AbuseIPDB

JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

User Betatester joined AbuseIPDB in October 2025 and has reported 760 IP addresses.

Standing (weight) is good.

INACTIVE USER

IP	Date	Comment	Categories
🇩🇪 157.230.19.140	15 Nov 2025	l9scan (leakix.net) performing same reconnaissance pattern as 165.227.173.41: WordPress REST users e ... show more l9scan (leakix.net) performing same reconnaissance pattern as 165.227.173.41: WordPress REST users endpoint, phpinfo, Laravel Telescope, config.json, Atlassian pom.properties, /.git/config, /.env, /.DS_Store, CouchDB _all_dbs, /login.action, /server-status, Exchange exporttool, Docker registry /v2/_catalog, debug pages, Swagger/OpenAPI docs and GraphQL endpoints. show less	Hacking Brute-Force
🇩🇪 164.92.244.132	15 Nov 2025	Another l9scan (leakix.net) host with the same comprehensive scanning pattern: probing WordPress RES ... show more Another l9scan (leakix.net) host with the same comprehensive scanning pattern: probing WordPress REST API, phpinfo, Laravel Telescope, config.json, Atlassian pom.properties, /.git/config, /.env, /.DS_Store, CouchDB _all_dbs, /login.action, /server-status, Exchange exporttool, Docker registry /v2/_catalog, Swagger/OpenAPI documentation, GraphQL endpoints and other debug interfaces. show less	Hacking Brute-Force
🇩🇪 165.227.173.41	15 Nov 2025	l9scan (leakix.net) client scanning for WordPress REST users endpoint, phpinfo, Laravel Telescope, c ... show more l9scan (leakix.net) client scanning for WordPress REST users endpoint, phpinfo, Laravel Telescope, config.json, Atlassian JIRA pom.properties, /.git/config, /.env, /.DS_Store, CouchDB _all_dbs, /login.action, /server-status, Exchange exporttool, Docker registry /v2/_catalog, multiple debug URLs, VSCode sftp.json, Spring Boot actuator/env, Vite env, Swagger/OpenAPI docs and GraphQL endpoints. Wide-spectrum reconnaissance for misconfigurations and exposed admin or API interfaces. show less	Hacking Brute-Force
🇺🇸 169.150.203.249	15 Nov 2025	Automated scanner sweeping for WordPress wlwmanifest.xml under numerous directory prefixes (/sito, / ... show more Automated scanner sweeping for WordPress wlwmanifest.xml under numerous directory prefixes (/sito, /cms, /site, /wp2, /media, /test, /wp1, /shop, /2019, /2018, /news, /wp, /website, /wordpress, /web, /blog), plus xmlrpc.php?rsd and /wp-includes/wlwmanifest.xml. Typical WordPress footprinting for later exploitation. show less	Hacking Brute-Force
🇧🇷 181.191.179.29	15 Nov 2025	Remote client issued POST request to /xmlrpc.php, which is commonly abused on WordPress sites for br ... show more Remote client issued POST request to /xmlrpc.php, which is commonly abused on WordPress sites for brute-force authentication and distributed attack coordination. Activity appears consistent with bot-driven probing for a vulnerable xmlrpc endpoint. show less	Hacking Brute-Force
🇩🇪 209.38.248.17	15 Nov 2025	l9scan (leakix.net) client performing broad reconnaissance similar to 165.227.173.41: WordPress REST ... show more l9scan (leakix.net) client performing broad reconnaissance similar to 165.227.173.41: WordPress REST users endpoint, phpinfo, Laravel Telescope, config.json, Atlassian pom.properties, /.git/config, /.env, /.DS_Store, CouchDB _all_dbs, /login.action, /server-status, Exchange exporttool, Docker registry /v2/_catalog, Swagger/OpenAPI documentation and GraphQL endpoints. show less	Hacking Brute-Force
🇺🇸 2a06:98c0:3600::103	15 Nov 2025	IPv6 host probing WordPress installer endpoints (/wp-admin/setup-config.php and /wordpress/wp-admin/ ... show more IPv6 host probing WordPress installer endpoints (/wp-admin/setup-config.php and /wordpress/wp-admin/setup-config.php) to detect fresh or misconfigured WordPress installations for potential takeover. show less	Hacking Brute-Force
🇺🇸 34.19.18.133	13 Nov 2025	Attempted access to /.git/config, commonly used in reconnaissance to extract Git repository configur ... show more Attempted access to /.git/config, commonly used in reconnaissance to extract Git repository configuration and potential credentials. show less	Hacking
🇺🇸 45.132.227.193	13 Nov 2025	Scanner attempted to retrieve /.env and related environment variable files, indicating credential ha ... show more Scanner attempted to retrieve /.env and related environment variable files, indicating credential harvesting, misconfiguration detection, or pre-exploitation reconnaissance. show less	Hacking Brute-Force
