AbuseIPDB

JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

User GAS joined AbuseIPDB in April 2019 and has reported 213,793 IP addresses.

Standing (weight) is good.

ACTIVE USER WEBMASTER SUPPORTER

IP	Date	Comment	Categories
🇲🇾 202.165.25.8	06 Nov 2026	SSH authentication brute-force attempt against GAS85/ssh-auth-logger honeypot from 202.165.25.8; use ... show more SSH authentication brute-force attempt against GAS85/ssh-auth-logger honeypot from 202.165.25.8; usernames=["ubuntu"]; passwords sha1 prefix=["2072c804" "e33de700" "f28058e8" "5130ea85" "ccc01419" "1113eb02" "f21c4700" "93ec71b2" "94dfa6e8" "7faf2dde"] show less	Brute-Force SSH
🇵🇱 45.138.12.51	06 Nov 2026	Direct IP access. 45.138.12.51 - - [06/Nov/2026:15:49:03 +0100] "GET / HTTP/1.1" 400 2354 "-" "-" "" ... show more Direct IP access. 45.138.12.51 - - [06/Nov/2026:15:49:03 +0100] "GET / HTTP/1.1" 400 2354 "-" "-" "" "-" 45.138.12.51 - - [06/Nov/2026:15:49:04 +0100] "GET / HTTP/1.1" 402 4895 "-" "l9tcpid/v1.1.0" "REDACTED" "" ... show less	Port Scan Web App Attack
🇵🇰 103.66.148.216	06 Nov 2026	Telnet authentication brute-force attempt against GAS85/ssh-auth-logger honeypot from 103.66.148.216 ... show more Telnet authentication brute-force attempt against GAS85/ssh-auth-logger honeypot from 103.66.148.216; usernames=["cunmgadmin" "tech" "admin" "root" "localadmin" "draytek" "TMAR#DLKT20060205"]; passwords sha1 prefix=["590eeb8a" "c95ee476" "f04a138b" "7505d64a" "63ccc2bf" "7110eda4" "dc76e9f0" "39ef9aae" "1aaf6bcc" "1b10fe8c"] show less	Port Scan Brute-Force IoT Targeted
🇷🇺 45.91.64.10	06 Nov 2026	Direct IP access. 45.91.64.10 - - [06/Nov/2026:14:44:16 +0100] "GET / HTTP/1.0" 400 651 "-" "-" "-" ... show more Direct IP access. 45.91.64.10 - - [06/Nov/2026:14:44:16 +0100] "GET / HTTP/1.0" 400 651 "-" "-" "-" "-" 45.91.64.10 - - [06/Nov/2026:14:44:16 +0100] "GET /aaa9 HTTP/1.1" 402 4857 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36" "REDACTED:443" "" ... show less	Port Scan Web App Attack
🇦🇲 176.32.193.16	06 Nov 2026	Direct IP access. 176.32.193.16 - - [06/Nov/2026:14:43:26 +0100] "GET / HTTP/1.0" 400 651 "-" "-" "- ... show more Direct IP access. 176.32.193.16 - - [06/Nov/2026:14:43:26 +0100] "GET / HTTP/1.0" 400 651 "-" "-" "-" "-" 176.32.193.16 - - [06/Nov/2026:14:44:16 +0100] "GET / HTTP/1.0" 400 651 "-" "-" "-" "-" ... show less	Port Scan Web App Attack
🇩🇪 151.243.11.201	06 Nov 2026	Direct IP access. 151.243.11.201 - - [06/Nov/2026:14:43:51 +0100] "CONNECT youshouldvecomeover.lol:4 ... show more Direct IP access. 151.243.11.201 - - [06/Nov/2026:14:43:51 +0100] "CONNECT youshouldvecomeover.lol:443 HTTP/1.1" 402 818 "-" "-" "youshouldvecomeover.lol:443" "" 151.243.11.201 - - [06/Nov/2026:14:43:51 +0100] "CONNECT youshouldvecomeover.lol:443 HTTP/1.1" 402 818 "-" "-" "youshouldvecomeover.lol:443" "" ... show less	Port Scan Web App Attack
