AbuseIPDB

JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

User wasuma joined AbuseIPDB in April 2026 and has reported 667 IP addresses.

Standing (weight) is good.

INACTIVE USER

IP	Date	Comment	Categories
🇳🇱 176.65.139.183	18 Jun 2026	Honeypot hit: \| SSH brute-force (2 successful logins) \| commands run: uname -s -v -n -r -m	Brute-Force Port Scan SSH
🇧🇪 34.38.56.242	18 Jun 2026	Honeypot hit: \| SSH brute-force (3 successful logins) \| commands run: User-Agent: Mozilla/5.0 (Windo ... show more Honeypot hit: \| SSH brute-force (3 successful logins) \| commands run: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36; Accept-Encoding: gzip; show less	Brute-Force Port Scan SSH
🇨🇳 223.85.251.55	18 Jun 2026	Honeypot hit: \| SSH brute-force (1 successful logins)	Brute-Force Port Scan SSH
🇺🇸 184.105.247.196	18 Jun 2026	Honeypot hit: \| SSH brute-force (1 successful logins) \| commands run: User-Agent: Mozilla/5.0 (Windo ... show more Honeypot hit: \| SSH brute-force (1 successful logins) \| commands run: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko/20100101 Firefox/136.0; Accept: /; Accept-Encoding: gzip show less	Brute-Force Port Scan SSH
🇧🇪 35.187.42.94	18 Jun 2026	Honeypot hit: \| SSH brute-force (3 successful logins) \| commands run: User-Agent: Mozilla/5.0 (Windo ... show more Honeypot hit: \| SSH brute-force (3 successful logins) \| commands run: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36; Accept-Encoding: gzip; show less	Brute-Force Port Scan SSH
🇪🇸 212.227.235.203	18 Jun 2026	Honeypot hit: \| SSH brute-force (1 successful logins)	Brute-Force Port Scan SSH
🇧🇪 34.156.50.136	18 Jun 2026	Honeypot hit: \| SSH brute-force (3 successful logins) \| commands run: User-Agent: Mozilla/5.0 (Windo ... show more Honeypot hit: \| SSH brute-force (3 successful logins) \| commands run: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36; Accept-Encoding: gzip; show less	Brute-Force Port Scan SSH
🇳🇱 192.109.200.204	18 Jun 2026	Honeypot hit: \| SSH brute-force (1 successful logins) \| commands run: echo SHELL_TEST; /bin/busybox ... show more Honeypot hit: \| SSH brute-force (1 successful logins) \| commands run: echo SHELL_TEST; /bin/busybox TEST; cat /proc show less	Brute-Force Port Scan SSH
🇳🇱 91.92.40.13	18 Jun 2026	Honeypot hit: \| SSH brute-force (14 successful logins) \| commands run: export PATH=/usr/local/sbin:/ ... show more Honeypot hit: \| SSH brute-force (14 successful logins) \| commands run: export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null); arch=$(uname -m 2>/dev/null); uptime=$(cat /proc/uptime 2>/dev/null \| cut -d. -f1); cpus=$( (nproc 2>/dev/null \|\| /usr/bin/nproc 2>/dev/null \|\| grep -c "^processor" /proc/cpuinfo 2>/dev/null) \| head -1); cpu_model=$( (grep -m1 -E "model name\|Hardware" /proc/cpuinfo \| cut -d: -f2- \| sed 's/^ //;s/ $//' ; lscpu 2>/dev/null \| awk -F: '/Model name/ {gsub(/^ +\| +$/,"",$2); print $2; exit}' ; dmidecode -s processor-version 2>/dev/null \| head -n1 ; uname -p 2>/dev/null) \| awk 'NF{print; exit}' ); gpu_info=$( (lspci 2>/dev/null \| grep -i vga; lspci 2>/dev/null \| grep -i nvidia) 2>/dev/null \| head -n50); cat_help=$( (cat --help 2>&1 \| tr '\n' ' ') \|\| cat --help 2>&1); ls_help=$( (ls --help 2>&1 \| tr '\n' ' ') \|\| ls --help 2>&1); last_output=$(last 2>/dev/null \| head -n 10); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$u show less	Brute-Force Port Scan SSH
🇨🇳 111.35.7.46	18 Jun 2026	Honeypot hit: \| SSH brute-force (1 successful logins) \| commands run: uname -s -m	Brute-Force Port Scan SSH
🇩🇪 130.12.180.51	18 Jun 2026	Honeypot hit: \| SSH brute-force (2 successful logins)	Brute-Force Port Scan SSH
