AbuseIPDB

JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

User wupinyin , the webmaster of wupinyin.co.uk, joined AbuseIPDB in July 2025 and has reported 8,652 IP addresses.

Standing (weight) is good.

ACTIVE USER WEBMASTER SUPPORTER

IP	Date	Comment	Categories
🇺🇸 20.171.121.149	02 Nov 2026	Probing for admin interfaces: GET /admin.php/ws.php, GET /admin.php/bhigtouj.php, GET /admin.php/m1. ... show more Probing for admin interfaces: GET /admin.php/ws.php, GET /admin.php/bhigtouj.php, GET /admin.php/m1.php \| Probing for known attack paths (web shells, dotfiles, dumps, config files): GET /wp-content/plugins/hellopress/wp_filemanager.php, GET /this_is_a_new_hello_world.php, GET /ab.php, GET /srontol.php, GET /xwpg.php (+6 more) [14 events, 2026-11-02T09:05:12Z; auto-reported by CrowdSec] show less	Web App Attack
🇫🇷 5.182.17.163	02 Nov 2026	Probing for sensitive files: GET /.env, GET /backend/.env, GET /api/.env, GET /static/.env, GET /adm ... show more Probing for sensitive files: GET /.env, GET /backend/.env, GET /api/.env, GET /static/.env, GET /admin/.env \| IDS alert: ET WEB_SERVER Tilde in URI - potential .php~ source disclosure vulnerability (TCP/80) \| IDS alert: ET WEB_SERVER WEB-PHP phpinfo access (TCP/80) [12 events, 2026-11-02T08:22:28Z; auto-reported by CrowdSec] show less	Hacking Web App Attack
🇵🇰 153.117.13.135	02 Nov 2026	Honeypot: sent a command-injection exploit that downloads malware to a decoy web server: hxxp://153. ... show more Honeypot: sent a command-injection exploit that downloads malware to a decoy web server: hxxp://153.117.13.135:50651/Mozi.m [1 event, 2026-11-02T08:03:33Z; auto-reported by CrowdSec] show less	Hacking Exploited Host Web App Attack
🇳🇱 34.158.80.253	02 Nov 2026	Probing for sensitive files: GET /.git/config, GET /.env, GET /.env.local, GET /.env.staging, GET /. ... show more Probing for sensitive files: GET /.git/config, GET /.env, GET /.env.local, GET /.env.staging, GET /.env.development \| Probing for known attack paths (web shells, dotfiles, dumps, config files): GET /.git/config, GET /.env, GET /.env.local, GET /.env.production, GET /.env.staging (+5 more) \| Probing for admin interfaces: GET /admin/.env, GET /administrator/.env, GET /phpinfo.php [19 events, 2026-11-02T07:47:00Z; auto-reported by CrowdSec] show less	Web App Attack
🇺🇸 172.98.32.161	02 Nov 2026	IDS alert: ET HUNTING HTTP URI Path Normalization Bypasses & Escapes M1 (TCP/80) [1 event, 2026-11-0 ... show more IDS alert: ET HUNTING HTTP URI Path Normalization Bypasses & Escapes M1 (TCP/80) [1 event, 2026-11-02T07:02:45Z; auto-reported by CrowdSec] show less	Hacking Web App Attack
🇺🇸 172.98.32.220	02 Nov 2026	IDS alert: ET HUNTING HTTP URI Path Normalization Bypasses & Escapes M1 (TCP/80) [1 event, 2026-11-0 ... show more IDS alert: ET HUNTING HTTP URI Path Normalization Bypasses & Escapes M1 (TCP/80) [1 event, 2026-11-02T07:02:51Z; auto-reported by CrowdSec] show less	Hacking Web App Attack
🇺🇸 172.98.32.109	02 Nov 2026	IDS alert: ET WEB_SPECIFIC_APPS WordPress Core wp2shell Remote Code Execution (CVE-2026-63030 & CVE- ... show more IDS alert: ET WEB_SPECIFIC_APPS WordPress Core wp2shell Remote Code Execution (CVE-2026-63030 & CVE-~ (TCP/80); ET WEB_SERVER Possible SQL Injection SELECT CONCAT in HTTP Request Body (TCP/80); ET WEB_SERVER Possible SQL Injection UNION SELECT in HTTP Request Body (TCP/80) [1 event, 2026-11-02T06:58:28Z; auto-reported by CrowdSec] show less	Hacking SQL Injection Web App Attack
🇺🇸 172.98.32.223	02 Nov 2026	IDS alert: ET WEB_SPECIFIC_APPS WordPress Core wp2shell Remote Code Execution (CVE-2026-63030 & CVE- ... show more IDS alert: ET WEB_SPECIFIC_APPS WordPress Core wp2shell Remote Code Execution (CVE-2026-63030 & CVE-~ (TCP/80); ET WEB_SERVER Possible SQL Injection SELECT CONCAT in HTTP Request Body (TCP/80); ET WEB_SERVER Possible SQL Injection UNION SELECT in HTTP Request Body (TCP/80) [1 event, 2026-11-02T06:58:07Z; auto-reported by CrowdSec] show less	Hacking SQL Injection Web App Attack
