AbuseIPDB

JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

User ketovoila.pl joined AbuseIPDB in August 2025 and has reported 31,314 IP addresses.

Standing (weight) is good.

ACTIVE USER

IP	Date	Comment	Categories
🇰🇷 20.194.0.112	43 minutes ago	Automated WordPress directory enumeration and exposed-file discovery. The source systematically prob ... show more Automated WordPress directory enumeration and exposed-file discovery. The source systematically probed WordPress administration, core and content directories, indicating an attempt to identify directory indexing, installed components, writable locations and exposed files. Attempts: 8; unique paths: 8; WordPress directories: 6; areas: wp-admin,wp-content,wp-includes; helper directories: 2; paths: /wp-includes/PHPMailer/,/wp-includes/html-api/,/wp-content/plugins/WordPressCore/,/wp-includes/images/,/wp-content/uploads/,/wp-admin/css/colors/ectoplasm/,/cgi-bin/,/.well-known/; unique User-Agents: 1; User-Agent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"; time range: 2026-10-22T23:57:36Z - 2026-10-22T23:57:36Z. HTTP methods: GET (48). show less	Hacking Bad Web Bot Web App Attack
🇦🇺 3.26.255.172	4 hours ago	ketovoila.pl web app/PHP backdoor scan: hits=1; unique_paths=1; sample_paths=//wp-content/plugins/fi ... show more ketovoila.pl web app/PHP backdoor scan: hits=1; unique_paths=1; sample_paths=//wp-content/plugins/fix/up.php; UA="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.102 Safari/537.36"; window=2026-10-22T20:34:41Z..2026-10-22T20:34:41Z HTTP methods: GET (1). show less	Bad Web Bot Web App Attack
🇩🇪 130.12.180.167	6 hours ago	ketovoila.pl web app secret/repository scan: hits=1; unique_paths=1; sample_paths=/.env; UA="Mozilla ... show more ketovoila.pl web app secret/repository scan: hits=1; unique_paths=1; sample_paths=/.env; UA="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36"; window=2026-10-22T18:27:47Z..2026-10-22T18:27:47Z HTTP methods: GET (1). show less	Bad Web Bot Web App Attack
🇵🇱 45.138.12.52	7 hours ago	ketovoila.pl web app secret/repository scan: hits=8; unique_paths=8; sample_paths=/.env.dev,/.env.sa ... show more ketovoila.pl web app secret/repository scan: hits=8; unique_paths=8; sample_paths=/.env.dev,/.env.save,/api/.env; UA="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"; window=2026-10-22T18:07:27Z..2026-10-22T18:07:27Z HTTP methods: GET (8). show less	Bad Web Bot Web App Attack
🇦🇺 15.135.163.178	7 hours ago	ketovoila.pl web app/PHP backdoor scan: hits=1; unique_paths=1; sample_paths=//wp-content/plugins/fi ... show more ketovoila.pl web app/PHP backdoor scan: hits=1; unique_paths=1; sample_paths=//wp-content/plugins/fix/up.php; UA="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.102 Safari/537.36"; window=2026-10-22T17:35:47Z..2026-10-22T17:35:47Z HTTP methods: GET (1). show less	Bad Web Bot Web App Attack
🇫🇷 143.244.57.84	7 hours ago	Automated WordPress alternative-installation reconnaissance. The source probed multiple aliases asso ... show more Automated WordPress alternative-installation reconnaissance. The source probed multiple aliases associated with old, backup, staging or secondary WordPress installations. Attempts: 9; unique paths: 9; unique aliases: 9; aliases: 2018,2019,blog,shop,site,sito,test,wordpress,wp; paths: /wordpress/wp-includes/wlwmanifest.xml,/blog/wp-includes/wlwmanifest.xml,/2018/wp-includes/wlwmanifest.xml,/2019/wp-includes/wlwmanifest.xml,/wp/wp-includes/wlwmanifest.xml,/shop/wp-includes/wlwmanifest.xml,/test/wp-includes/wlwmanifest.xml,/site/wp-includes/wlwmanifest.xml,/sito/wp-includes/wlwmanifest.xml; User-Agent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"; time range: 2026-10-22T17:09:41Z - 2026-10-22T17:09:44Z. Additional application-targeting probes were observed in the same source group. HTTP methods: GET (21). show less	Hacking Bad Web Bot Web App Attack
