SKIPREPORTER - AbuseIPDB User Profile

JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

User SKIPREPORTER joined AbuseIPDB in September 2025 and has reported 118 IP addresses.

Standing (weight) is good.

ACTIVE USER

IP	Date	Comment	Categories
🇩🇪 193.148.56.6	09 Jul 2026	Trigger WAF. Endpoint wpadmin	Hacking Exploited Host Web App Attack
🇫🇮 34.88.231.255	04 Jul 2026	Multiple WAF triggered	Hacking Exploited Host Web App Attack
🇩🇪 2a03:4000:a:c58:c49d:ecff:fe8b:771e	04 Jul 2026	Scanning for potential entry point. Triggered WAF	Port Scan Bad Web Bot Web App Attack
🇳🇱 195.178.110.104	22 Jun 2026	Automated HTTP vulnerability scanner sent more than 120 malicious requests attempting to retrieve ex ... show more Automated HTTP vulnerability scanner sent more than 120 malicious requests attempting to retrieve exposed credentials, private SSH keys, configuration files and database backups. Requested paths included /.env, /.env.production, /.env.backup, /id_rsa, /.ssh/id_rsa.pem, /database.sql, /backup.sql.gz, /phpinfo.php, /config/database.yml and /composer.json. The scanner also used /./ path-normalisation variants in apparent attempts to bypass URL filtering. Requests were detected and blocked as hostile-path activity. Earliest observation: 2026-06-22 02:09:26 Europe show less	Hacking Bad Web Bot Web App Attack
🇺🇸 45.45.237.171	21 Jun 2026	Multiple WAF triggers. Using different AI agent (OpenAI, deepseek, Gemini)	Brute-Force Exploited Host Web App Attack
🇺🇸 72.154.155.130	16 Jun 2026	Brute force. Mod_Security triggered	Hacking Brute-Force Exploited Host
🇺🇸 54.234.161.168	05 Jun 2026	Repeated malicious POST requests to /index.php targeting a WordPress site. Payload contained URL-enc ... show more Repeated malicious POST requests to /index.php targeting a WordPress site. Payload contained URL-encoded binary garbage including NULL byte characters (%00), triggering firewall rule: "ASCII character 0x00 (NULL byte)" in POST data. Request was blocked as CRITICAL by WAF. No legitimate user-agent behavior observed; appears to be automated exploit/scanner traffic. show less	Hacking Web App Attack
🇺🇸 157.254.221.199	02 Jun 2026	Malicious scanner probing for exposed configuration/secrets files. The same IP requested suspicio ... show more Malicious scanner probing for exposed configuration/secrets files. The same IP requested suspicious sensitive paths within seconds while rotating fake crawler user agents: * `/application.yml` * `/secrets.yml` User agents used: * `Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot` * `Mozilla/5.0 (compatible; Applebot/0.1; +http://www.apple.com/go/applebot)` The bot identity was not verified and appears spoofed. This looks like automated reconnaissance for leaked YAML configuration files, secrets, credentials, or application settings. show less	Web Spam Hacking Bad Web Bot
🇬🇧 217.194.215.46	03 May 2026	Automated scan. WAF triggered	Port Scan Bad Web Bot Web App Attack
🇺🇸 107.175.32.196	03 May 2026	Automated web application attack / sensitive file probing. The IP requested /.env.production, a high ... show more Automated web application attack / sensitive file probing. The IP requested /.env.production, a high-risk environment configuration file path commonly targeted to steal production secrets such as database credentials, API keys, SMTP passwords, tokens, and app keys. This was not legitimate visitor traffic. Request was blocked by WAF show less	Port Scan Hacking Web App Attack
🇳🇱 2a0b:8bc0:2:807c::1	03 May 2026	Automated web application scan / probing for exposed environment files. The IP requested /.env.local ... show more Automated web application scan / probing for exposed environment files. The IP requested /.env.local, a high-risk sensitive configuration file path commonly targeted to steal secrets such as database credentials, API keys, SMTP passwords, and application tokens. This was not normal user traffic. Request was blocked by WAF show less	Port Scan Hacking Web App Attack
🇬🇧 217.194.215.46	02 May 2026	Scanning endpoints as well as critical entry points. WAF triggered.	Hacking Bad Web Bot Web App Attack
🇺🇸 44.248.33.252	21 Apr 2026	Repetitive WAF violation	Hacking Bad Web Bot Web App Attack
🇳🇱 195.178.110.104	21 Apr 2026	Multiple WAF violation	Hacking Bad Web Bot
