AbuseIPDB

JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

User S S joined AbuseIPDB in March 2025 and has reported 234 IP addresses.

Standing (weight) is good.

ACTIVE USER

IP	Date	Comment	Categories
🇺🇸 139.87.112.70	22 Aug 2026	Web recon scan against ad-serving infra: ~1163 requests probing 554 unique URLs. Targets Apache Slin ... show more Web recon scan against ad-serving infra: ~1163 requests probing 554 unique URLs. Targets Apache Sling/AEM admin endpoints (/system/login, /system/console/bundles, /metrics) plus overlong-UTF8 path-traversal attempts (/status/%c0%ae%c0%ae/..., %e0%80%ae, %f0%80%80%ae variants). Same signature as coordinated scan from 139.87.112.0/24 subnet. All requests blocked HTTP 403. show less	Hacking Bad Web Bot Web App Attack
🇺🇸 139.87.112.75	22 Aug 2026	Web recon scan against ad-serving infra: ~1162 requests probing 554 unique URLs. Targets Apache Slin ... show more Web recon scan against ad-serving infra: ~1162 requests probing 554 unique URLs. Targets Apache Sling/AEM admin endpoints (/system/login, /system/console/bundles, /metrics) plus overlong-UTF8 path-traversal attempts (/status/%c0%ae%c0%ae/..., %e0%80%ae, %f0%80%80%ae variants). Same signature as coordinated scan from 139.87.112.0/24 subnet. All requests blocked HTTP 403. show less	Hacking Bad Web Bot Web App Attack
🇺🇸 139.87.112.78	22 Aug 2026	Web recon scan against ad-serving infra: ~1160-1167 requests probing 554 unique URLs on each of 4 ta ... show more Web recon scan against ad-serving infra: ~1160-1167 requests probing 554 unique URLs on each of 4 targeted vservers. Targets Apache Sling/AEM admin endpoints (/system/login, /system/console/bundles, /metrics) plus overlong-UTF8 path-traversal attempts (/status/%c0%ae%c0%ae/..., %e0%80%ae, %f0%80%80%ae variants). Same signature as coordinated scan from 139.87.112.0/24 subnet. All requests blocked HTTP 403. show less	Hacking Bad Web Bot Web App Attack
🇺🇸 139.87.112.135	22 Aug 2026	Web recon scan against ad-serving infra: ~1160 requests probing 554 unique URLs in a short window on ... show more Web recon scan against ad-serving infra: ~1160 requests probing 554 unique URLs in a short window on each of 7 targeted vservers. Pattern targets Apache Sling/AEM admin endpoints (/system/login, /system/console/bundles, /metrics) plus overlong-UTF8 encoded path-traversal attempts (/status/%c0%ae%c0%ae/..., %e0%80%ae, %f0%80%80%ae variants). All requests correctly blocked with HTTP 403. show less	Hacking Bad Web Bot Web App Attack
🇺🇸 139.87.112.147	22 Aug 2026	Web recon scan against ad-serving infra: ~1169 requests probing 554 unique URLs. Targets Apache Slin ... show more Web recon scan against ad-serving infra: ~1169 requests probing 554 unique URLs. Targets Apache Sling/AEM admin endpoints (/system/login, /system/console/bundles, /metrics) plus overlong-UTF8 path-traversal attempts (/status/%c0%ae%c0%ae/..., %e0%80%ae, %f0%80%80%ae variants). Same signature as coordinated scan from 139.87.112.0/24 subnet. All requests blocked HTTP 403. show less	Hacking Bad Web Bot Web App Attack
🇺🇸 138.124.60.46	17 Aug 2026	612 requests / 14 unique URLs against adsproxycsp1-1.sde10493 today, all returning HTTP 400 (no matc ... show more 612 requests / 14 unique URLs against adsproxycsp1-1.sde10493 today, all returning HTTP 400 (no matching vhost - probed by bare IP, no valid Host/SNI). Classic IoT/DVR camera exploit scan: /ISAPI/Security/userCheck, /RPC2_Login, /cgi-bin/gw.cgi, /Login.htm, /cgi-bin/nobody/VerifyCode.cgi, /LoginPC.cgi, /jpg/image.jpg, /. Source: nginx all_errors.log. show less	Bad Web Bot IoT Targeted
🇺🇸 216.180.246.33	09 Aug 2026	Automated scanning for admin/login panels and known exploit paths (/manage/account/login, /admin/ind ... show more Automated scanning for admin/login panels and known exploit paths (/manage/account/login, /admin/index.html, /index.html, /+CSCOE+/logon.html - Cisco ASA WebVPN probe) returning 400 on two adsproxy edge hosts (adsproxycsp1-1.ssg10093, adsproxycsp1-1.ssg10091). Self-identifies as UA 'GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler' but probes match malicious scanner behavior. show less	Hacking Bad Web Bot Web App Attack