🇺🇿 144.124.192.153	9 hours ago	ketovoila.pl WordPress user/author enumeration: hits=8; unique_paths=8; sample_paths=/wp-json/wp/v2/ ... show more ketovoila.pl WordPress user/author enumeration: hits=8; unique_paths=8; sample_paths=/wp-json/wp/v2/users?_jsonp=callback&per_page=100&_fields=id,slug&page=1,/?rest_route=/wp/v2/users&_jsonp=callback&per_page=100&_fields=id,slug&page=1; UA="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36"; window=2026-10-22T15:10:59Z..2026-10-22T15:11:04Z HTTP methods: GET (6),POST (2). show less	Hacking Bad Web Bot Web App Attack
🇧🇭 109.63.6.191	9 hours ago	ketovoila.pl WordPress user/author enumeration: hits=47; unique_paths=35; sample_paths=/wp-json/wp/v ... show more ketovoila.pl WordPress user/author enumeration: hits=47; unique_paths=35; sample_paths=/wp-json/wp/v2/users/me,/?author=3&_fields=slug,/wp-json/wp/v2/users?per_page=100&_fields=slug,/?author=1&_fields=slug,/?author=2&_fields=slug,/wp-json/wp/v2/users?per_page=50&_embed&_fields=id,slug,name,/?rest_route=%2Fwp%2Fv2%2Fusers&_fields=slug&per_page=100&page=1,/wp-json/wp/v2/users?context=edit&_fields=slug&per_page=100&page=1,/index.php?rest_route=/wp/v2/users&_fields=slug&per_page=100&page=1,/wp-json/wp/v2/users?_fields=slug&per_page=100&page=1; UA="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36"; window=2026-10-22T15:10:57Z..2026-10-22T15:11:04Z HTTP methods: GET (47). show less	Hacking Bad Web Bot Web App Attack
🇷🇺 185.201.30.43	9 hours ago	ketovoila.pl WordPress user/author enumeration: hits=36; unique_paths=32; sample_paths=/wp-json/wp/v ... show more ketovoila.pl WordPress user/author enumeration: hits=36; unique_paths=32; sample_paths=/wp-json/wp/v2/users/me,/xmlrpc.php,/wp-json/wp/v2/users?per_page=100&_fields=slug,locale,/?author=4&feed=rss2,/index.php/wp-json/wp/v2/users?_fields=slug&per_page=100&page=1,/index.php?rest_route=/wp/v2/users&_fields=slug&per_page=100&page=1,/?author=5&feed=rss2,/wp/wp-json/wp/v2/users?_fields=slug&per_page=100&page=1,/?author=1&feed=rss2,/?author=2&feed=rss2; UA="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36"; window=2026-10-22T15:10:57Z..2026-10-22T15:11:04Z HTTP methods: GET (31),POST (5). show less	Hacking Bad Web Bot Web App Attack
🇩🇪 159.69.73.185	11 hours ago	Automated probing of URL decoding, request normalization, and input-processing limits. On 2026-10 ... show more Automated probing of URL decoding, request normalization, and input-processing limits. On 2026-10-22 at 13:34:12 UTC, the source submitted four crafted HTTP GET requests within the same second. The requests included paths containing single-encoded and double-encoded forward slashes (/%2f and /%252f), apparently testing how the application interprets and normalizes specially encoded URL characters. The source also submitted an abnormally long query string containing thousands of characters, with extensive repetition of the double-encoded sequence %2541. This sequence becomes %41 after one decoding pass and the letter A after a second pass. The combination of double-encoded URL paths and an oversized, repetitive query parameter is consistent with deliberate testing for inconsistent URL decoding, input-validation weaknesses, request parser limitations, and potential filter bypasses. This was suspicious automated security probing rather than legitimate website navigation. show less	Web App Attack Hacking
🇭🇰 156.245.205.12	12 hours ago	ketovoila.pl web app/PHP backdoor scan: hits=2; unique_paths=2; sample_paths=/1234.php; UA="Mozilla/ ... show more ketovoila.pl web app/PHP backdoor scan: hits=2; unique_paths=2; sample_paths=/1234.php; UA="Mozilla/5.0 (Windows NT 10.0; WOW64; rv:48.0) Gecko/20100101 Firefox/48.0"; window=2026-10-22T12:23:01Z..2026-10-22T12:31:46Z HTTP methods: GET (2). show less	Bad Web Bot Web App Attack