🇺🇸 138.197.41.30	06 Nov 2026	Bad Bot. 138.197.41.30 - - [06/Nov/2026:14:26:03 +0100] "GET /.git/config HTTP/1.1" 402 2793 "-" "Mo ... show more Bad Bot. 138.197.41.30 - - [06/Nov/2026:14:26:03 +0100] "GET /.git/config HTTP/1.1" 402 2793 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36" "REDACTED" "" ... show less	Bad Web Bot Web App Attack
🇵🇱 195.3.221.149	06 Nov 2026	Direct IP access. 195.3.221.149 - - [06/Nov/2026:14:20:53 +0100] "GET / HTTP/1.1" 402 2737 "-" "-" " ... show more Direct IP access. 195.3.221.149 - - [06/Nov/2026:14:20:53 +0100] "GET / HTTP/1.1" 402 2737 "-" "-" "REDACTED" "" 195.3.221.149 - - [06/Nov/2026:14:20:55 +0100] "GET /login.htm HTTP/1.1" 402 2731 "-" "-" "REDACTED" "" ... show less	Port Scan Web App Attack
🇺🇸 45.156.129.60	06 Nov 2026	Direct IP access. 45.156.129.60 - - [06/Nov/2026:13:59:49 +0100] "GET / HTTP/1.1" 402 4889 "-" "Mozi ... show more Direct IP access. 45.156.129.60 - - [06/Nov/2026:13:59:49 +0100] "GET / HTTP/1.1" 402 4889 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36" "REDACTED" "" 45.156.129.60 - - [06/Nov/2026:13:59:54 +0100] "POST /mcp HTTP/2.0" 402 2669 "-" "python-httpx/0.28.1" "REDACTED" "" ... show less	Port Scan Web App Attack
🇷🇺 91.234.62.222	06 Nov 2026	Telnet authentication brute-force attempt against GAS85/ssh-auth-logger honeypot from 91.234.62.222; ... show more Telnet authentication brute-force attempt against GAS85/ssh-auth-logger honeypot from 91.234.62.222; usernames=["admin" "root" "e8ehome1"]; passwords sha1 prefix=["cab524d4" "f8a79f21" "b82dd601" "5cb6a0d0" "72fee339" "404865ca" "7110eda4" "a9440e0b" "7505d64a" "f7c3bc1d"] show less	Port Scan Brute-Force IoT Targeted
🇲🇾 202.165.25.8	06 Nov 2026	SSH authentication brute-force attempt against GAS85/ssh-auth-logger honeypot from 202.165.25.8; use ... show more SSH authentication brute-force attempt against GAS85/ssh-auth-logger honeypot from 202.165.25.8; usernames=["ubuntu"]; passwords sha1 prefix=["bbd365ce" "3b8db1b1" "2918cdd2" "aa372c6b" "9ad92c6b" "0e09a744" "1964bb8a" "732e9dae" "feb1d023" "d2f2809f"] show less	Brute-Force SSH
🇰🇷 43.108.120.121	06 Nov 2026	Direct IP access. 43.108.120.121 - - [06/Nov/2026:13:09:44 +0100] "POST /cgi-bin/.%2e/.%2e/.%2e/.%2e ... show more Direct IP access. 43.108.120.121 - - [06/Nov/2026:13:09:44 +0100] "POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh HTTP/1.1" 400 2354 "-" "libredtail-http" "REDACTED:443" "-" 43.108.120.121 - - [06/Nov/2026:13:09:49 +0100] "POST /cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh HTTP/1.1" 400 2354 "-" "libredtail-http" "REDACTED:443" "-" ... show less	Port Scan Web App Attack
🇳🇱 195.178.110.217	06 Nov 2026	SSH aggressive port ping. {"destinationServicename":"sshd","dpt":"2222","dst":"REDACTED.2","level":" ... show more SSH aggressive port ping. {"destinationServicename":"sshd","dpt":"2222","dst":"REDACTED.2","level":"info","msg":"SSH connection","product":"ssh-auth-logger","spt":"44818","src":"195.178.110.217","time":"2026-11-06T10:00:47Z"} {"abuseConfidenceScore":100,"countryCode":"NL","destinationServicename":"sshd","dpt":"2222","dst":"REDACTED.2","level":"info","msg":"SSH