AbuseIPDB

JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

User BerndG17 joined AbuseIPDB in May 2026 and has reported 215 IP addresses.

Standing (weight) is good.

ACTIVE USER

IP	Date	Comment	Categories
🇺🇸 8.231.155.92	13 May 2026	Directory enumeration via HEAD requests (/old/, /backup/, /blog/, /wordpress/). Uses historical do ... show more Directory enumeration via HEAD requests (/old/, /backup/, /blog/, /wordpress/). Uses historical domains (candida.de, alkohol-ade.com) as referers - evidence of prior reconnaissance into server history. Rotating user agents. show less	Hacking Web App Attack
🇺🇸 151.196.18.82	13 May 2026	MJ12bot impersonation with curated German-language search queries targeting specific alcohol/neuro ... show more MJ12bot impersonation with curated German-language search queries targeting specific alcohol/neuroscience topic niche. Same keyword list previously seen from Asian IPs - distributed botnet using shared target list. Verizon fixed line, likely compromised endpoint. show less	Bad Web Bot Web App Attack
🇩🇪 95.90.249.104	13 May 2026	Headless browser accessing specific forum post ID (48086), followed by 5 rapid admin-ajax POSTs in ... show more Headless browser accessing specific forum post ID (48086), followed by 5 rapid admin-ajax POSTs in 7 seconds, then navigating to target article. No fbclid this time - forum post used as entry point. Vodafone Kabel Deutschland Berlin. show less	Brute-Force Web App Attack
🇺🇸 34.162.84.26	13 May 2026	Directory enumeration via HEAD requests probing for hidden WordPress installations and backup dire ... show more Directory enumeration via HEAD requests probing for hidden WordPress installations and backup directories (/wordpress/, /backup/, /wp/, /old/, /new/). Rotating user agents. Uses unrelated domain as referer to obscure origin. show less	Hacking Web App Attack
🇬🇷 185.183.184.230	13 May 2026	Login attempt with redirect to specific member profile ID (/participant/xxxx/). Fake user agent: O ... show more Login attempt with redirect to specific member profile ID (/participant/xxxx/). Fake user agent: Opera 9.69 with Khmer language code (km-KH) - non-existent combination. Previously reported as Bad Web Bot with fake UA. show less	Brute-Force Web App Attack
🇭🇰 20.239.192.136	13 May 2026	Extensive webshell enumeration. Probed dozens of known and randomly-named PHP backdoor paths inclu ... show more Extensive webshell enumeration. Probed dozens of known and randomly-named PHP backdoor paths including wp-content/plugins/, wp-admin/maint/, and root-level shells (asd.php, t.php, a.php, ws81.php, 6xBAm3vODE05BSzkJZRAws.php etc.). show less	Hacking Web App Attack
🇸🇬 213.35.119.176	13 May 2026	CMS-agnostic admin panel scanner. Probed /wp-admin/, /administrator/, /user/login, /admin, /login, ... show more CMS-agnostic admin panel scanner. Probed /wp-admin/, /administrator/, /user/login, /admin, /login, /register simultaneously with rotating user agents (iPhone, iPad, Linux, Android, Mac). Oracle cloud Singapore. show less	Web App Attack
🇺🇸 208.84.100.207	13 May 2026	Scanning for sensitive files: wp-config.php.bak, /.env, PHP webshells. Rate-limited and blocked by ... show more Scanning for sensitive files: wp-config.php.bak, /.env, PHP webshells. Rate-limited and blocked by NinjaFirewall. Fro LLC datacenter, Kansas City. Consistent with multiple reports today across German WordPress sites. show less	Web App Attack
🇵🇱 195.3.220.7	13 May 2026	Systematic webshell enumeration across WordPress directories. Probing for known backdoor filenames ... show more Systematic webshell enumeration across WordPress directories. Probing for known backdoor filenames (worksec.php) and PHP files in theme/plugin/cache directories. Looking for previously planted shells. show less	Web App Attack
🇩🇪 87.122.63.243	13 May 2026	Credential stuffing attack against ARMember login endpoint /aa-login/. 5 rapid POST requests to ad ... show more Credential stuffing attack against ARMember login endpoint /aa-login/. 5 rapid POST requests to admin-ajax.php within 9 seconds. Fixed line ISP, likely compromised endpoint. show less	Brute-Force Web App Attack
🇺🇸 172.212.217.10	13 May 2026	Webshell scanning and plugin exploit probing. Attempted to access known webshell paths: moon.php, ... show more Webshell scanning and plugin exploit probing. Attempted to access known webshell paths: moon.php, a1.php, ahax.php, lite.php, k.php, leaf.php, wp_filemanager.php (hellopress plugin exploit), wp-conflg.php (typosquatted wp-config.php). No User-Agent, no Referer - automated scanner. Web App Attack. show less	Web App Attack