🇵🇱 45.138.12.41	14 hours ago	Automated WordPress and REST API reconnaissance targeting ketovoila.pl. On 2026-10-22 between 08: ... show more Automated WordPress and REST API reconnaissance targeting ketovoila.pl. On 2026-10-22 between 08:27:56 and 08:28:01 UTC, this IP generated 47 HTTP GET requests within approximately 6 seconds. The requests targeted 24 distinct URL/path-query combinations, including /wp-json/, /wordpress/wp-json/, /blog/wp-json/, /cms/?rest_route=/, /wp/?rest_route=/ and other WordPress installation paths. The scanner rotated 8 User-Agent strings, including 7 requests claiming to be Googlebot without verified bot classification. show less	Bad Web Bot Hacking
🇵🇱 45.138.12.44	14 hours ago	Automated WordPress installation and REST API reconnaissance targeting ketovoila.pl. On 2026-10-2 ... show more Automated WordPress installation and REST API reconnaissance targeting ketovoila.pl. On 2026-10-22, Cloudflare recorded 105 requests from this IP in two bursts (08:18:09–08:18:27 UTC and 09:17:48–09:17:51 UTC). The scanner probed /wp-json/, /wordpress/, /wp/, /cms/, /blog/, /site/, /news/, /press/ and multiple ?rest_route=/ variants. The source rotated 8 different User-Agent strings, including 9 requests impersonating Googlebot without verified bot classification. show less	Bad Web Bot Hacking
🇳🇱 45.148.10.120	14 hours ago	Attempted access to an exposed Git repository configuration file on ketovoila.pl. On 2026-10-21 a ... show more Attempted access to an exposed Git repository configuration file on ketovoila.pl. On 2026-10-21 at 21:56:53 UTC, the source sent an HTTP GET request to /.git/config, a sensitive file that may expose repository configuration and internal infrastructure details if accessible. show less	Web App Attack Hacking
🇳🇱 195.178.110.108	14 hours ago	Automated WordPress installation and REST API reconnaissance targeting ketovoila.pl. Cloudflare r ... show more Automated WordPress installation and REST API reconnaissance targeting ketovoila.pl. Cloudflare recorded 73 blocked HTTP GET events on 2026-10-22 between 09:09:15 and 09:40:03 UTC, across two scanning bursts. The activity covered 24 distinct URL/path-query combinations, including /wp-json/, /wordpress/wp-json/, /wp/wp-json/, /blog/wp-json/, /cms/?rest_route=/, /press/?rest_route=/ and /news/?rest_route=/. The source rotated 8 different User-Agent strings, including 10 requests claiming to be Googlebot/2.1. This was automated CMS discovery, not ordinary browsing. show less	Bad Web Bot Hacking
🇺🇸 108.175.8.9	14 hours ago	ketovoila.pl web app/PHP backdoor scan: hits=5; unique_paths=5; sample_paths=/file.php,/file17.php,/ ... show more ketovoila.pl web app/PHP backdoor scan: hits=5; unique_paths=5; sample_paths=/file.php,/file17.php,/file5.php; UA="Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36"; window=2026-10-22T10:18:01Z..2026-10-22T10:18:13Z HTTP methods: GET (5). show less	Bad Web Bot Web App Attack
🇺🇸 5.78.116.127	15 hours ago	ketovoila.pl web app/PHP backdoor scan: hits=2; unique_paths=2; sample_paths=/actuator,/api/actuator ... show more ketovoila.pl web app/PHP backdoor scan: hits=2; unique_paths=2; sample_paths=/actuator,/api/actuator; UA="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"; window=2026-10-22T09:20:25Z..2026-10-22T09:20:25Z HTTP methods: GET (2). show less	Bad Web Bot Web App Attack
🇮🇩 2001:df4:4400:402d:1043:aeff:fef8:a2ce	18 hours ago	ketovoila.pl web app secret/repository scan: hits=2; unique_paths=2; sample_paths=/.vscode/sftp.json ... show more ketovoila.pl web app secret/repository scan: hits=2; unique_paths=2; sample_paths=/.vscode/sftp.json; UA="Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0"; window=2026-10-22T06:23:53Z..2026-10-22T06:23:54Z HTTP methods: GET (2). show less	Bad Web Bot Web App Attack
🇳🇱 185.226.197.63	19 hours ago	Automated multi-product enterprise vulnerability reconnaissance. The source probed product-fingerpri ... show more Automated multi-product enterprise vulnerability reconnaissance. The source probed product-fingerprinting endpoints associated with multiple unrelated enterprise products, indicating coordinated technology fingerprinting and vulnerability discovery rather than legitimate browsing. Products: Adobe ColdFusion,ManageEngine family; attempts: 2; unique paths: 2; paths: /cf_scripts/scripts/ajax/ckeditor/ckeditor.js,/showLogin.cc; helper-path context: 1; unique User-Agents: 1; User-Agent: "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36"; time range: 2026-10-22T05:12:23Z - 2026-10-22T05:12:48Z. HTTP methods: GET (3). show less	Hacking Bad Web Bot Web App Attack