connection","product":"ssh-auth-logger","spt":"49406","src":"195.178.110.217","time":"2026-11-06T10:10:45Z","totalReports":18283} {"abuseConfidenceScore":100,"countryCode":"NL","destinationServicename":"sshd","dpt":"2222","dst":"REDACTED.2","level":"info","msg":"SSH connection","product":"ssh-auth-logger","spt":"52504","src":"195.178.110.217","time":"2026-11-06T10:12:23Z","totalReports":18283} {"abuseConfidenceScore":100,"countryCode":"NL","destinationServicename":"sshd","dpt":"2222","dst":"REDACTED.2","level":"info","msg":"SSH connection","product":"ssh-auth-logger","spt":"55604","src":"195.178.110.217","time":"2026-11-06T10:14:00Z","totalReports": ... show less	Brute-Force Port Scan
🇳🇱 195.178.110.217	06 Nov 2026	SSH authentication brute-force attempt against GAS85/ssh-auth-logger honeypot from 195.178.110.217; ... show more SSH authentication brute-force attempt against GAS85/ssh-auth-logger honeypot from 195.178.110.217; usernames=["root"]; passwords sha1 prefix=["40bd0015" "4d9012b4" "7110eda4" "8cb2237d" "7c4a8d09" "20eabe5d" "7c222fb2" "f7c3bc1d" "e7d537e1" "4be30d98"] show less	Brute-Force SSH
🇺🇸 66.132.195.46	06 Nov 2026	Direct IP access. 66.132.195.46 - - [06/Nov/2026:10:56:17 +0100] "\x16\x03\x01\x05\xba\x01" 400 392 ... show more Direct IP access. 66.132.195.46 - - [06/Nov/2026:10:56:17 +0100] "\x16\x03\x01\x05\xba\x01" 400 392 "-" "-" "-" "-" 66.132.195.46 - - [06/Nov/2026:10:56:22 +0100] "GET / HTTP/1.1" 402 2777 "-" "Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)" "REDACTED" "" ... show less	Port Scan Web App Attack
🇯🇵 8.216.3.19	06 Nov 2026	Direct IP access. 8.216.3.19 - - [06/Nov/2026:09:40:08 +0100] "GET / HTTP/1.1" 402 4860 "-" "curl/7. ... show more Direct IP access. 8.216.3.19 - - [06/Nov/2026:09:40:08 +0100] "GET / HTTP/1.1" 402 4860 "-" "curl/7.64.1" "REDACTED:443" "" 8.216.3.19 - - [06/Nov/2026:09:40:10 +0100] "GET / HTTP/2.0" 402 1093 "-" "curl/7.74.0" "REDACTED:443" "" ... show less	Port Scan Web App Attack
🇺🇸 47.251.184.15	06 Nov 2026	Direct IP access. 47.251.184.15 - - [06/Nov/2026:09:39:43 +0100] "\x16\x03\x01" 400 392 "-" "-" "-" ... show more Direct IP access. 47.251.184.15 - - [06/Nov/2026:09:39:43 +0100] "\x16\x03\x01" 400 392 "-" "-" "-" "-" 47.251.184.15 - - [06/Nov/2026:09:39:43 +0100] "GET / HTTP/1.1" 402 818 "-" "curl/7.74.0" "REDACTED:80" "" ... show less	Port Scan Web App Attack
🇳🇱 45.74.28.238	06 Nov 2026	Direct IP access. 45.74.28.238 - - [06/Nov/2026:08:59:31 +0100] "\x16\x03\x01\x05\xc6\x01" 400 392 " ... show more Direct IP access. 45.74.28.238 - - [06/Nov/2026:08:59:31 +0100] "\x16\x03\x01\x05\xc6\x01" 400 392 "-" "-" "-" "-" 45.74.28.238 - - [06/Nov/2026:08:59:32 +0100] "GET / HTTP/1.1" 402 818 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" "REDACTED:80" "" ... show less	Port Scan Web App Attack
