AbuseIPDB

JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

User Awack joined AbuseIPDB in August 2026 and has reported 218 IP addresses.

Standing (weight) is good.

ACTIVE USER

IP	Date	Comment	Categories
🇺🇸 3.134.82.68	30 Oct 2026	Webshell hunt on WordPress sites: /wp-content/themes/seotheme/db.php, //wp-content/plugins/fix/up.ph ... show more Webshell hunt on WordPress sites: /wp-content/themes/seotheme/db.php, //wp-content/plugins/fix/up.php, /alfacgiapi/perl.alfa and /ALFA_DATA/alfacgiapi/perl.alfa, with a spoofed misspelled Android User-Agent (Mozlila/Bulid/Moblie). Tripped ModSecurity scanner-UA rule 913100. All blocked 403. show less	Web App Attack Hacking
🇬🇧 2001:41d0:801:1000::13fc	29 Oct 2026	Webshell hunt on a WordPress site: repeated /images/images/.../cache.php and /cache/cache/cache.php ... show more Webshell hunt on a WordPress site: repeated /images/images/.../cache.php and /cache/cache/cache.php probes, all 403, with a spoofed misspelled Android User-Agent (Mozlila/Bulid). Tripped ModSecurity scanner-UA rule 913100. show less	Web App Attack Bad Web Bot
🇩🇪 85.155.15.20	29 Oct 2026	Credential-file sweep of a WordPress shop: /.aws/credentials, /.aws/config, /.kube/config, /.docker/ ... show more Credential-file sweep of a WordPress shop: /.aws/credentials, /.aws/config, /.kube/config, /.docker/config.json, /.npmrc, /.netrc, plus a 112-request burst across 86 paths in 185 seconds. Tripped ModSecurity CRS restricted-file rule 930130. show less	Web App Attack Hacking
🇺🇸 98.88.70.84	29 Oct 2026	Exploit probing of a WordPress shop: ${@print(env)} PHP injection, /__debug__/execute, /_ignition/ex ... show more Exploit probing of a WordPress shop: ${@print(env)} PHP injection, /__debug__/execute, /_ignition/execute-solution, /v2/api-docs, /swagger.json, /env. Tripped ModSecurity CRS 932260 and 933135. All 404/blocked. show less	Web App Attack Hacking
🇫🇷 169.40.142.202	29 Oct 2026	Vulnerability probing of WordPress sites: GravitySMTP REST mock-data probe (/?rest_route=/gravitysmt ... show more Vulnerability probing of WordPress sites: GravitySMTP REST mock-data probe (/?rest_route=/gravitysmtp/v1/tests/mock-data), /api/session/properties, scanner UA metabase-cve-2026-72898-detect. Blocked 403/404. show less	Web App Attack Hacking
🇬🇧 2001:41d0:801:1000::1e58	28 Oct 2026	Repeated requests to a WordPress shop category with a spoofed, misspelled Android User-Agent (Mozlil ... show more Repeated requests to a WordPress shop category with a spoofed, misspelled Android User-Agent (Mozlila/Bulid/Moblie); tripped ModSecurity scanner-UA rule 913100 and anomaly score 36 times in 24h. show less	Web App Attack Bad Web Bot
🇺🇸 34.219.138.100	28 Oct 2026	Secrets and info-file sweep of a WordPress site: .npmrc, laravel.log, docker-compose.yml, src/config ... show more Secrets and info-file sweep of a WordPress site: .npmrc, laravel.log, docker-compose.yml, src/config.yaml, phpinfo/info.php, magento_version, error.log (about 45 paths in one burst). Tripped ModSecurity CRS 79 times in 24h. show less	Web App Attack Hacking
🇨🇦 2607:5300:205:300::12bc	28 Oct 2026	Webshell hunt on a WordPress site: repeated /images/images/.../cache.php and /cache/cache/cache.php ... show more Webshell hunt on a WordPress site: repeated /images/images/.../cache.php and /cache/cache/cache.php probes, all blocked 403. Tripped ModSecurity CRS 30 times in 24h. show less	Web App Attack Hacking
