AbuseIPDB

JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

User BerndG17 joined AbuseIPDB in May 2026 and has reported 215 IP addresses.

Standing (weight) is good.

ACTIVE USER

IP	Date	Comment	Categories
🇪🇸 46.24.47.5	13 May 2026	Fake iOS 26.4.2 (OS doesn't exist), fbclid cover, POST on /, simultaneous admin-ajax calls – part of ... show more Fake iOS 26.4.2 (OS doesn't exist), fbclid cover, POST on /, simultaneous admin-ajax calls – part of ongoing coordinated botnet attack since 2026-04-29 show less	Brute-Force Web App Attack
🇩🇪 89.246.207.255	13 May 2026	fbclid cover without referrer (fake), POST on /, simultaneous admin-ajax and BetterDocs REST API cal ... show more fbclid cover without referrer (fake), POST on /, simultaneous admin-ajax and BetterDocs REST API calls – part of ongoing coordinated botnet attack since 2026-04-29 show less	Brute-Force Web App Attack
🇩🇪 92.208.186.51	13 May 2026	Headless browser, POST on /, simultaneous admin-ajax calls – part of ongoing coordinated botnet atta ... show more Headless browser, POST on /, simultaneous admin-ajax calls – part of ongoing coordinated botnet attack since 2026-04-29. Previous DDoS participation confirmed. show less	Brute-Force Web App Attack
🇩🇪 217.224.51.57	13 May 2026	Fake iOS 26.3.1 (OS doesn't exist), 7x simultaneous admin-ajax calls targeting registration page – p ... show more Fake iOS 26.3.1 (OS doesn't exist), 7x simultaneous admin-ajax calls targeting registration page – part of ongoing coordinated botnet attack since 2026-04-29 show less	Brute-Force Web App Attack
🇯🇵 20.78.158.17	13 May 2026	PHP webshell enumeration, scanning for uploaded shells in wp-admin subdirectories – automated scanne ... show more PHP webshell enumeration, scanning for uploaded shells in wp-admin subdirectories – automated scanner show less	Hacking Web App Attack
🇩🇪 80.145.126.183	13 May 2026	Credential stuffing attack, systematic login enumeration including password reset endpoint /einlogge ... show more Credential stuffing attack, systematic login enumeration including password reset endpoint /einloggen-2/?action=lostpassword – part of ongoing coordinated attack since 2026-04-29 show less	Hacking Brute-Force
🇩🇪 80.141.72.203	13 May 2026	Headless browser mimicking outdated Firefox/Windows 7, POST on / after every GET – part of ongoing c ... show more Headless browser mimicking outdated Firefox/Windows 7, POST on / after every GET – part of ongoing coordinated botnet attack since 2026-04-29 show less	Brute-Force Web App Attack
🇩🇪 84.191.246.126	13 May 2026	Fake Android 16 (OS doesn't exist), fbclid cover, simultaneous POST on / and admin-ajax – part of on ... show more Fake Android 16 (OS doesn't exist), fbclid cover, simultaneous POST on / and admin-ajax – part of ongoing coordinated botnet attack since 2026-04-29 show less	Brute-Force Web App Attack
🇩🇪 91.23.61.240	13 May 2026	Headless browser, POST on /, multiple simultaneous admin-ajax calls, fake Safari version (26.4 doesn ... show more Headless browser, POST on /, multiple simultaneous admin-ajax calls, fake Safari version (26.4 doesn't exist) – part of ongoing coordinated botnet attack since 2026-04-29 show less	Brute-Force Web App Attack
🇺🇸 74.7.243.250	13 May 2026	Fake GPTBot from Azure Atlanta, login page enumeration – not legitimate OpenAI crawler	Hacking Web App Attack
🇺🇸 20.169.78.191	13 May 2026	Fake ChatGPT-User bot from Azure Phoenix, sequential participant ID enumeration – identical attack p ... show more Fake ChatGPT-User bot from Azure Phoenix, sequential participant ID enumeration – identical attack pattern to 2026-05-12 campaign show less	Hacking Web App Attack