🇳🇱 45.148.10.246	13 Nov 2025	Go-http-client/1.1 aggressively probing Git metadata (.git/HEAD, .git/config, .git/refs/, .git/FETC ... show more Go-http-client/1.1 aggressively probing Git metadata (.git/HEAD, .git/config, .git/refs/, .git/FETCH_HEAD). High-confidence Git repository dump attempt. show less	Hacking
🇯🇵 54.95.8.194	13 Nov 2025	python-httpx/0.27.0 agent attempting to access /.git/config. This behavior matches typical Git repos ... show more python-httpx/0.27.0 agent attempting to access /.git/config. This behavior matches typical Git repository enumeration patterns. show less	Hacking
🇮🇳 139.59.32.114	13 Nov 2025	404 request to /wp-login.php intended to detect WordPress installations, often used as a pre-step fo ... show more 404 request to /wp-login.php intended to detect WordPress installations, often used as a pre-step for brute-forcing or plugin-based exploitation attempts. show less	Brute-Force
🇳🇱 195.178.110.201	13 Nov 2025	Automated Python aiohttp scanner requesting multiple sensitive paths including aws.config.js, config ... show more Automated Python aiohttp scanner requesting multiple sensitive paths including aws.config.js, config.js, .gitlab-ci.yml, several .env files, and .git/config. Strong indication of reconnaissance aimed at exposing configuration or secrets. show less	Hacking Brute-Force
🇺🇸 34.19.18.133	13 Nov 2025	Attempt to read Git config \| GET /.git/config -> 404 \| UA:	Hacking Bad Web Bot Web App Attack
🇺🇸 45.132.227.193	13 Nov 2025	Attempt to read environment file \| GET /.env -> 404 \| UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10. ... show more Attempt to read environment file \| GET /.env -> 404 \| UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0 show less	Hacking Bad Web Bot Web App Attack
🇳🇱 45.148.10.246	13 Nov 2025	Automated Git repository enumeration \| GET /.git/refs/remotes/origin/HEAD -> 404 \| UA: Go-http-clien ... show more Automated Git repository enumeration \| GET /.git/refs/remotes/origin/HEAD -> 404 \| UA: Go-http-client/1.1 show less	Hacking Bad Web Bot Web App Attack
🇯🇵 54.95.8.194	13 Nov 2025	Attempt to read Git config \| GET /.git/config -> 404 \| UA: python-httpx/0.27.0	Hacking Bad Web Bot Web App Attack
🇮🇳 139.59.32.114	13 Nov 2025	WordPress login probing \| GET /wp-login.php -> 404 \| UA: Mozilla/5.0	Hacking Bad Web Bot Web App Attack
🇳🇱 195.178.110.201	13 Nov 2025	Suspicious malformed GTM URL probe \| GET /%22https:/www.googletagmanager.com/gtag/js?id=G-NEWT20ME5G ... show more Suspicious malformed GTM URL probe \| GET /%22https:/www.googletagmanager.com/gtag/js?id=G-NEWT20ME5G%22 -> 404 \| UA: Python/3.10 aiohttp/3.13.1 show less	Hacking Bad Web Bot Web App Attack
🇳🇱 45.144.212.58	13 Nov 2025	Attempt to access /.git/config (source control exposure probe).	Port Scan Hacking Bad Web Bot Web App Attack
🇳🇱 45.148.10.246	13 Nov 2025	Extensive Git repository enumeration: /.git/refs/remotes/origin/HEAD, /.git/refs/heads/main, /.git/r ... show more Extensive Git repository enumeration: /.git/refs/remotes/origin/HEAD, /.git/refs/heads/main, /.git/refs/heads/master, /.git/info/exclude, /.git/logs/HEAD, /.git/ORIG_HEAD, /.git/HEAD, /.git/config. Clear attempt to retrieve repo data. show less	Port Scan Hacking Bad Web Bot Web App Attack
🇳🇱 93.123.109.7	13 Nov 2025	Probing for /.git/config (multiple times). Attempt to exfiltrate exposed Git repository metadata.	Port Scan Hacking Bad Web Bot Web App Attack
🇮🇳 103.138.237.18	13 Nov 2025	Environment file scanning: GET /env/.env, /api/.env, /.env using UA 'env-checker/1.0 (+local)'. Typi ... show more Environment file scanning: GET /env/.env, /api/.env, /.env using UA 'env-checker/1.0 (+local)'. Typical attempt to exfiltrate secrets from misconfigured servers. show less	Port Scan Hacking Bad Web Bot Web App Attack
🇺🇸 128.192.12.126	13 Nov 2025	UGAResearchAgent/1.0 requesting '/'. Non-human scanning activity resulting in 404. Reporting as unso ... show more UGAResearchAgent/1.0 requesting '/'. Non-human scanning activity resulting in 404. Reporting as unsolicited reconnaissance. show less	Port Scan Hacking Bad Web Bot Web App Attack
🇺🇸 134.209.43.100	13 Nov 2025	Repeated attempts to access /.git/config across multiple timestamps (also on Nov 12). Indicative of ... show more Repeated attempts to access /.git/config across multiple timestamps (also on Nov 12). Indicative of source leak probing. show less	Port Scan Hacking Bad Web Bot Web App Attack