🇳🇱 101.99.75.183	28 Oct 2026	Webshell hunt on WordPress sites: GET /wp-content/themes/seotheme/db.php, /wp-content/plugins/apikey ... show more Webshell hunt on WordPress sites: GET /wp-content/themes/seotheme/db.php, /wp-content/plugins/apikey/apikey.php, /plugins/content/apismtp/apismtp.php, POST /wp-plain.php and random php names with ?Fox=d3wL7, all 403/404. Tripped ModSecurity CRS 27 times in 24h. show less	Web App Attack Hacking
🇩🇪 43.228.157.98	27 Oct 2026	Webshell probing of a WordPress site: /wp-content/themes/seotheme/db.php, /mbltbskm.php and /wp-plai ... show more Webshell probing of a WordPress site: /wp-content/themes/seotheme/db.php, /mbltbskm.php and /wp-plain.php, blocked 403/404; misspelled Android User-Agent (Mozlila/Bulid). Tripped ModSecurity CRS 6 times. show less	Web App Attack Hacking
🇦🇺 3.107.195.156	27 Oct 2026	Webshell hunt on WordPress sites: 857 requests in 24h for xleet.php, wp-info.php, xmrlpc.php, wp-pan ... show more Webshell hunt on WordPress sites: 857 requests in 24h for xleet.php, wp-info.php, xmrlpc.php, wp-pano.php, yanz.php and similar shell names, all 404; fake Chrome User-Agent. Tripped ModSecurity CRS 8 times. show less	Web App Attack Hacking
🇦🇺 16.178.73.211	27 Oct 2026	Webshell hunt on a WordPress site: 1459 requests in 24h for xleet.php, wp-info.php, xmrlpc.php, wp-p ... show more Webshell hunt on a WordPress site: 1459 requests in 24h for xleet.php, wp-info.php, xmrlpc.php, wp-pano.php, yanz.php and similar shell names, all 404; fake Chrome User-Agent. Tripped ModSecurity CRS 8 times. show less	Web App Attack Hacking
🇩🇪 23.132.164.250	26 Oct 2026	Webshell hunt on a WordPress site: GET /wp-content/themes/seotheme/db.php (x2), /wp-plain.php, /yyxa ... show more Webshell hunt on a WordPress site: GET /wp-content/themes/seotheme/db.php (x2), /wp-plain.php, /yyxamsuf.php?Fox=..., forged User-Agent with misspellings ("Mozlila", "Bulid", "Moblie"). Blocked by ModSecurity/CRS anomaly score. show less	Web App Attack Hacking
🇩🇪 45.139.104.59	26 Oct 2026	Secrets probe on a WordPress site: GET /uploads/.env with a generic Mac Chrome User-Agent. Blocked b ... show more Secrets probe on a WordPress site: GET /uploads/.env with a generic Mac Chrome User-Agent. Blocked by ModSecurity/CRS anomaly score. show less	Web App Attack Hacking
🇩🇪 89.163.146.129	26 Oct 2026	Webshell hunt on a WordPress site: GET /images/images/images/cache.php and /wp-includes/php-ai-clien ... show more Webshell hunt on a WordPress site: GET /images/images/images/cache.php and /wp-includes/php-ai-client/src/src/cache.php, forged User-Agent with misspellings ("Mozlila", "Bulid", "Moblie") and fake Referer www.google.com. Blocked by ModSecurity/CRS anomaly score. show less	Web App Attack Hacking
🇫🇷 13.140.140.77	25 Oct 2026	WordPress remote-code-execution exploit attempts: 10 requests in 24h to /wp-json/batch/v1 and /index ... show more WordPress remote-code-execution exploit attempts: 10 requests in 24h to /wp-json/batch/v1 and /index.php/wp-json/batch/v1, blocked by Cloudflare managed rules (WordPress RCE CVE). show less	Web App Attack Hacking
🇱🇹 77.90.185.240	25 Oct 2026	Scanner sweep of a WordPress site: /site.zip, /phpinfo/, /app_dev.php/_profiler/phpinfo, /.config.ya ... show more Scanner sweep of a WordPress site: /site.zip, /phpinfo/, /app_dev.php/_profiler/phpinfo, /.config.yaml, /sendgrid.env, /.env.example, /laravel/.env, /backend/.env, /dev/.env within seconds, old MSIE 7.0 User-Agent. Challenged/blocked at the edge. show less	Web App Attack Hacking
