" Attempts to access sensitive Spring Boot Actuator endpoints: /api/actuator/env and /actuator/;/env show less	Brute-Force Web App Attack
🇬🇧 35.177.47.120	08 Apr 2025	35.177.47.120 - - [07/Apr/2025:21:37:22 +0300] "GET /backup HTTP/1.1" 404 682 "www.google.com" "Mozi ... show more 35.177.47.120 - - [07/Apr/2025:21:37:22 +0300] "GET /backup HTTP/1.1" 404 682 "www.google.com" "Mozilla/5.0 (Linux; Android 7.0; SM-G892A Build/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Mobile Safari/537.36" /backup is commonly scanned in hopes of finding exposed configuration files, DB dumps, or zipped backups show less	Web App Attack
🇩🇪 104.248.21.236	08 Apr 2025	104.248.21.236 - - [08/Apr/2025:06:15:08 +0300] "POST /sdk HTTP/1.1" 404 682 "-" "Mozilla/5.0 (compa ... show more 104.248.21.236 - - [08/Apr/2025:06:15:08 +0300] "POST /sdk HTTP/1.1" 404 682 "-" "Mozilla/5.0 (compatible; Odin; https://docs.getodin.com/)" /sdk is probed by this attacker looking for vulnerable mobile SDK interfaces or misconfigured backends show less	Web App Attack
🇩🇪 165.232.126.165	08 Apr 2025	165.232.126.165 - - [08/Apr/2025:07:44:03 +0300] "GET /HNAP1 HTTP/1.1" 404 682 "-" "Mozilla/5.0 (com ... show more 165.232.126.165 - - [08/Apr/2025:07:44:03 +0300] "GET /HNAP1 HTTP/1.1" 404 682 "-" "Mozilla/5.0 (compatible; Odin; https://docs.getodin.com/)" This scan originates from an automated vulnerability scanner or botnet show less	Web App Attack
🇨🇳 111.41.147.227	07 Apr 2025	111.41.147.227 - - [06/Apr/2025:15:03:07 +0000] "GET /test.cgi HTTP/1.1" [Reducted] ; /bin/cat /etc/ ... show more 111.41.147.227 - - [06/Apr/2025:15:03:07 +0000] "GET /test.cgi HTTP/1.1" [Reducted] ; /bin/cat /etc/passwd" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.6.1 Safari/605.1.15" This is a Shellshock exploit payload targeting a CGI script (/test.cgi), the attacker is trying to read the contents of /etc/passwd show less	Brute-Force Web App Attack
🇸🇬 157.245.144.252	07 Apr 2025	157.245.144.252 - - [05/Apr/2025:06:31:16 +0000] "GET /.env.bak HTTP/1.1" 404 134 "-" "python-reques ... show more 157.245.144.252 - - [05/Apr/2025:06:31:16 +0000] "GET /.env.bak HTTP/1.1" 404 134 "-" "python-requests/2.32.3" The request from 157.245.144.252 attempting to access /.env.bak is a clear reconnaissance attempt targeting sensitive configuration files. show less	Web App Attack
🇸🇬 104.248.153.200	07 Apr 2025	104.248.153.200 - - [06/Apr/2025:00:11:54 +0000] "GET /.env.bak HTTP/1.1" 404 134 "-" "python-reques ... show more 104.248.153.200 - - [06/Apr/2025:00:11:54 +0000] "GET /.env.bak HTTP/1.1" 404 134 "-" "python-requests/2.32.3" The request from 104.248.153.200 attempting to access /.env.bak is a clear reconnaissance attempt targeting sensitive configuration files. show less	Web App Attack
🇪🇬 41.35.103.233	07 Apr 2025	41.35.103.233 - - [07/Apr/2025:07:59:21 +0300] "POST /xmlrpc.php HTTP/1.1" 405 568 "-" "Mozilla/5.0 ... show more 41.35.103.233 - - [07/Apr/2025:07:59:21 +0300] "POST /xmlrpc.php HTTP/1.1" 405 568 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36" This IP 41.35.103.233 request to /xmlrpc.php using the POST method is a common signature of WordPress-targeted probing, specifically for vulnerabilities related to xmlrpc.php show less	Web App Attack
🇺🇸 104.152.52.76	07 Apr 2025	104.152.52.76 - - [07/Apr/2025:05:10:41 +0300] "GET /evox/about HTTP/1.1" 404 682 "-" "Mozilla/5.0 ( ... show more 104.152.52.76 - - [07/Apr/2025:05:10:41 +0300] "GET /evox/about HTTP/1.1" 404 682 "-" "Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)" 104.152.52.76 - - [07/Apr/2025:05:10:41 +0300] "GET /HNAP1 HTTP/1.1" 404 682 "-" "Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)" 104.152.52.76 - - [07/Apr/2025:05:10:40 +0300] "GET /evox/about HTTP/1.1" 404 682 "-" "Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)" This IP address 104.152.52.76 is performing reconnaissance using the Nmap Scripting Engine show less	Brute-Force Web App Attack
