AbuseIPDB

JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

User wupinyin , the webmaster of wupinyin.co.uk, joined AbuseIPDB in July 2025 and has reported 8,859 IP addresses.

Standing (weight) is good.

ACTIVE USER WEBMASTER SUPPORTER

IP	Date	Comment	Categories
🇺🇸 142.86.121.133	06 Nov 2026	Probing for sensitive files: GET /.git/config, GET /.env, GET /.env.local, GET /.env.staging, GET /. ... show more Probing for sensitive files: GET /.git/config, GET /.env, GET /.env.local, GET /.env.staging, GET /.env.development \| Probing for known attack paths (web shells, dotfiles, dumps, config files): GET /.git/config, GET /.env, GET /.env.local, GET /.env.production, GET /.env.staging (+5 more) [16 events, 2026-11-06T20:25:16Z; auto-reported by CrowdSec] show less	Web App Attack
🇿🇦 102.133.162.110	06 Nov 2026	Probing for known attack paths (web shells, dotfiles, dumps, config files): GET /wp-content/plugins/ ... show more Probing for known attack paths (web shells, dotfiles, dumps, config files): GET /wp-content/plugins/hellopress/wp_filemanager.php, GET /this_is_a_new_hello_world.php, GET /core.php, GET /footer.php, GET /header.php (+6 more) [11 events, 2026-11-06T19:04:47Z; auto-reported by CrowdSec] show less	Web App Attack
🇵🇱 193.111.117.34	06 Nov 2026	IDS alert: ET WEB_SPECIFIC_APPS React Server Components React2Shell Unsafe Flight Protocol Property ... show more IDS alert: ET WEB_SPECIFIC_APPS React Server Components React2Shell Unsafe Flight Protocol Property ~ (TCP/443); ET HUNTING Javascript Prototype Pollution Attempt via __proto__ in HTTP Body (TCP/443) [1 event, 2026-11-06T18:25:53Z; auto-reported by CrowdSec] show less	Hacking Web App Attack
🇭🇰 103.243.25.44	06 Nov 2026	SSH login brute-force against a git server [6 events, 2026-11-06T18:00:08Z; auto-reported by CrowdSe ... show more SSH login brute-force against a git server [6 events, 2026-11-06T18:00:08Z; auto-reported by CrowdSec] show less	Brute-Force SSH
🇻🇪 23.146.236.120	06 Nov 2026	IDS alert: ET EXPLOIT D-Link Devices Home Network Administration Protocol Command Execution (TCP/80) ... show more IDS alert: ET EXPLOIT D-Link Devices Home Network Administration Protocol Command Execution (TCP/80); ET WEB_SERVER WGET Command Specifying Output in HTTP Headers (TCP/80) [2 events, 2026-11-06T14:40:08Z; auto-reported by CrowdSec] show less	Hacking Web App Attack
🇻🇳 124.158.13.141	06 Nov 2026	IDS alert: ET EXPLOIT Apache HTTP Server 2.4.49 - Path Traversal Attempt (CVE-2021-41773) M2 (TCP/80 ... show more IDS alert: ET EXPLOIT Apache HTTP Server 2.4.49 - Path Traversal Attempt (CVE-2021-41773) M2 (TCP/80); ET WEB_SERVER /bin/sh In URI Possible Shell Command Execution Attempt (TCP/80) [1 event, 2026-11-06T13:33:28Z; auto-reported by CrowdSec] show less	Hacking Web App Attack
🇫🇷 86.48.2.136	06 Nov 2026	Probing for sensitive files: GET /.env, GET /backend/.env, GET /media/.env, GET /.env.local, GET /.e ... show more Probing for sensitive files: GET /.env, GET /backend/.env, GET /media/.env, GET /.env.local, GET /.env.prod [5 events, 2026-11-06T12:45:53Z; auto-reported by CrowdSec] show less	Web App Attack
🇺🇸 34.74.49.123	06 Nov 2026	IDS alert: ET WEB_SERVER Next.js Middleware Authorization Bypass (CVE-2025-29927) (TCP/80) [1 event, ... show more IDS alert: ET WEB_SERVER Next.js Middleware Authorization Bypass (CVE-2025-29927) (TCP/80) [1 event, 2026-11-06T11:44:46Z; auto-reported by CrowdSec] show less	Hacking Web App Attack
🇺🇸 34.75.163.65	06 Nov 2026	IDS alert: ET WEB_SERVER Next.js Middleware Authorization Bypass (CVE-2025-29927) (TCP/80) [1 event, ... show more IDS alert: ET WEB_SERVER Next.js Middleware Authorization Bypass (CVE-2025-29927) (TCP/80) [1 event, 2026-11-06T07:21:02Z; auto-reported by CrowdSec] show less	Hacking Web App Attack