🇺🇸 91.209.228.154	18 Jun 2026	Honeypot hit: \| SSH brute-force (1 successful logins)	Brute-Force Port Scan SSH
🇧🇪 35.205.166.70	18 Jun 2026	Honeypot hit: \| SSH brute-force (1 successful logins)	Brute-Force Port Scan SSH
🇳🇱 176.65.139.94	18 Jun 2026	Honeypot hit: \| SSH brute-force (759 successful logins) \| commands run: uname -s -v -n -r -m; uname ... show more Honeypot hit: \| SSH brute-force (759 successful logins) \| commands run: uname -s -v -n -r -m; uname -s -v -n -r -m; uname -s -v -n -r -m show less	Brute-Force Port Scan SSH
🇫🇷 91.231.89.149	18 Jun 2026	Honeypot hit: \| SSH brute-force (2 successful logins)	Brute-Force Port Scan SSH
🇵🇱 185.16.38.216	18 Jun 2026	Honeypot hit: \| SSH brute-force (5 successful logins) \| commands run: busybox abc; busybox abc; busy ... show more Honeypot hit: \| SSH brute-force (5 successful logins) \| commands run: busybox abc; busybox abc; busybox abc show less	Brute-Force Port Scan SSH
🇨🇳 180.101.149.231	18 Jun 2026	Honeypot hit: \| SSH brute-force (1 successful logins) \| commands run: uname -s -m	Brute-Force Port Scan SSH
🇳🇱 45.148.10.121	18 Jun 2026	Honeypot hit: \| SSH brute-force (4 successful logins)	Brute-Force Port Scan SSH
🇵🇱 95.214.55.226	18 Jun 2026	Honeypot hit: \| SSH brute-force (6 successful logins) \| commands run: busybox abc; busybox abc; busy ... show more Honeypot hit: \| SSH brute-force (6 successful logins) \| commands run: busybox abc; busybox abc; busybox abc show less	Brute-Force Port Scan SSH
🇨🇳 218.201.39.71	18 Jun 2026	SSH brute force followed by SFTP upload of Linux.Trojan.Multiverze (fake sshd backdoor, Go-compiled, ... show more SSH brute force followed by SFTP upload of Linux.Trojan.Multiverze (fake sshd backdoor, Go-compiled, SHA256: 629db57b96d6e965401d866f895d86c542efe344b3d489630a6ec09d643add76). Logged in as root/centos, uploaded file named 'sshd' to honeypot via SFTP. Confirmed malicious by ReversingLabs/Kaspersky/vxCube. show less	SSH
🇺🇦 1.2.3.4	18 Jun 2026	Honeypot hit: \| botnet C2 beacon	Brute-Force Port Scan IoT Targeted
🇺🇦 1.2.3.4	17 Jun 2026	Honeypot hit: \| botnet C2 beacon	Brute-Force Port Scan IoT Targeted
🇩🇪 2.26.86.54	03 Jun 2026	CVE-2024-4577 PHP-CGI RCE worm bot. Directly observed POSTing exploit payload to our honeypot. C2: 4 ... show more CVE-2024-4577 PHP-CGI RCE worm bot. Directly observed POSTing exploit payload to our honeypot. C2: 46.151.182.82. Worm self-replicates by exploiting PHP-CGI servers. Evidence: directly hit our honeypot 15 times; AbuseIPDB score=100% reports=34; appears in 4 sensor tags. Confidence score: 85/100 (multi-source verified). show less	Port Scan Web App Attack
🇨🇳 120.241.79.66	03 Jun 2026	CVE-2024-4577 PHP-CGI RCE worm bot. Directly observed POSTing exploit payload to our honeypot. C2: 4 ... show more CVE-2024-4577 PHP-CGI RCE worm bot. Directly observed POSTing exploit payload to our honeypot. C2: 46.151.182.82. Worm self-replicates by exploiting PHP-CGI servers. Evidence: directly hit our honeypot 213 times; AbuseIPDB score=100% reports=1961; appears in 4 sensor tags. Confidence score: 85/100 (multi-source verified). show less	Port Scan Web App Attack
🇸🇪 79.76.58.113	03 Jun 2026	CVE-2024-4577 PHP-CGI RCE worm bot. Directly observed POSTing exploit payload to our honeypot. C2: 4 ... show more CVE-2024-4577 PHP-CGI RCE worm bot. Directly observed POSTing exploit payload to our honeypot. C2: 46.151.182.82. Worm self-replicates by exploiting PHP-CGI servers. Evidence: directly hit our honeypot 194 times; AbuseIPDB score=100% reports=1381; appears in 4 sensor tags. Confidence score: 85/100 (multi-source verified). show less	Port Scan Web App Attack