🇺🇸 40.124.174.247	04 Aug 2026	Unsolicited scanning of our public HTTPS frontends: 1 request(s) across 1 of our edge nodes at 04/Au ... show more Unsolicited scanning of our public HTTPS frontends: 1 request(s) across 1 of our edge nodes at 04/Aug/2026:03:33:27 UTC, all rejected with HTTP 400 (sent to the bare server IP with no valid Host header / SNI). Requested paths: /manager/html. User-Agent: "Mozilla/5.0 zgrab/0.x". show less	Hacking Bad Web Bot Web App Attack
🇺🇸 135.119.96.21	04 Aug 2026	Unsolicited scanning of our public HTTPS frontends: 1 request(s) across 1 of our edge nodes at 04/Au ... show more Unsolicited scanning of our public HTTPS frontends: 1 request(s) across 1 of our edge nodes at 04/Aug/2026:02:37:49 UTC, all rejected with HTTP 400 (sent to the bare server IP with no valid Host header / SNI). Requested paths: /manager/html. User-Agent: "Mozilla/5.0 zgrab/0.x". show less	Hacking Bad Web Bot Web App Attack
🇺🇸 20.64.104.5	04 Aug 2026	Unsolicited scanning of our public HTTPS frontends: 1 request(s) across 1 of our edge nodes at 04/Au ... show more Unsolicited scanning of our public HTTPS frontends: 1 request(s) across 1 of our edge nodes at 04/Aug/2026:03:37:06 UTC, all rejected with HTTP 400 (sent to the bare server IP with no valid Host header / SNI). Requested paths: /manager/html. User-Agent: "Mozilla/5.0 zgrab/0.x". show less	Hacking Bad Web Bot Web App Attack
🇺🇸 40.124.174.133	04 Aug 2026	Unsolicited scanning of our public HTTPS frontends: 1 request(s) across 1 of our edge nodes at 04/Au ... show more Unsolicited scanning of our public HTTPS frontends: 1 request(s) across 1 of our edge nodes at 04/Aug/2026:03:13:25 UTC, all rejected with HTTP 400 (sent to the bare server IP with no valid Host header / SNI). Requested paths: /manager/html. User-Agent: "Mozilla/5.0 zgrab/0.x". show less	Hacking Bad Web Bot Web App Attack
🇺🇸 20.55.42.210	04 Aug 2026	Unsolicited scanning of our public HTTPS frontends: 1 request(s) across 1 of our edge nodes at 04/Au ... show more Unsolicited scanning of our public HTTPS frontends: 1 request(s) across 1 of our edge nodes at 04/Aug/2026:03:38:05 UTC, all rejected with HTTP 400 (sent to the bare server IP with no valid Host header / SNI). Requested paths: /manager/html. User-Agent: "Mozilla/5.0 zgrab/0.x". show less	Hacking Bad Web Bot Web App Attack
🇺🇸 20.65.195.41	04 Aug 2026	Unsolicited scanning of our public HTTPS frontends: 1 request(s) across 1 of our edge nodes at 04/Au ... show more Unsolicited scanning of our public HTTPS frontends: 1 request(s) across 1 of our edge nodes at 04/Aug/2026:02:38:27 UTC, all rejected with HTTP 400 (sent to the bare server IP with no valid Host header / SNI). Requested paths: /manager/html. User-Agent: "Mozilla/5.0 zgrab/0.x". show less	Hacking Bad Web Bot Web App Attack
🇺🇸 20.65.194.25	04 Aug 2026	Unsolicited scanning of our public HTTPS frontends: 1 request(s) across 1 of our edge nodes at 04/Au ... show more Unsolicited scanning of our public HTTPS frontends: 1 request(s) across 1 of our edge nodes at 04/Aug/2026:03:00:01 UTC, all rejected with HTTP 400 (sent to the bare server IP with no valid Host header / SNI). Requested paths: /manager/html. User-Agent: "Mozilla/5.0 zgrab/0.x". show less	Hacking Bad Web Bot Web App Attack
🇩🇪 46.101.114.183	04 Aug 2026	Unsolicited scanning of our public HTTPS frontends: 1 request(s) across 1 of our edge nodes at 04/Au ... show more Unsolicited scanning of our public HTTPS frontends: 1 request(s) across 1 of our edge nodes at 04/Aug/2026:03:49:11 UTC, all rejected with HTTP 400 (sent to the bare server IP with no valid Host header / SNI). Requested paths: /cgi-bin/authLogin.cgi. User-Agent: "Go-http-client/1.1". show less	Hacking Bad Web Bot Web App Attack
🇳🇱 93.174.93.12	04 Aug 2026	Unsolicited scanning of our public HTTPS frontends: 1 request(s) across 1 of our edge nodes at 04/Au ... show more Unsolicited scanning of our public HTTPS frontends: 1 request(s) across 1 of our edge nodes at 04/Aug/2026:02:47:55 UTC, all rejected with HTTP 400 (sent to the bare server IP with no valid Host header / SNI). Requested paths: /aaa9. User-Agent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36". show less	Bad Web Bot Web App Attack