🇵🇰 103.66.149.29	06 Nov 2026	IDS alert: ET EXPLOIT HackingTrio UA (Hello, World) (TCP/80); ET SCAN Mirai Variant User-Agent (Inbo ... show more IDS alert: ET EXPLOIT HackingTrio UA (Hello, World) (TCP/80); ET SCAN Mirai Variant User-Agent (Inbound) (TCP/80); ET WEB_SERVER WebShell Generic - wget http - POST (TCP/80) [2 events, 2026-11-06T05:41:03Z; auto-reported by CrowdSec] show less	Port Scan Hacking Web App Attack
🇺🇸 129.121.96.133	06 Nov 2026	SSH login brute-force against a git server [6 events, 2026-11-06T05:16:27Z; auto-reported by CrowdSe ... show more SSH login brute-force against a git server [6 events, 2026-11-06T05:16:27Z; auto-reported by CrowdSec] show less	Brute-Force SSH
🇫🇮 193.187.110.160	06 Nov 2026	IDS alert: ET SCAN LibSSH Based Frequent SSH Connections Likely BruteForce Attack (TCP/22) [1 event, ... show more IDS alert: ET SCAN LibSSH Based Frequent SSH Connections Likely BruteForce Attack (TCP/22) [1 event, 2026-11-06T03:30:43Z; auto-reported by CrowdSec] show less	Port Scan Hacking Brute-Force
🇲🇾 202.165.25.8	06 Nov 2026	IDS alert: ET INFO SSH-2.0-Go version string Observed in Network Traffic (TCP/2222) [24 events, 2026 ... show more IDS alert: ET INFO SSH-2.0-Go version string Observed in Network Traffic (TCP/2222) [24 events, 2026-11-06T00:09:26Z to 2026-11-06T03:18:55Z; auto-reported by CrowdSec] show less	Hacking
🇦🇹 88.117.196.154	06 Nov 2026	IDS alert: ET EXPLOIT Apache Struts Possible OGNL Java Exec In URI (TCP/80); ET WEB_SPECIFIC_APPS Ap ... show more IDS alert: ET EXPLOIT Apache Struts Possible OGNL Java Exec In URI (TCP/80); ET WEB_SPECIFIC_APPS Apache Struts java.lang inbound OGNL injection remote code execution~ (TCP/80); ET WEB_SERVER Possible Apache Struts OGNL in Dynamic Action (TCP/80); ET HUNTING .exec in HTTP URI Inbound - Possible Exploit Activity (TCP/80) [1 event, 2026-11-06T02:46:07Z; auto-reported by CrowdSec] show less	Hacking Web App Attack
🇮🇹 172.213.9.3	06 Nov 2026	Probing for known attack paths (web shells, dotfiles, dumps, config files): GET /wp-content/plugins/ ... show more Probing for known attack paths (web shells, dotfiles, dumps, config files): GET /wp-content/plugins/hellopress/wp_filemanager.php, GET /this_is_a_new_hello_world.php, GET /rapid.php, GET /ggg.php, GET /zzxx.php (+6 more) \| WordPress scanning: GET /wp-content/plugins/hellopress/wp_filemanager.php, GET /wp-admin/css/about.php, GET /wp-content/about.php, GET /wp-content/plugins/index.php [15 events, 2026-11-06T01:30:51Z; auto-reported by CrowdSec] show less	Web App Attack
🇵🇱 45.138.12.180	06 Nov 2026	Probing for sensitive files: GET /backend/.env, GET /.env, GET /source/.env, GET /config.env, GET /f ... show more Probing for sensitive files: GET /backend/.env, GET /.env, GET /source/.env, GET /config.env, GET /framework/.env \| Probing for known attack paths (web shells, dotfiles, dumps, config files): GET /wp-login.php, GET /backend/.env, GET /.env, GET /.env.production, GET /.gitlab-ci.yml (+2 more) \| Exploit attempt for CVE-2017-9841: GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php \| Probing for admin interfaces: GET /wp-login.php, GET /phpinfo.php.bak, GET /phpinfo.php3 [20 events, 2026-11-06T01:07:37Z; auto-reported by CrowdSec] show less	Hacking Web App Attack
🇵🇱 45.138.12.16	06 Nov 2026	Probing for sensitive files: GET /.git/config, GET /.env, GET /.env.local, GET /.env.backup, GET /.e ... show more Probing for sensitive files: GET /.git/config, GET /.env, GET /.env.local, GET /.env.backup, GET /.env.bak \| Probing for known attack paths (web shells, dotfiles, dumps, config files): GET /.git/config, GET /.svn/wc.db, GET /.env, GET /.git-credentials, GET /.env.local (+6 more) \| WordPress scanning: GET /wp-config.php, GET /wp-load.php, GET /wp-settings.php, GET /wp-blog-header.php [20 events, 2026-11-06T01:06:29Z; auto-reported by CrowdSec] show less	Web App Attack