🇺🇸 103.168.66.141	21 Apr 2026	Multiples WAF violations	Hacking Bad Web Bot Web App Attack
🇺🇸 103.215.74.213	21 Apr 2026	Multiple WAF Violations	Hacking Exploited Host Web App Attack
🇺🇸 195.184.76.40	13 Apr 2026	Repeated probing of Joomla API endpoint /api/index.php/v1/config/application?public=true. This endpo ... show more Repeated probing of Joomla API endpoint /api/index.php/v1/config/application?public=true. This endpoint is commonly targeted to detect exposed application configuration. Pattern matches automated vulnerability scanning across multiple IPs. show less	Hacking Bad Web Bot Web App Attack
🇺🇸 195.184.76.44	13 Apr 2026	Repeated probing of Joomla API endpoint /api/index.php/v1/config/application?public=true. This endpo ... show more Repeated probing of Joomla API endpoint /api/index.php/v1/config/application?public=true. This endpoint is commonly targeted to detect exposed application configuration. Pattern matches automated vulnerability scanning across multiple IPs. show less	Hacking Bad Web Bot Web App Attack
🇺🇸 158.101.15.41	13 Apr 2026	Automated probing for authentication endpoints. Requests include /admin, /login, /register, /user/lo ... show more Automated probing for authentication endpoints. Requests include /admin, /login, /register, /user/login, /administrator/. Multiple inconsistent user agents (Android, iPhone, iPad, Linux, Mac) within seconds indicate spoofing. Pattern consistent with automated scanning for exposed login panels. show less	Hacking Bad Web Bot Web App Attack
🇺🇸 195.184.76.45	13 Apr 2026	Repeated probing of Joomla API endpoint /api/index.php/v1/config/application?public=true across mult ... show more Repeated probing of Joomla API endpoint /api/index.php/v1/config/application?public=true across multiple IPs. This endpoint is commonly targeted to detect exposed application configuration. Pattern indicates automated vulnerability scanning for misconfigured web applications. show less	Hacking Bad Web Bot Web App Attack
🇺🇸 195.184.76.253	13 Apr 2026	Repeated probing of Joomla API endpoint /api/index.php/v1/config/application?public=true across mult ... show more Repeated probing of Joomla API endpoint /api/index.php/v1/config/application?public=true across multiple IPs. This endpoint is commonly targeted to detect exposed application configuration. Pattern indicates automated vulnerability scanning for misconfigured web applications. show less	Hacking Bad Web Bot Web App Attack
🇺🇸 195.184.76.43	13 Apr 2026	Repeated probing of Joomla API endpoint /api/index.php/v1/config/application?public=true across mult ... show more Repeated probing of Joomla API endpoint /api/index.php/v1/config/application?public=true across multiple IPs. This endpoint is commonly targeted to detect exposed application configuration. Pattern indicates automated vulnerability scanning for misconfigured web applications. show less	Hacking Bad Web Bot Web App Attack
🇺🇸 195.184.76.42	13 Apr 2026	Repeated probing of Joomla API endpoint /api/index.php/v1/config/application?public=true across mult ... show more Repeated probing of Joomla API endpoint /api/index.php/v1/config/application?public=true across multiple IPs. This endpoint is commonly targeted to detect exposed application configuration. Pattern indicates automated vulnerability scanning for misconfigured web applications. show less	Hacking Bad Web Bot Web App Attack
🇺🇸 195.184.76.248	13 Apr 2026	Repeated probing of Joomla API endpoint /api/index.php/v1/config/application?public=true across mult ... show more Repeated probing of Joomla API endpoint /api/index.php/v1/config/application?public=true across multiple IPs. This endpoint is commonly targeted to detect exposed application configuration. Pattern indicates automated vulnerability scanning for misconfigured web applications. show less	Hacking Bad Web Bot Web App Attack
🇺🇸 195.184.76.254	13 Apr 2026	Repeated probing of Joomla API endpoint /api/index.php/v1/config/application?public=true across mult ... show more Repeated probing of Joomla API endpoint /api/index.php/v1/config/application?public=true across multiple IPs. This endpoint is commonly targeted to detect exposed application configuration. Pattern indicates automated vulnerability scanning for misconfigured web applications. show less	Hacking Bad Web Bot Web App Attack