🇩🇪 51.77.74.125	13 May 2026	Plugin health-check endpoint reconnaissance (?wmo_hc= parameter). Same IP rotated two different us ... show more Plugin health-check endpoint reconnaissance (?wmo_hc= parameter). Same IP rotated two different user agents (Windows Chrome, Mac Firefox) within 1 second. Also probed typo domain to confirm shared infrastructure. OVH datacenter IP, no legitimate use case. Web App Attack. show less	Web App Attack
🇸🇪 193.42.245.98	13 May 2026	Plugin reconnaissance probe. Parameter ?element-bbcode-showed=1 with cache-buster timestamp. Data ... show more Plugin reconnaissance probe. Parameter ?element-bbcode-showed=1 with cache-buster timestamp. Data center IP (Fine Group Servers, AS59651, Marsta SE). Known bulletproof hosting range. Category: Web App Attack. show less	Web App Attack
🇨🇭 95.174.242.18	13 May 2026	Headless browser attack disguised as Facebook iOS app traffic. Fake iOS 26.x UA (non-existent OS v ... show more Headless browser attack disguised as Facebook iOS app traffic. Fake iOS 26.x UA (non-existent OS version). 4 simultaneous POST /wp-admin/admin-ajax.php within 1 second + POST /. fbclid-cloaked. IP appears to be compromised Swiss business endpoint. show less	Brute-Force Web App Attack
🇳🇴 81.167.26.57	13 May 2026	MJ12bot impersonation, ignoring robots.txt. Systematic forum crawling/content harvesting on WordPres ... show more MJ12bot impersonation, ignoring robots.txt. Systematic forum crawling/content harvesting on WordPress site. IP belongs to Lyse Tele AS Norway. Already listed as 100% abuse score. show less	Open Proxy Web App Attack
🇩🇪 84.140.41.35	13 May 2026	Scripted behavior with repeated identical navigation sequence, UA switching between WebView and MIUI ... show more Scripted behavior with repeated identical navigation sequence, UA switching between WebView and MIUI Browser, multiple simultaneous admin-ajax calls – part of ongoing coordinated botnet attack since 2026-04-29 show less	Brute-Force Web App Attack
🇩🇪 87.159.189.63	13 May 2026	fbclid cover, simultaneous POST on / and double admin-ajax in one second – part of ongoing coordinat ... show more fbclid cover, simultaneous POST on / and double admin-ajax in one second – part of ongoing coordinated botnet attack since 2026-04-29 show less	Brute-Force Web App Attack
🇩🇪 176.4.245.31	13 May 2026	Fake iOS 26.4 (OS doesn't exist), fbclid cover, simultaneous POST on / and admin-ajax – part of ongo ... show more Fake iOS 26.4 (OS doesn't exist), fbclid cover, simultaneous POST on / and admin-ajax – part of ongoing coordinated botnet attack since 2026-04-29 show less	Brute-Force Web App Attack
🇩🇪 109.42.48.72	13 May 2026	Credential stuffing, systematic login endpoint enumeration targeting both /aa-login/ and /einloggen- ... show more Credential stuffing, systematic login endpoint enumeration targeting both /aa-login/ and /einloggen-2/ after failed login – part of ongoing coordinated botnet attack since 2026-04-29 show less	Brute-Force Web App Attack
🇫🇷 217.182.194.2	13 May 2026	MJ12bot ignoring robots.txt, rotating OVH IPs	Bad Web Bot
🇩🇪 77.25.18.228	13 May 2026	UA inconsistency between GET and POST (FB_IAB missing on first request), 7x simultaneous admin-ajax ... show more UA inconsistency between GET and POST (FB_IAB missing on first request), 7x simultaneous admin-ajax calls targeting registration page – part of ongoing coordinated botnet attack since 2026-04-29 show less	Brute-Force Web App Attack
🇺🇸 35.208.143.239	13 May 2026	ARMember-specific login endpoint probing (/arm-login/), infrastructure subdomain scanning, switching ... show more ARMember-specific login endpoint probing (/arm-login/), infrastructure subdomain scanning, switching between .at and .com domains – part of ongoing coordinated attack since 2026-04-29 show less	Hacking Web App Attack
🇩🇪 31.12.59.81	13 May 2026	Targeted members-only content access attempt, POST on / after access denial – part of ongoing coordi ... show more Targeted members-only content access attempt, POST on / after access denial – part of ongoing coordinated botnet attack since 2026-04-29 show less	Brute-Force Web App Attack
🇳🇱 82.151.33.168	13 May 2026	Fake iPadOS 26.3.1 (OS doesn't exist), systematic login enumeration targeting /einloggen-2 – part of ... show more Fake iPadOS 26.3.1 (OS doesn't exist), systematic login enumeration targeting /einloggen-2 – part of ongoing coordinated botnet attack since 2026-04-29 show less	Brute-Force Web App Attack
🇺🇸 34.1.16.226	13 May 2026	Source map enumeration (.css.map, .js.map files) to identify plugin versions and code structure for ... show more Source map enumeration (.css.map, .js.map files) to identify plugin versions and code structure for vulnerability research – confirmed by AbuseIPDB report 'trolling for resource vulnerabilities' from same day show less	Web App Attack