🇩🇪 209.38.250.32	04 Apr 2025	209.38.250.32 - - [04/Apr/2025:06:35:08 +0300] "GET /HNAP1 HTTP/1.1" 404 682 "-" "Mozilla/5.0 (compa ... show more 209.38.250.32 - - [04/Apr/2025:06:35:08 +0300] "GET /HNAP1 HTTP/1.1" 404 682 "-" "Mozilla/5.0 (compatible; Odin; https://docs.getodin.com/)" This IP address 209.38.250.32 made an attempt to access the /HNAP1 endpoints on the web server, which is commonly targeted during scans for vulnerable network devices show less	Web App Attack
🇺🇸 104.152.52.80	04 Apr 2025	104.152.52.80 - - [04/Apr/2025:05:55:11 +0300] "GET /HNAP1 HTTP/1.1" 404 682 "-" "Mozilla/5.0 (compa ... show more 104.152.52.80 - - [04/Apr/2025:05:55:11 +0300] "GET /HNAP1 HTTP/1.1" 404 682 "-" "Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)" 104.152.52.80 - - [04/Apr/2025:05:55:10 +0300] "GET /evox/about HTTP/1.1" 404 682 "-" "Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)" This IP address 104.152.52.80 was observed conducting reconnaissance activity against the web server, attempting to access endpoints such as /HNAP1 and /evox/about using the Nmap Scripting Engine show less	Brute-Force Web App Attack
🇳🇱 149.210.179.100	03 Apr 2025	149.210.179.100 - - [03/Apr/2025:02:02:37 +0000] "GET /app/vendor/phpunit/phpunit/src/Util/PHP/eval- ... show more 149.210.179.100 - - [03/Apr/2025:02:02:37 +0000] "GET /app/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 404 162 "-" "Custom-AsyncHttpClient" 149.210.179.100 - - [03/Apr/2025:02:02:33 +0000] "GET /apps/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 404 162 "-" "Custom-AsyncHttpClient" 149.210.179.100 - - [03/Apr/2025:02:02:30 +0000] "GET /public/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 404 162 "-" "Custom-AsyncHttpClient" This IP 149.210.179.100 attempted to access PHPUnit eval-stdin.php files across multiple directories (/app/vendor/, /apps/vendor/, /public/vendor/) show less	Web App Attack
🇺🇸 161.35.235.208	03 Apr 2025	161.35.235.208 - - [02/Apr/2025:16:32:26 +0000] "GET /admin/php/?file=memeklo.hitam HTTP/1.1" 404 12 ... show more 161.35.235.208 - - [02/Apr/2025:16:32:26 +0000] "GET /admin/php/?file=memeklo.hitam HTTP/1.1" 404 12112 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.78 Safari/537.36" 161.35.235.208 - - [02/Apr/2025:16:32:26 +0000] "GET /public/multiuploader/server/php/?file=memeklo.hitam HTTP/1.1" 404 12130 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.78 Safari/537.36" This IP 161.35.235.208 attempted to access potentially vulnerable PHP file upload directories (/admin/php/ and /public/multiuploader/server/php/) with a specific filename "memeklo.hitam" show less	Web App Attack
🇸🇬 52.77.244.71	03 Apr 2025	52.77.244.71 - - [02/Apr/2025:18:23:46 +0000] "GET //web/.env HTTP/1.1" 404 119 "https://www.google. ... show more 52.77.244.71 - - [02/Apr/2025:18:23:46 +0000] "GET //web/.env HTTP/1.1" 404 119 "https://www.google.com/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_1_5) Gecko/20031701 Firefox/13.0" 52.77.244.71 - - [02/Apr/2025:18:23:46 +0000] "GET //admin/.env HTTP/1.1" 404 121 "https://www.google.com/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_1_5) Gecko/20031701 Firefox/13.0" This IP 52.77.244.71 attempted to access .env files in directories such as /web/ and /admin/. These files typically contain sensitive configuration details. show less	Web App Attack
🇩🇪 103.161.34.89	02 Apr 2025	103.161.34.89 - - [01/Apr/2025:17:43:36 +0300] "GET /%2e%2e/%2e%2e/etc/passwd HTTP/1.1" 400 166 "-" ... show more 103.161.34.89 - - [01/Apr/2025:17:43:36 +0300] "GET /%2e%2e/%2e%2e/etc/passwd HTTP/1.1" 400 166 "-" "-" 103.161.34.89 - - [01/Apr/2025:17:43:35 +0300] "GET /cgi-bin/account_mgr.cgi?cmd=cgi_user_add&name=%27;id;%27 HTTP/1.1" 404 682 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.120 Safari/537.36" This IP address was observed engaging in malicious web-based activity, as evidenced by access logs. The behavior included repeated attempts to exploit vulnerabilities, like unauthorized access attempts to sensitive endpoints, and SQL injection attempt. show less	SQL Injection Web App Attack
