AbuseIPDB

JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

User SKIPREPORTER joined AbuseIPDB in September 2025 and has reported 124 IP addresses.

Standing (weight) is good.

ACTIVE USER

IP	Date	Comment	Categories
🇺🇸 195.184.76.45	13 Apr 2026	Repeated probing of Joomla API endpoint /api/index.php/v1/config/application?public=true across mult ... show more Repeated probing of Joomla API endpoint /api/index.php/v1/config/application?public=true across multiple IPs. This endpoint is commonly targeted to detect exposed application configuration. Pattern indicates automated vulnerability scanning for misconfigured web applications. show less	Bad Web Bot Web App Attack Hacking
🇺🇸 195.184.76.253	13 Apr 2026	Repeated probing of Joomla API endpoint /api/index.php/v1/config/application?public=true across mult ... show more Repeated probing of Joomla API endpoint /api/index.php/v1/config/application?public=true across multiple IPs. This endpoint is commonly targeted to detect exposed application configuration. Pattern indicates automated vulnerability scanning for misconfigured web applications. show less	Bad Web Bot Web App Attack Hacking
🇺🇸 195.184.76.43	13 Apr 2026	Repeated probing of Joomla API endpoint /api/index.php/v1/config/application?public=true across mult ... show more Repeated probing of Joomla API endpoint /api/index.php/v1/config/application?public=true across multiple IPs. This endpoint is commonly targeted to detect exposed application configuration. Pattern indicates automated vulnerability scanning for misconfigured web applications. show less	Bad Web Bot Web App Attack Hacking
🇺🇸 195.184.76.42	13 Apr 2026	Repeated probing of Joomla API endpoint /api/index.php/v1/config/application?public=true across mult ... show more Repeated probing of Joomla API endpoint /api/index.php/v1/config/application?public=true across multiple IPs. This endpoint is commonly targeted to detect exposed application configuration. Pattern indicates automated vulnerability scanning for misconfigured web applications. show less	Bad Web Bot Web App Attack Hacking
🇺🇸 195.184.76.248	13 Apr 2026	Repeated probing of Joomla API endpoint /api/index.php/v1/config/application?public=true across mult ... show more Repeated probing of Joomla API endpoint /api/index.php/v1/config/application?public=true across multiple IPs. This endpoint is commonly targeted to detect exposed application configuration. Pattern indicates automated vulnerability scanning for misconfigured web applications. show less	Bad Web Bot Web App Attack Hacking
🇺🇸 195.184.76.254	13 Apr 2026	Repeated probing of Joomla API endpoint /api/index.php/v1/config/application?public=true across mult ... show more Repeated probing of Joomla API endpoint /api/index.php/v1/config/application?public=true across multiple IPs. This endpoint is commonly targeted to detect exposed application configuration. Pattern indicates automated vulnerability scanning for misconfigured web applications. show less	Bad Web Bot Web App Attack Hacking
🇺🇸 129.153.94.60	13 Apr 2026	Automated probing for authentication endpoints. Requests include /admin, /administrator/, /user/logi ... show more Automated probing for authentication endpoints. Requests include /admin, /administrator/, /user/login, /register following initial homepage access. Multiple inconsistent user agents (Android, iPhone, Linux, Mac) within seconds indicate spoofing. Pattern consistent with reconnaissance for CMS login panels. show less	Bad Web Bot Web App Attack Hacking
🇸🇬 213.35.119.176	13 Apr 2026	Automated probing for admin/login endpoints. Requests include /admin, /login, /user/login, /administ ... show more Automated probing for admin/login endpoints. Requests include /admin, /login, /user/login, /administrator/ and malformed path /-/-/-/-/-/-/-/-/-/-/. Multiple different user agents (Linux, iPad, Android) within seconds indicate UA spoofing. Pattern consistent with malicious scanning for authentication panels. show less	Bad Web Bot Web App Attack Hacking
🇳🇱 45.153.34.151	13 Apr 2026	Automated HTTP probing for sensitive files on website. Same source IP requested /docker-compose.yml, ... show more Automated HTTP probing for sensitive files on website. Same source IP requested /docker-compose.yml, /.env.bak, /db.php, /composer.json, and /settings.php within the same second. User-Agent strings varied across Windows/Mac/Linux Firefox 133 at identical timestamps, indicating likely spoofing/automation. This activity matches malicious reconnaissance for exposed configuration/secrets and web application probing. No legitimate access expected. show less	Bad Web Bot Web App Attack Hacking
🇺🇸 129.153.94.60	09 Apr 2026	Automated scanning activity detected. The IP performed rapid sequential requests targeting sensit ... show more Automated scanning activity detected. The IP performed rapid sequential requests targeting sensitive endpoints: - /admin - /administrator/ - /user/login - /register User-Agent strings were rotated between requests (Android, iPhone, Linux, Mac, iPad), indicating spoofing. Request frequency and behavior are consistent with automated vulnerability scanning and credential harvesting attempts. No legitimate browsing pattern observed. show less	Brute-Force Web App Attack