🇺🇸 136.144.42.24	02 Nov 2026	IDS alert: ET WEB_SPECIFIC_APPS React Server Components React2Shell Unsafe Flight Protocol Property ... show more IDS alert: ET WEB_SPECIFIC_APPS React Server Components React2Shell Unsafe Flight Protocol Property ~ (TCP/80); ET HUNTING Javascript Prototype Pollution Attempt via __proto__ in HTTP Body (TCP/80); ET INFO User-Agent (python-requests) Inbound to Webserver (TCP/80); ET HUNTING Javascript Sandbox Escape via Global Object (process) (TCP/80) [1 event, 2026-11-02T06:57:33Z; auto-reported by CrowdSec] show less	Hacking Web App Attack
🇺🇸 172.98.32.111	02 Nov 2026	IDS alert: ET INFO User-Agent (python-requests) Inbound to Webserver (TCP/80); ET WEB_SPECIFIC_APPS ... show more IDS alert: ET INFO User-Agent (python-requests) Inbound to Webserver (TCP/80); ET WEB_SPECIFIC_APPS React Server Components React2Shell Unsafe Flight Protocol Property ~ (TCP/80); ET HUNTING Javascript Prototype Pollution Attempt via __proto__ in HTTP Body (TCP/80); ET HUNTING Javascript Sandbox Escape via Global Object (process) (TCP/80) [1 event, 2026-11-02T06:57:22Z; auto-reported by CrowdSec] show less	Hacking Web App Attack
🇩🇪 64.89.160.73	02 Nov 2026	Probing for sensitive files: GET /.env, GET /.env.local, GET /.env.prod, GET /.env.staging, GET /.en ... show more Probing for sensitive files: GET /.env, GET /.env.local, GET /.env.prod, GET /.env.staging, GET /.env.backup [5 events, 2026-11-02T06:34:18Z; auto-reported by CrowdSec] show less	Web App Attack
🇭🇺 89.134.154.97	02 Nov 2026	IDS alert: ET EXPLOIT Apache Struts Possible OGNL Java Exec In URI (TCP/80); ET WEB_SPECIFIC_APPS Ap ... show more IDS alert: ET EXPLOIT Apache Struts Possible OGNL Java Exec In URI (TCP/80); ET WEB_SPECIFIC_APPS Apache Struts java.lang inbound OGNL injection remote code execution~ (TCP/80); ET WEB_SERVER Possible Apache Struts OGNL in Dynamic Action (TCP/80); ET HUNTING .exec in HTTP URI Inbound - Possible Exploit Activity (TCP/80) [2 events, 2026-11-02T06:08:21Z; auto-reported by CrowdSec] show less	Hacking Web App Attack
🇺🇸 2602:fa59:2:84d3::1	02 Nov 2026	IDS alert: ET WEB_SERVER Tilde in URI - potential .php~ source disclosure vulnerability (TCP/80) [1 ... show more IDS alert: ET WEB_SERVER Tilde in URI - potential .php~ source disclosure vulnerability (TCP/80) [1 event, 2026-11-02T05:24:51Z; auto-reported by CrowdSec] show less	Hacking Web App Attack
🇧🇷 187.115.82.254	02 Nov 2026	IDS alert: ET SCAN MS Terminal Server Traffic on Non-standard Port (TCP/22); ET SCAN MS Terminal Ser ... show more IDS alert: ET SCAN MS Terminal Server Traffic on Non-standard Port (TCP/22); ET SCAN MS Terminal Server Traffic on Non-standard Port (TCP/2222) [18 events, 2026-11-02T02:39:04Z to 2026-11-02T04:47:56Z; auto-reported by CrowdSec] show less	Port Scan
🇵🇰 124.29.230.206	02 Nov 2026	Honeypot: sent a command-injection exploit that downloads malware to a decoy web server: hxxp://124. ... show more Honeypot: sent a command-injection exploit that downloads malware to a decoy web server: hxxp://124.29.230.206:34217/Mozi.m [1 event, 2026-11-02T04:20:53Z; auto-reported by CrowdSec] show less	Hacking Exploited Host Web App Attack
🇪🇬 41.33.45.100	02 Nov 2026	SSH login brute-force against a git server [6 events, 2026-11-02T04:11:01Z; auto-reported by CrowdSe ... show more SSH login brute-force against a git server [6 events, 2026-11-02T04:11:01Z; auto-reported by CrowdSec] show less	Brute-Force SSH
