AbuseIPDB

JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

User andreighitan joined AbuseIPDB in February 2026 and has reported 3,580 IP addresses.

Standing (weight) is good.

ACTIVE USER WEBMASTER SUPPORTER

IP	Date	Comment	Categories
🇦🇺 34.129.31.119	26 Jun 2026	Automated credential/webshell/config harvesting scanner targeting WordPress installations. Paths inc ... show more Automated credential/webshell/config harvesting scanner targeting WordPress installations. Paths include wp-config, .env, .git/config, credentials.json, and webshell uploads. Part of ongoing coordinated attack campaign active since April 2026. show less	Web App Attack
🇨🇱 34.176.90.51	26 Jun 2026	Automated credential/webshell/config harvesting scanner targeting WordPress installations. Paths inc ... show more Automated credential/webshell/config harvesting scanner targeting WordPress installations. Paths include wp-config, .env, .git/config, credentials.json, and webshell uploads. Part of ongoing coordinated attack campaign active since April 2026. show less	Web App Attack
🇺🇸 34.133.240.167	26 Jun 2026	Automated credential/webshell/config harvesting scanner targeting WordPress installations. Paths inc ... show more Automated credential/webshell/config harvesting scanner targeting WordPress installations. Paths include wp-config, .env, .git/config, credentials.json, and webshell uploads. Part of ongoing coordinated attack campaign active since April 2026. show less	Web App Attack
🇯🇵 35.243.73.90	26 Jun 2026	Automated credential/webshell/config harvesting scanner targeting WordPress installations. Paths inc ... show more Automated credential/webshell/config harvesting scanner targeting WordPress installations. Paths include wp-config, .env, .git/config, credentials.json, and webshell uploads. Part of ongoing coordinated attack campaign active since April 2026. show less	Web App Attack
🇺🇸 103.153.183.166	25 Jun 2026	Automated exploit scanner — credential harvesting (.env, wp-config, GitLab secrets, Drupal config), ... show more Automated exploit scanner — credential harvesting (.env, wp-config, GitLab secrets, Drupal config), webshell probing against WordPress hosting server. Sustained attack campaign since April 2026. show less	Web App Attack
🇯🇵 104.46.218.75	25 Jun 2026	Automated exploit scanner — credential harvesting (.env, wp-config, GitLab secrets, Drupal config), ... show more Automated exploit scanner — credential harvesting (.env, wp-config, GitLab secrets, Drupal config), webshell probing against WordPress hosting server. Sustained attack campaign since April 2026. show less	Web App Attack
🇯🇵 103.163.220.84	25 Jun 2026	Automated exploit scanner — credential harvesting (.env, wp-config, GitLab secrets, Drupal config), ... show more Automated exploit scanner — credential harvesting (.env, wp-config, GitLab secrets, Drupal config), webshell probing against WordPress hosting server. Sustained attack campaign since April 2026. show less	Web App Attack
🇸🇦 135.136.48.47	25 Jun 2026	Automated exploit scanner — credential harvesting (.env, wp-config, GitLab secrets, Drupal config), ... show more Automated exploit scanner — credential harvesting (.env, wp-config, GitLab secrets, Drupal config), webshell probing against WordPress hosting server. Sustained attack campaign since April 2026. show less	Web App Attack
🇫🇷 173.212.228.15	25 Jun 2026	Automated exploit scanner — credential harvesting (.env, wp-config, GitLab secrets, Drupal config), ... show more Automated exploit scanner — credential harvesting (.env, wp-config, GitLab secrets, Drupal config), webshell probing against WordPress hosting server. Sustained attack campaign since April 2026. show less	Web App Attack
🇫🇷 161.97.86.82	25 Jun 2026	Automated exploit scanner — credential harvesting (.env, wp-config, GitLab secrets, Drupal config), ... show more Automated exploit scanner — credential harvesting (.env, wp-config, GitLab secrets, Drupal config), webshell probing against WordPress hosting server. Sustained attack campaign since April 2026. show less	Web App Attack
🇬🇧 81.0.219.249	25 Jun 2026	Automated exploit scanner — credential harvesting (.env, wp-config, GitLab secrets, Drupal config), ... show more Automated exploit scanner — credential harvesting (.env, wp-config, GitLab secrets, Drupal config), webshell probing against WordPress hosting server. Sustained attack campaign since April 2026. show less	Web App Attack
🇩🇪 87.106.163.38	25 Jun 2026	Automated exploit scanner — credential harvesting (.env, wp-config, GitLab secrets, Drupal config), ... show more Automated exploit scanner — credential harvesting (.env, wp-config, GitLab secrets, Drupal config), webshell probing against WordPress hosting server. Sustained attack campaign since April 2026. show less	Web App Attack