🇫🇷 91.196.152.255	08 Apr 2026	Automated probing for Joomla API configuration endpoint. Request to /api/index.php/v1/config/applica ... show more Automated probing for Joomla API configuration endpoint. Request to /api/index.php/v1/config/application?public=true on a non-Joomla site. Likely reconnaissance scanning for exposed configuration data. No legitimate user behavior. show less	Bad Web Bot Web App Attack Hacking
🇩🇪 45.135.193.131	08 Apr 2026	Automated malicious probing against website. Source IP 45.135.193.131 requested /backend/.env and us ... show more Automated malicious probing against website. Source IP 45.135.193.131 requested /backend/.env and used multiple spoofed Firefox 1.0.2 user-agent strings. This appears to be reconnaissance for exposed environment/config files and not legitimate browser traffic. show less	Bad Web Bot Web App Attack Hacking
🇪🇸 51.92.41.71	07 Apr 2026	Suspicious automated behavior targeting web application logic. Triggered a custom verification endpo ... show more Suspicious automated behavior targeting web application logic. Triggered a custom verification endpoint multiple times in rapid succession. show less	Bad Web Bot
🇺🇸 34.75.167.170	07 Apr 2026	Wordpress vulnerability scanning	Web App Attack
🇺🇸 44.248.33.252	07 Apr 2026	Automated probing detected against web application. Request details: - Method: GET - URI: /core ... show more Automated probing detected against web application. Request details: - Method: GET - URI: /core/install.php - User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36 Behavior indicates reconnaissance for exposed installation scripts or vulnerable endpoints. This path is not present on the server and is commonly targeted during automated scans. No legitimate user interaction expected for this endpoint. Action taken: - Request blocked (403/404) - Logged for monitoring and potential blacklist Assessment: Malicious or suspicious automated scanning activity. show less	Port Scan Web App Attack Hacking
🇺🇦 91.234.7.9	03 Apr 2026	Automated probe targeting sensitive configuration files. IP attempted to access: GET /.env.stagi ... show more Automated probe targeting sensitive configuration files. IP attempted to access: GET /.env.staging User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 This pattern is consistent with vulnerability scanning for exposed environment files (.env). Request was blocked. No successful access. show less	Port Scan Web App Attack Hacking
🇵🇱 74.248.113.81	01 Apr 2026	Get /wp-Blogs.php empty-ua Triggered WAF	Brute-Force Web App Attack Hacking
🇫🇷 185.249.227.3	28 Mar 2026	GET /wp-login.php / GET /wp-admin/index.php SERVER:HTTP_USER_AGENT = Mozilla/5.0 (WordPress CMS Scan ... show more GET /wp-login.php / GET /wp-admin/index.php SERVER:HTTP_USER_AGENT = Mozilla/5.0 (WordPress CMS Scanner)] WAF triggered show less	Brute-Force Web App Attack Hacking
🇺🇸 54.184.201.157	28 Mar 2026	Scanning login page + admin SERVER:HTTP_USER_AGENT = Mozilla/5.0 (WordPress CMS Scanner)] WAF trig ... show more Scanning login page + admin SERVER:HTTP_USER_AGENT = Mozilla/5.0 (WordPress CMS Scanner)] WAF triggered. show less	Brute-Force Web App Attack Hacking
🇩🇪 172.70.246.206	19 Mar 2026	Automated probe attempting to access /config/.env to retrieve sensitive credentials. Likely vulnera ... show more Automated probe attempting to access /config/.env to retrieve sensitive credentials. Likely vulnerability scanning activity. show less	Port Scan Hacking
🇺🇸 44.249.28.9	17 Mar 2026	UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrom ... show more UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36 URI: /core/install.php Trigger WAF. show less	Port Scan Bad Web Bot Hacking
🇫🇷 185.249.227.3	15 Mar 2026	Automated WordPress reconnaissance. Requests to /wp-login.php and /wp-admin/index.php using user ag ... show more Automated WordPress reconnaissance. Requests to /wp-login.php and /wp-admin/index.php using user agent "WordPress CMS Scanner". Clearly malicious enumeration of admin endpoints for potential brute force or vulnerability exploitation. Traffic blocked by security system. show less	Brute-Force Exploited Host Hacking
🇳🇱 45.148.10.62	15 Mar 2026	Automated exploit scanning against WordPress front controller. Repeated POST requests to /index.php ... show more Automated exploit scanning against WordPress front controller. Repeated POST requests to /index.php containing random parameter names and binary payloads with NULL bytes (0x00). Payload appears fuzzed/malformed, consistent with vulnerability probing tools. No legitimate application behavior would generate this traffic. Requests were blocked by WAF. show less	Port Scan Exploited Host Hacking
🇬🇧 35.177.244.162	07 Mar 2026	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Sa ... show more Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 WAF TRIGGERED show less	Bad Web Bot
🇺🇸 35.161.55.60	07 Mar 2026	UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/13 ... show more UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 ANTI BOT SYSTEM TRIGGERED show less	Web App Attack