🇩🇪 165.22.70.229	04 Aug 2026	Unsolicited scanning of our public HTTPS frontends: 2 request(s) across 1 of our edge nodes between ... show more Unsolicited scanning of our public HTTPS frontends: 2 request(s) across 1 of our edge nodes between 04/Aug/2026:02:36:17 and 04/Aug/2026:05:29:03 UTC, all rejected with HTTP 400 (sent to the bare server IP with no valid Host header / SNI). Requested paths: /query, /v2/_catalog. User-Agent: "Go-http-client/1.1". show less	Bad Web Bot Web App Attack
🇩🇪 207.154.239.237	04 Aug 2026	Unsolicited scanning of our public HTTPS frontends: 2 request(s) across 1 of our edge nodes between ... show more Unsolicited scanning of our public HTTPS frontends: 2 request(s) across 1 of our edge nodes between 04/Aug/2026:02:36:17 and 04/Aug/2026:02:36:18 UTC, all rejected with HTTP 400 (sent to the bare server IP with no valid Host header / SNI). Requested paths: /solr/admin/cores, /solr/admin/info/system. User-Agent: "Go-http-client/1.1". show less	Hacking Bad Web Bot Web App Attack
🇺🇸 23.239.3.62	04 Aug 2026	Unsolicited scanning of our public HTTPS frontends: 2 request(s) across 2 of our edge nodes at 04/Au ... show more Unsolicited scanning of our public HTTPS frontends: 2 request(s) across 2 of our edge nodes at 04/Aug/2026:06:07:55 UTC, all rejected with HTTP 400 (sent to the bare server IP with no valid Host header / SNI). Requested paths: /sdk. User-Agent: "Go-http-client/1.1". show less	Bad Web Bot Web App Attack
🇺🇸 137.184.129.94	04 Aug 2026	Unsolicited scanning of our public HTTPS frontends: 3 request(s) across 3 of our edge nodes at 04/Au ... show more Unsolicited scanning of our public HTTPS frontends: 3 request(s) across 3 of our edge nodes at 04/Aug/2026:06:03:48 UTC, all rejected with HTTP 400 (sent to the bare server IP with no valid Host header / SNI). Requested paths: /sdk. User-Agent: "Go-http-client/1.1". show less	Bad Web Bot Web App Attack
🇺🇸 198.58.114.219	04 Aug 2026	Unsolicited scanning of our public HTTPS frontends: 3 request(s) across 3 of our edge nodes between ... show more Unsolicited scanning of our public HTTPS frontends: 3 request(s) across 3 of our edge nodes between 04/Aug/2026:06:07:54 and 04/Aug/2026:06:07:55 UTC, all rejected with HTTP 400 (sent to the bare server IP with no valid Host header / SNI). Requested paths: /sdk. User-Agent: "Go-http-client/1.1". show less	Bad Web Bot Web App Attack
🇳🇱 86.54.31.46	04 Aug 2026	Unsolicited scanning of our public HTTPS frontends: 5 request(s) across 1 of our edge nodes between ... show more Unsolicited scanning of our public HTTPS frontends: 5 request(s) across 1 of our edge nodes between 04/Aug/2026:12:27:27 and 04/Aug/2026:12:27:46 UTC, all rejected with HTTP 400 (sent to the bare server IP with no valid Host header / SNI). Requested paths: (malformed/empty request line). User-Agent: "-". show less	Bad Web Bot Web App Attack
🇱🇹 141.98.11.194	04 Aug 2026	Unsolicited scanning of our public HTTPS frontends: 3 request(s) across 1 of our edge nodes at 04/Au ... show more Unsolicited scanning of our public HTTPS frontends: 3 request(s) across 1 of our edge nodes at 04/Aug/2026:02:25:27 UTC, all rejected with HTTP 400 (sent to the bare server IP with no valid Host header / SNI). Requested paths: /, /RDWeb. User-Agent: "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, l". show less	Bad Web Bot Web App Attack
🇺🇸 3.129.187.38	04 Aug 2026	Unsolicited scanning of our public HTTPS frontends: 9 request(s) across 3 of our edge nodes between ... show more Unsolicited scanning of our public HTTPS frontends: 9 request(s) across 3 of our edge nodes between 04/Aug/2026:00:19:54 and 04/Aug/2026:00:30:08 UTC, all rejected with HTTP 400 (sent to the bare server IP with no valid Host header / SNI). Requested paths: (malformed/empty request line), /. User-Agent: "visionheight.com/scan Mozilla/5.0 (Macintosh; Intel Mac OS X". show less	Bad Web Bot Web App Attack
🇳🇱 80.82.65.207	04 Aug 2026	Unsolicited scanning of our public HTTPS frontends: 8 request(s) across 8 of our edge nodes between ... show more Unsolicited scanning of our public HTTPS frontends: 8 request(s) across 8 of our edge nodes between 04/Aug/2026:06:34:03 and 04/Aug/2026:07:34:33 UTC, all rejected with HTTP 400 (sent to the bare server IP with no valid Host header / SNI). Requested paths: /. User-Agent: "-". show less	Bad Web Bot Web App Attack