🇷🇺 91.107.123.111	25 Jun 2026	Automated exploit scanner — credential harvesting (.env, wp-config, GitLab secrets, Drupal config), ... show more Automated exploit scanner — credential harvesting (.env, wp-config, GitLab secrets, Drupal config), webshell probing against WordPress hosting server. Sustained attack campaign since April 2026. show less	Web App Attack
🇫🇷 161.97.125.94	25 Jun 2026	Automated exploit scanner — credential harvesting (.env, wp-config, GitLab secrets, Drupal config), ... show more Automated exploit scanner — credential harvesting (.env, wp-config, GitLab secrets, Drupal config), webshell probing against WordPress hosting server. Sustained attack campaign since April 2026. show less	Web App Attack
🇯🇵 139.162.68.249	25 Jun 2026	Automated exploit scanner — credential harvesting (.env, wp-config, GitLab secrets, Drupal config), ... show more Automated exploit scanner — credential harvesting (.env, wp-config, GitLab secrets, Drupal config), webshell probing against WordPress hosting server. Sustained attack campaign since April 2026. show less	Web App Attack
🇫🇷 5.189.191.18	25 Jun 2026	Automated exploit scanner — credential harvesting (.env, wp-config, GitLab secrets, Drupal config), ... show more Automated exploit scanner — credential harvesting (.env, wp-config, GitLab secrets, Drupal config), webshell probing against WordPress hosting server. Sustained attack campaign since April 2026. show less	Web App Attack
🇬🇧 18.175.56.70	25 Jun 2026	Automated exploit scanner — credential harvesting (.env, wp-config, GitLab secrets, Drupal config), ... show more Automated exploit scanner — credential harvesting (.env, wp-config, GitLab secrets, Drupal config), webshell probing against WordPress hosting server. Sustained attack campaign since April 2026. show less	Web App Attack
🇻🇳 118.70.231.249	25 Jun 2026	Automated exploit scanner — credential harvesting (.env, wp-config, .yarnrc), PHPUnit RCE CVE-2017-9 ... show more Automated exploit scanner — credential harvesting (.env, wp-config, .yarnrc), PHPUnit RCE CVE-2017-9841, OpenWRT Luci RCE CVE-2023-1767, Hikvision probe against WordPress hosting server. Sustained attack campaign since April 2026. show less	Web App Attack
🇵🇱 212.127.90.201	25 Jun 2026	Automated exploit scanner — credential harvesting (.env, wp-config, .yarnrc), PHPUnit RCE CVE-2017-9 ... show more Automated exploit scanner — credential harvesting (.env, wp-config, .yarnrc), PHPUnit RCE CVE-2017-9841, OpenWRT Luci RCE CVE-2023-1767, Hikvision probe against WordPress hosting server. Sustained attack campaign since April 2026. show less	Web App Attack
🇸🇬 152.42.252.134	25 Jun 2026	Automated exploit scanner — credential harvesting (.env, wp-config, .yarnrc), PHPUnit RCE CVE-2017-9 ... show more Automated exploit scanner — credential harvesting (.env, wp-config, .yarnrc), PHPUnit RCE CVE-2017-9841, OpenWRT Luci RCE CVE-2023-1767, Hikvision probe against WordPress hosting server. Sustained attack campaign since April 2026. show less	Web App Attack
🇩🇪 31.76.29.145	25 Jun 2026	Automated exploit scanner — credential harvesting (.env, wp-config, .yarnrc), PHPUnit RCE CVE-2017-9 ... show more Automated exploit scanner — credential harvesting (.env, wp-config, .yarnrc), PHPUnit RCE CVE-2017-9841, OpenWRT Luci RCE CVE-2023-1767, Hikvision probe against WordPress hosting server. Sustained attack campaign since April 2026. show less	Web App Attack
🇫🇷 161.97.84.65	25 Jun 2026	Automated exploit scanner — credential harvesting (.env, wp-config, .yarnrc), PHPUnit RCE CVE-2017-9 ... show more Automated exploit scanner — credential harvesting (.env, wp-config, .yarnrc), PHPUnit RCE CVE-2017-9841, OpenWRT Luci RCE CVE-2023-1767, Hikvision probe against WordPress hosting server. Sustained attack campaign since April 2026. show less	Web App Attack
🇳🇱 5.61.209.43	25 Jun 2026	Automated exploit scanner — credential harvesting (.env, wp-config, .yarnrc), PHPUnit RCE CVE-2017-9 ... show more Automated exploit scanner — credential harvesting (.env, wp-config, .yarnrc), PHPUnit RCE CVE-2017-9841, OpenWRT Luci RCE CVE-2023-1767, Hikvision probe against WordPress hosting server. Sustained attack campaign since April 2026. show less	Web App Attack
🇩🇪 128.140.96.46	25 Jun 2026	Automated exploit scanner — credential harvesting (.env, wp-config, .yarnrc), PHPUnit RCE CVE-2017-9 ... show more Automated exploit scanner — credential harvesting (.env, wp-config, .yarnrc), PHPUnit RCE CVE-2017-9841, OpenWRT Luci RCE CVE-2023-1767, Hikvision probe against WordPress hosting server. Sustained attack campaign since April 2026. show less	Web App Attack
🇫🇷 5.189.154.54	25 Jun 2026	Automated exploit scanner — credential harvesting (.env, wp-config, .yarnrc), PHPUnit RCE CVE-2017-9 ... show more Automated exploit scanner — credential harvesting (.env, wp-config, .yarnrc), PHPUnit RCE CVE-2017-9841, OpenWRT Luci RCE CVE-2023-1767, Hikvision probe against WordPress hosting server. Sustained attack campaign since April 2026. show less	Web App Attack