🇺🇸 104.152.52.45	02 Apr 2025	104.152.52.45 - - [01/Apr/2025:15:53:53 +0300] "GET /evox/about HTTP/1.1" 404 682 "-" "Mozilla/5.0 ( ... show more 104.152.52.45 - - [01/Apr/2025:15:53:53 +0300] "GET /evox/about HTTP/1.1" 404 682 "-" "Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)" 104.152.52.45 - - [01/Apr/2025:15:53:53 +0300] "GET /HNAP1 HTTP/1.1" 404 682 "-" "Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)" 104.152.52.45 - - [01/Apr/2025:15:53:53 +0300] "POST /sdk HTTP/1.1" 404 682 "-" "Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)" show less	Brute-Force Web App Attack
🇷🇺 185.147.125.36	01 Apr 2025	A brute-force attack was attempted from IP 185.147.125.36 using NTLM authentication. This attacker t ... show more A brute-force attack was attempted from IP 185.147.125.36 using NTLM authentication. This attacker tried logging into [REDACTED] server several times with an invalid username, triggering multiple failed logins show less	Brute-Force
🇺🇸 104.152.52.52	01 Apr 2025	104.152.52.52 - - [31/Mar/2025:22:42:27 +0000] "POST /sdk HTTP/1.1" 404 162 "-" "Mozilla/5.0 (compat ... show more 104.152.52.52 - - [31/Mar/2025:22:42:27 +0000] "POST /sdk HTTP/1.1" 404 162 "-" "Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)" This IP 104.152.52.52 attempted a POST request using the Nmap Scripting Engine, which is used for reconnaissance and vulnerability scanning show less	Web App Attack
🇨🇦 67.205.116.233	01 Apr 2025	67.205.116.233 - - [01/Apr/2025:02:28:13 +0000] "GET /test.cgi HTTP/1.1" 302 0 "() { ignored; }; ech ... show more 67.205.116.233 - - [01/Apr/2025:02:28:13 +0000] "GET /test.cgi HTTP/1.1" 302 0 "() { ignored; }; echo Content-Type: text/html; echo ; /bin/cat /etc/passwd" "Mozilla/5.0 (X11; Linux i686; rv:126.0) Gecko/20100101 Firefox/126.0" This IP attempted to exploit a vulnerability in the Bash shell (CVE-2014-6271) show less	Hacking Brute-Force Web App Attack
🇩🇪 85.215.138.170	31 Mar 2025	85.215.138.170 - - [30/Mar/2025:14:54:37 +0000] "GET /test/wp-includes/wlwmanifest.xml HTTP/1.1" 404 ... show more 85.215.138.170 - - [30/Mar/2025:14:54:37 +0000] "GET /test/wp-includes/wlwmanifest.xml HTTP/1.1" 404 564 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36" 85.215.138.170 - - [30/Mar/2025:14:54:37 +0000] "GET /wp1/wp-includes/wlwmanifest.xml HTTP/1.1" 404 564 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36" This IP 85.215.138.170 has been making multiple attempts to access "wlwmanifest.xml" files across various WordPress-related directories, such as /test/, /shop/, and /2019/. This behavior suggests an automated scan for vulnerable or outdated WordPress installations, likely targeting sites for exploitation show less	Brute-Force Web App Attack
🇺🇸 54.177.128.99	31 Mar 2025	54.177.128.99 - - [30/Mar/2025:10:46:02 +0000] "GET //web/.env HTTP/1.1" 404 119 "https://www.google ... show more 54.177.128.99 - - [30/Mar/2025:10:46:02 +0000] "GET //web/.env HTTP/1.1" 404 119 "https://www.google.com/" "Mozilla/5.0 (Windows; U; MSIE 7.0b; Macintosh; .NET CLR 2.1.12482; Intel Mac OS X 11_2_0)" 54.177.128.99 - - [30/Mar/2025:10:46:01 +0000] "GET //admin/.env HTTP/1.1" 404 121 "https://www.google.com/" "Mozilla/5.0 (Windows; U; MSIE 7.0b; Macintosh; .NET CLR 2.1.12482; Intel Mac OS X 11_2_0)" This IP 54.177.128.99 has been attempting to access .env files in various directories, including /web/, /admin/, /site/, and others. This suggests an automated scan for environment configuration files that may contain sensitive credentials, API keys, or database connection details. show less	Brute-Force Web App Attack