🇺🇸 66.132.172.193	06 Nov 2026	Direct IP access. 66.132.172.193 - - [06/Nov/2026:08:47:45 +0100] "GET / HTTP/1.1" 402 4872 "-" "Moz ... show more Direct IP access. 66.132.172.193 - - [06/Nov/2026:08:47:45 +0100] "GET / HTTP/1.1" 402 4872 "-" "Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)" "REDACTED" "" 66.132.172.193 - - [06/Nov/2026:08:49:09 +0100] "GET /sitemap.xml HTTP/1.1" 402 4878 "-" "Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)" "REDACTED" "" ... show less	Port Scan Web App Attack
🇵🇰 103.26.86.81	06 Nov 2026	Telnet authentication brute-force attempt against GAS85/ssh-auth-logger honeypot from 103.26.86.81; ... show more Telnet authentication brute-force attempt against GAS85/ssh-auth-logger honeypot from 103.26.86.81; usernames=["supervisor" "root" "admin" "ubnt" "support"]; passwords sha1 prefix=["b69413e4" "dc76e9f0" "a762554c" "b5e701c9" "e1915c29" "d033e22a" "7110eda4" "cf21d858" "162aab82"] show less	Port Scan Brute-Force IoT Targeted
🇻🇳 171.243.149.187	06 Nov 2026	SSH authentication brute-force attempt against GAS85/ssh-auth-logger honeypot from 171.243.149.187; ... show more SSH authentication brute-force attempt against GAS85/ssh-auth-logger honeypot from 171.243.149.187; usernames=["admin" "test" "ubnt" "root" "support" "system"]; passwords sha1 prefix=["7c4a8d09" "a94a8fe5" "7110eda4" "f865b536" "39aeb928" "b5e701c9" "d033e22a" "dc76e9f0" "5bdcd3c0" "e7613c1a"] show less	Brute-Force SSH
🇸🇬 152.42.200.153	06 Nov 2026	Telnet authentication brute-force attempt against GAS85/ssh-auth-logger honeypot from 152.42.200.153 ... show more Telnet authentication brute-force attempt against GAS85/ssh-auth-logger honeypot from 152.42.200.153; usernames=["root" "admin" "user" "telnet"]; passwords sha1 prefix=["dc76e9f0" "0da3f8fe" "d033e22a" "12dea96f" "6ebf2197" "22e9f568" "cc7ef1dd" "5baa61e4"] show less	Port Scan Brute-Force IoT Targeted
🇧🇪 35.210.39.113	06 Nov 2026	Direct IP access. 35.210.39.113 - - [06/Nov/2026:08:13:45 +0100] "OPTIONS / HTTP/1.1" 402 4403 "-" " ... show more Direct IP access. 35.210.39.113 - - [06/Nov/2026:08:13:45 +0100] "OPTIONS / HTTP/1.1" 402 4403 "-" "Mozilla/5.0 (compatible)" "REDACTED" "" 35.210.39.113 - - [06/Nov/2026:08:13:45 +0100] "GET / HTTP/1.1" 402 4891 "-" "Mozilla/5.0 (compatible; nmap-http-info)" "REDACTED" "" ... show less	Port Scan Web App Attack
🇵🇱 95.214.53.196	06 Nov 2026	Direct IP access. 95.214.53.196 - - [06/Nov/2026:08:10:25 +0100] "GET / HTTP/1.0" 400 651 "-" "-" "- ... show more Direct IP access. 95.214.53.196 - - [06/Nov/2026:08:10:25 +0100] "GET / HTTP/1.0" 400 651 "-" "-" "-" "-" 95.214.53.196 - - [06/Nov/2026:08:10:25 +0100] "GET / HTTP/1.0" 400 651 "-" "-" "-" "-" ... show less	Port Scan Web App Attack
🇳🇱 138.226.239.5	06 Nov 2026	Direct IP access. 138.226.239.5 - - [06/Nov/2026:08:06:43 +0100] "GET / HTTP/1.0" 400 651 "-" "-" "- ... show more Direct IP access. 138.226.239.5 - - [06/Nov/2026:08:06:43 +0100] "GET / HTTP/1.0" 400 651 "-" "-" "-" "-" 138.226.239.5 - - [06/Nov/2026:08:06:44 +0100] "GET /global-protect/login.esp HTTP/1.0" 402 4537 "https://www.google.com" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36" "REDACTED" "" ... show less	Port Scan Web App Attack