🇸🇦 84.13.129.116	25 Oct 2026	WordPress exploit probing: POSTs to /wp-json/batch/v1 and /?rest_route=/batch/v1 (blocked by Cloudfl ... show more WordPress exploit probing: POSTs to /wp-json/batch/v1 and /?rest_route=/batch/v1 (blocked by Cloudflare managed rules as SQL injection / remote code execution CVE), admin-ajax.php?action=wdpsso_step1 and meta-box-loader probes, plus 41 rapid requests (GET and POST) to one WooCommerce category page on another site two days earlier. Blocked by Wordfence WAF. show less	Web App Attack Hacking
🇺🇸 129.221.156.219	25 Oct 2026	WordPress recon and login hammering: 480+ requests to /wp-login.php in 24h, 240+ requests to /wp-adm ... show more WordPress recon and login hammering: 480+ requests to /wp-login.php in 24h, 240+ requests to /wp-admin/index.php, author enumeration (/?author=3, 4, 5) and /wp-json/wp/v2/users. Challenged at the edge. show less	Web App Attack Brute-Force
🇫🇷 169.40.142.177	25 Oct 2026	Sensitive-file probing of WordPress sites: /.aws/credentials, /config.php.old, /phpinfo, /test.php, ... show more Sensitive-file probing of WordPress sites: /.aws/credentials, /config.php.old, /phpinfo, /test.php, /i.php, /info.php; tripped ModSecurity CRS 10 times in 24h. show less	Web App Attack Hacking
🇳🇱 2a0f:ca80:b00b:3b19::5	25 Oct 2026	Credential and plugin recon on a WordPress site: /.env, /.git/config, /wp-config.txt, /wp-config.php ... show more Credential and plugin recon on a WordPress site: /.env, /.git/config, /wp-config.txt, /wp-config.php.swp, /wp-config.php~, /wp-config.php.old, plus theme and plugin readme/style.css enumeration (gravityforms, essential-addons, user-registration, newsblogger). show less	Web App Attack Hacking
🇺🇸 2604:2dc0:101:100::4e	25 Oct 2026	Security-scanner User-Agent crawling WordPress blog URLs: 24 requests in 24h, all blocked 403 (ModSe ... show more Security-scanner User-Agent crawling WordPress blog URLs: 24 requests in 24h, all blocked 403 (ModSecurity 913100 scanner signature, 48 CRS hits); same /64 as other abusive addresses. show less	Web App Attack Bad Web Bot
🇩🇪 64.89.160.157	25 Oct 2026	Webshell hunt on WordPress sites: /alfacgiapi/perl.alfa, /ALFA_DATA/alfacgiapi/perl.alfa, /wp-conten ... show more Webshell hunt on WordPress sites: /alfacgiapi/perl.alfa, /ALFA_DATA/alfacgiapi/perl.alfa, /wp-content/plugins/fix/up.php, /wp-content/themes/seotheme/db.php, /wp-plain.php, /sawcpxcr.php; security-scanner User-Agent; tripped ModSecurity CRS 48 times in 24h. show less	Web App Attack Hacking
🇺🇸 84.233.212.34	25 Oct 2026	Scanner sweep of a WordPress site: /test.php, /server-status, /php_info.php, /info.php, /debug, /api ... show more Scanner sweep of a WordPress site: /test.php, /server-status, /php_info.php, /info.php, /debug, /api/v1/execute, /actuator/env, /actuator/configprops; tripped ModSecurity CRS 24 times in 24h (scanner and restricted-file rules). show less	Web App Attack Hacking
🇺🇸 95.173.216.5	25 Oct 2026	Scanner sweep of a WordPress site: /test.php, /server-status, /php_info.php, /info.php, /debug, /api ... show more Scanner sweep of a WordPress site: /test.php, /server-status, /php_info.php, /info.php, /debug, /api/v1/execute, /actuator/env, /actuator/configprops; tripped ModSecurity CRS 24 times in 24h (scanner and restricted-file rules). show less	Web App Attack Hacking