🇬🇧 34.13.62.71	05 Nov 2026	Probing for sensitive files: GET /.git/config, GET /.env, GET /.env.local, GET /.env.staging, GET /. ... show more Probing for sensitive files: GET /.git/config, GET /.env, GET /.env.local, GET /.env.staging, GET /.env.development \| Probing for known attack paths (web shells, dotfiles, dumps, config files): GET /.git/config, GET /.env, GET /.env.local, GET /.env.production, GET /.env.staging (+5 more) [16 events, 2026-11-05T21:43:48Z; auto-reported by CrowdSec] show less	Web App Attack
🇧🇪 104.28.195.126	05 Nov 2026	IDS alert: ET WEB_SPECIFIC_APPS Vite Arbitrary File Read Via raw parameter (CVE-2025-30208) (TCP/80) ... show more IDS alert: ET WEB_SPECIFIC_APPS Vite Arbitrary File Read Via raw parameter (CVE-2025-30208) (TCP/80) [1 event, 2026-11-05T19:41:27Z; auto-reported by CrowdSec] show less	Hacking Web App Attack
🇺🇸 34.125.80.133	05 Nov 2026	Probing for sensitive files: GET /.env, GET /.env.local, GET /.env.staging, GET /.env.development, G ... show more Probing for sensitive files: GET /.env, GET /.env.local, GET /.env.staging, GET /.env.development, GET /.env.backup \| Probing for known attack paths (web shells, dotfiles, dumps, config files): GET /.env, GET /.env.local, GET /.env.production, GET /.env.staging, GET /.env.development (+6 more) [16 events, 2026-11-05T19:40:37Z; auto-reported by CrowdSec] show less	Web App Attack
🇦🇺 34.87.235.203	05 Nov 2026	Probing for sensitive files: GET /.git/config, GET /.env, GET /.env.local, GET /.env.staging, GET /. ... show more Probing for sensitive files: GET /.git/config, GET /.env, GET /.env.local, GET /.env.staging, GET /.env.development \| Probing for known attack paths (web shells, dotfiles, dumps, config files): GET /.git/config, GET /.env, GET /.env.local, GET /.env.production, GET /.env.staging (+5 more) [16 events, 2026-11-05T19:33:00Z; auto-reported by CrowdSec] show less	Web App Attack
🇧🇷 187.115.82.254	05 Nov 2026	IDS alert: ET SCAN MS Terminal Server Traffic on Non-standard Port (TCP/2222); ET SCAN MS Terminal S ... show more IDS alert: ET SCAN MS Terminal Server Traffic on Non-standard Port (TCP/2222); ET SCAN MS Terminal Server Traffic on Non-standard Port (TCP/22) [31 events, 2026-11-05T14:26:56Z to 2026-11-05T18:45:31Z; auto-reported by CrowdSec] show less	Port Scan
🇩🇪 64.89.160.73	05 Nov 2026	Probing for sensitive files: GET /.env, GET /.env.local, GET /.env.prod, GET /.env.staging, GET /.en ... show more Probing for sensitive files: GET /.env, GET /.env.local, GET /.env.prod, GET /.env.staging, GET /.env.backup \| Probing for known attack paths (web shells, dotfiles, dumps, config files): GET /.env, GET /.env.local, GET /.env.production, GET /.env.prod, GET /.env.staging (+6 more) [16 events, 2026-11-05T18:00:27Z; auto-reported by CrowdSec] show less	Web App Attack
🇹🇭 118.194.250.232	05 Nov 2026	IDS alert: ET INFO External Oracle T3 Requests Inbound (TCP/443) [1 event, 2026-11-05T17:20:34Z; aut ... show more IDS alert: ET INFO External Oracle T3 Requests Inbound (TCP/443) [1 event, 2026-11-05T17:20:34Z; auto-reported by CrowdSec] show less	Hacking
🇫🇷 20.199.44.243	05 Nov 2026	Probing for sensitive files: GET /.env.prod, GET /.env.staging, GET /.env.dev, GET /.env.backup, GET ... show more Probing for sensitive files: GET /.env.prod, GET /.env.staging, GET /.env.dev, GET /.env.backup, GET /.env.bak [7 events, 2026-11-05T17:12:18Z; auto-reported by CrowdSec] show less	Web App Attack