🇩🇪 185.202.158.46	13 May 2026	Automated forum search with double-encoded UTF-8 (encoding error typical of bots), targeted thematic ... show more Automated forum search with double-encoded UTF-8 (encoding error typical of bots), targeted thematic search term without prior page visit – part of ongoing coordinated attack against alkohol-ade.com since 2026-04-29 show less	Bad Web Bot Web App Attack
🇺🇸 57.141.20.1	13 May 2026	Fake meta-externalagent crawler from Meta IP range, systematic forum crawling with multiple parallel ... show more Fake meta-externalagent crawler from Meta IP range, systematic forum crawling with multiple parallel IPs from same /24, confirmed by multiple independent sources (CrowdSec, Fail2Ban). Not legitimate Meta crawler – no correlation with actual Facebook page activity. show less	Bad Web Bot Web App Attack
🇧🇪 45.120.179.118	13 May 2026	Fake crawler with non-existent contact URL (crawler.example), probing security.txt – not a legitimat ... show more Fake crawler with non-existent contact URL (crawler.example), probing security.txt – not a legitimate security researcher show less	Hacking Bad Web Bot
🇺🇸 149.18.100.134	12 May 2026	Automated wpForo signup endpoint probing, direct navigation to /aa-login/?wpforo=signup without huma ... show more Automated wpForo signup endpoint probing, direct navigation to /aa-login/?wpforo=signup without human browsing pattern show less	Web App Attack
🇩🇪 92.212.161.17	12 May 2026	Compromised Android device (Motorola Moto G05), fbclid cover, 5x simultaneous admin-ajax calls in 5 ... show more Compromised Android device (Motorola Moto G05), fbclid cover, 5x simultaneous admin-ajax calls in 5 seconds – part of ongoing coordinated botnet attack since 2026-04-29 show less	Brute-Force Web App Attack
🇮🇪 20.238.26.64	12 May 2026	PHP filter chain RCE attempt via php://filter stream wrapper, CRITICAL severity	Hacking Web App Attack
🇸🇲 109.233.87.184	12 May 2026	Automated Python script probing site, no user agent spoofing attempt	Web App Attack
🇳🇱 45.154.98.187	12 May 2026	BASE64-encoded PHP webshell upload attempt, CRITICAL severity, identical payload to ongoing attack c ... show more BASE64-encoded PHP webshell upload attempt, CRITICAL severity, identical payload to ongoing attack campaign show less	Hacking Web App Attack
🇹🇭 171.103.62.202	12 May 2026	Fake Googlebot from Thailand, WordPress installation script enumeration across multiple paths	Hacking Web App Attack
🇦🇹 89.26.38.10	12 May 2026	Compromised device (hotel network Salzburg AT), headless browser with fbclid cover, simultaneous POS ... show more Compromised device (hotel network Salzburg AT), headless browser with fbclid cover, simultaneous POST on / and multiple admin-ajax calls – part of ongoing coordinated botnet attack since 2026-04-29 show less	Brute-Force Web App Attack
🇩🇪 80.132.227.7	12 May 2026	Headless browser, POST on /, repeated admin-ajax calls, systematic forum crawling	Brute-Force Web App Attack
🇳🇱 2.58.56.147	12 May 2026	BASE64-encoded PHP webshell upload attempt, CRITICAL severity	Hacking Web App Attack
🇩🇪 77.3.50.16	12 May 2026	Non-existent OS versions in the UA	Brute-Force
🇺🇸 109.166.40.69	12 May 2026	Systematic site reconnaissance, targeting all login endpoints and content structure – proxy IP Weeha ... show more Systematic site reconnaissance, targeting all login endpoints and content structure – proxy IP Weehawken NJ show less	Hacking Web App Attack