🇳🇱 185.226.197.65	19 hours ago	Automated multi-product enterprise vulnerability reconnaissance. The source probed product-fingerpri ... show more Automated multi-product enterprise vulnerability reconnaissance. The source probed product-fingerprinting endpoints associated with multiple unrelated enterprise products, indicating coordinated technology fingerprinting and vulnerability discovery rather than legitimate browsing. Products: CrushFTP,Telerik UI,Zabbix; attempts: 3; unique paths: 3; paths: /Telerik.Web.UI.WebResource.axd?type=rau,/WebInterface/,/zabbix/favicon.ico; helper-path context: 1; unique User-Agents: 1; User-Agent: "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36"; time range: 2026-10-22T05:12:40Z - 2026-10-22T05:12:59Z. HTTP methods: GET (4). show less	Hacking Bad Web Bot Web App Attack
🇳🇱 185.226.197.64	19 hours ago	Automated multi-product enterprise vulnerability reconnaissance. The source probed product-fingerpri ... show more Automated multi-product enterprise vulnerability reconnaissance. The source probed product-fingerprinting endpoints associated with multiple unrelated enterprise products, indicating coordinated technology fingerprinting and vulnerability discovery rather than legitimate browsing. Products: Metabase,QNAP QTS,Zimbra; attempts: 3; unique paths: 3; paths: /api/session/properties,/js/NewWindow_2_all.js,/cgi-bin/authLogin.cgi; helper-path context: 5; unique User-Agents: 1; User-Agent: "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36"; time range: 2026-10-22T05:12:21Z - 2026-10-22T05:12:42Z. HTTP methods: GET (9). show less	Hacking Bad Web Bot Web App Attack
🇳🇱 185.226.197.62	19 hours ago	Automated multi-product enterprise vulnerability reconnaissance. The source probed product-fingerpri ... show more Automated multi-product enterprise vulnerability reconnaissance. The source probed product-fingerprinting endpoints associated with multiple unrelated enterprise products, indicating coordinated technology fingerprinting and vulnerability discovery rather than legitimate browsing. Products: Apache Solr,IBM Aspera Faspex,Microsoft Exchange OWA,Sitecore,SugarCRM candidate; attempts: 5; unique paths: 5; paths: /solr/,/owa/,/sitecore/shell/sitecore.version.xml,/aspera/faspex/,/sugar_version.json; helper-path context: 3; unique User-Agents: 1; User-Agent: "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36"; time range: 2026-10-22T05:12:25Z - 2026-10-22T05:12:55Z. HTTP methods: GET (9). show less	Hacking Bad Web Bot Web App Attack
🇱🇹 62.60.130.117	20 hours ago	ketovoila.pl web app secret/repository scan: hits=2; unique_paths=2; sample_paths=/.vscode/sftp.json ... show more ketovoila.pl web app secret/repository scan: hits=2; unique_paths=2; sample_paths=/.vscode/sftp.json; UA="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36"; window=2026-10-22T04:47:40Z..2026-10-22T04:47:40Z HTTP methods: GET (2). show less	Bad Web Bot Web App Attack
🇰🇷 20.194.17.163	21 hours ago	ketovoila.pl web app secret/repository scan: hits=134; unique_paths=85; sample_paths=/db.php,/0.php, ... show more ketovoila.pl web app secret/repository scan: hits=134; unique_paths=85; sample_paths=/db.php,/0.php,/155.php; UA=""; window=2026-10-22T03:06:13Z..2026-10-22T03:06:14Z HTTP methods: GET (134). show less	Bad Web Bot Web App Attack
🇩🇪 64.89.161.160	23 hours ago	ketovoila.pl web app/PHP backdoor scan: hits=1; unique_paths=1; sample_paths=/wp-content/plugins/mm- ... show more ketovoila.pl web app/PHP backdoor scan: hits=1; unique_paths=1; sample_paths=/wp-content/plugins/mm-forms-community/includes/doajaxfileupload.php; UA="ALittle Client"; window=2026-10-22T01:50:43Z..2026-10-22T01:50:43Z HTTP methods: GET (1). show less	Bad Web Bot Web App Attack