🇯🇵 156.227.234.198	02 Nov 2026	IDS alert: ET EXPLOIT Apache HTTP Server 2.4.49 - Path Traversal Attempt (CVE-2021-41773) M2 (TCP/80 ... show more IDS alert: ET EXPLOIT Apache HTTP Server 2.4.49 - Path Traversal Attempt (CVE-2021-41773) M2 (TCP/80); ET WEB_SERVER /bin/sh In URI Possible Shell Command Execution Attempt (TCP/80) [1 event, 2026-11-02T04:01:52Z; auto-reported by CrowdSec] show less	Hacking Web App Attack
🇷🇺 37.77.150.71	02 Nov 2026	IDS alert: ET EXPLOIT Hikvision IP Camera RCE Attempt (CVE-2021-36260) (TCP/80) [1 event, 2026-11-02 ... show more IDS alert: ET EXPLOIT Hikvision IP Camera RCE Attempt (CVE-2021-36260) (TCP/80) [1 event, 2026-11-02T03:53:17Z; auto-reported by CrowdSec] show less	Hacking
🇧🇪 34.77.99.151	02 Nov 2026	Probing for sensitive files: GET /.docker/.env, GET /.aws/config, GET /.docker/laravel/app/.env, GET ... show more Probing for sensitive files: GET /.docker/.env, GET /.aws/config, GET /.docker/laravel/app/.env, GET /.env, GET /.aws/.env \| Probing for known attack paths (web shells, dotfiles, dumps, config files): GET /.docker/.env, GET /.aws/config, GET /.docker/laravel/app/.env, GET /.env, GET /.env-sample (+3 more) \| Probing for admin interfaces: GET /admin/.env, GET /api/phpinfo.php, GET /phpinfo.php [19 events, 2026-11-02T03:27:39Z; auto-reported by CrowdSec] show less	Web App Attack
🇨🇳 27.216.215.209	02 Nov 2026	Honeypot: sent a command-injection exploit that downloads malware to a decoy web server: hxxp://27.2 ... show more Honeypot: sent a command-injection exploit that downloads malware to a decoy web server: hxxp://27.216.215.209:55397/Mozi.a [1 event, 2026-11-02T02:42:15Z; auto-reported by CrowdSec] show less	Hacking Exploited Host Web App Attack
🇵🇰 103.74.20.77	02 Nov 2026	Honeypot: sent a command-injection exploit that downloads malware to a decoy web server: hxxp://172. ... show more Honeypot: sent a command-injection exploit that downloads malware to a decoy web server: hxxp://172.168.137.187:45998/Mozi.m [1 event, 2026-11-02T02:37:15Z; auto-reported by CrowdSec] show less	Hacking Exploited Host Web App Attack
🇳🇱 45.148.10.21	02 Nov 2026	Probing for sensitive files: GET /.aws/config, GET /.docker/config.json, GET /.env, GET /.docker/.en ... show more Probing for sensitive files: GET /.aws/config, GET /.docker/config.json, GET /.env, GET /.docker/.env, GET /.aws/.env \| Probing for known attack paths (web shells, dotfiles, dumps, config files): GET /.aws/config, GET /.docker/config.json, GET /.env, GET /.env-example, GET /.docker/.env (+3 more) \| Probing for admin interfaces: GET /api/phpinfo.php, GET /admin/.env, GET /phpinfo.php [19 events, 2026-11-02T01:59:21Z; auto-reported by CrowdSec] show less	Web App Attack
🇨🇳 47.113.195.222	02 Nov 2026	SSH login brute-force against a git server [6 events, 2026-11-02T01:38:50Z; auto-reported by CrowdSe ... show more SSH login brute-force against a git server [6 events, 2026-11-02T01:38:50Z; auto-reported by CrowdSec] show less	Brute-Force SSH
🇩🇪 213.209.159.133	01 Nov 2026	Probing for known attack paths (web shells, dotfiles, dumps, config files): GET /.env, GET /%2f%2eaw ... show more Probing for known attack paths (web shells, dotfiles, dumps, config files): GET /.env, GET /%2f%2eaws%2fcredentials, GET /.env.old, GET /.aws/config, GET /.env.production (+3 more) \| Probing for sensitive files: GET /.env, GET /.aws/config, GET /.env.local, GET /api/.env, GET /app/.env [16 events, 2026-11-01T23:00:13Z; auto-reported by CrowdSec] show less	Web App Attack
🇺🇸 162.245.218.45	01 Nov 2026	IDS alert: ET EXPLOIT Apache HTTP Server 2.4.49 - Path Traversal Attempt (CVE-2021-41773) M2 (TCP/80 ... show more IDS alert: ET EXPLOIT Apache HTTP Server 2.4.49 - Path Traversal Attempt (CVE-2021-41773) M2 (TCP/80); ET WEB_SERVER /bin/sh In URI Possible Shell Command Execution Attempt (TCP/80) [2 events, 2026-11-01T22:22:20Z; auto-reported by CrowdSec] show less	Hacking Web App Attack