AbuseIPDB

JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

User arcy joined AbuseIPDB in August 2026 and has reported 1,874 IP addresses.

Standing (weight) is good.

ACTIVE USER WEBMASTER SUPPORTER

IP	Date	Comment	Categories
🇳🇱 91.148.244.131	22 Sep 2026	Detected by CrowdSec IDS on a self-hosted server. Target: HTTP/HTTPS (ports 80/443). Triggered rules ... show more Detected by CrowdSec IDS on a self-hosted server. Target: HTTP/HTTPS (ports 80/443). Triggered rules: http-sensitive-files. 10 matching log events between 2026-09-21T23:28:54Z and 2026-09-22T01:05:32Z (UTC). Sample requests: GET /dump.sql -> 401; GET /backup.sql -> 401; GET /database_backup.sql -> 401; GET /database.sql -> 401; GET /user_secrets.yml -> 401; GET /_vti_pvt/service.pwd -> 302; GET /.git/HEAD -> 302; GET /.env -> 302; GET /api/.env -> 404; GET /zzcanary-2b43ad58e5b1d2ce.env -> 302 show less	Hacking Web App Attack
🇩🇪 94.154.46.243	22 Sep 2026	Detected by CrowdSec IDS on a self-hosted server. Target: HTTP/HTTPS (ports 80/443). Triggered rules ... show more Detected by CrowdSec IDS on a self-hosted server. Target: HTTP/HTTPS (ports 80/443). Triggered rules: http-probing, http-sensitive-files, http-technology-probing. 17 matching log events at 2026-09-21T15:39:08Z (UTC). Sample requests: GET /info.php -> 404; GET /wp-config.php.bak -> 404; GET /.aws/credentials -> 404; GET /.aws/config -> 404; GET /composer.json -> 404; GET /.env.test -> 404; GET /wp-config.php.old -> 404; GET /.git/index -> 404; GET /wp-config.old -> 404; GET /wp-config.php~ -> 404; GET /wp-config.php -> 404; GET /config/app.php -> 404; GET /package-lock.json -> 404; GET /config.py -> 404; GET /.travis.yml -> 404 show less	Port Scan Hacking Web App Attack
🇳🇱 130.12.180.117	22 Sep 2026	Detected by CrowdSec IDS on a self-hosted server. Target: HTTP/HTTPS (ports 80/443). Triggered rules ... show more Detected by CrowdSec IDS on a self-hosted server. Target: HTTP/HTTPS (ports 80/443). Triggered rules: http-sensitive-files. 15 matching log events between 2026-09-21T18:33:39Z and 21:46:05Z (UTC). Sample requests: GET /.env -> 301; GET /.git/HEAD -> 200; GET /.env.backup -> 200; GET /.env.save -> 200; GET /.env.bak -> 200; GET /.git/HEAD -> 301; GET /.env.backup -> 301; GET /.env.save -> 301; GET /.env.bak -> 301; GET /.git/HEAD -> 401; GET /.env.backup -> 401; GET /.env.save -> 401; GET /.env.bak -> 401 show less	Hacking Web App Attack
🇺🇸 134.33.67.95	22 Sep 2026	Detected by CrowdSec IDS on a self-hosted server. Target: HTTP/HTTPS (ports 80/443). Triggered rules ... show more Detected by CrowdSec IDS on a self-hosted server. Target: HTTP/HTTPS (ports 80/443). Triggered rules: http-technology-probing. 1 matching log event at 2026-09-21T14:25:43Z (UTC). Sample requests: GET /manager/html -> 404 show less	Port Scan Web App Attack
🇩🇪 138.68.86.32	22 Sep 2026	Detected by CrowdSec IDS on a self-hosted server. Target: HTTP/HTTPS (ports 80/443). Triggered rules ... show more Detected by CrowdSec IDS on a self-hosted server. Target: HTTP/HTTPS (ports 80/443). Triggered rules: jira_cve-2021-26086. 1 matching log event at 2026-09-21T18:18:22Z (UTC). Sample requests: GET /s/138313e2934323e2832313e27353/_/;/META-INF/maven/com.atlassian.jira/jira-webapp-dist/pom.properties -> 200 show less	Hacking Web App Attack
🇩🇪 139.59.136.184	22 Sep 2026	Detected by CrowdSec IDS on a self-hosted server. Target: HTTP/HTTPS (ports 80/443). Triggered rules ... show more Detected by CrowdSec IDS on a self-hosted server. Target: HTTP/HTTPS (ports 80/443). Triggered rules: jira_cve-2021-26086. 1 matching log event at 2026-09-21T18:18:23Z (UTC). Sample requests: GET /s/138313e2934323e2832313e27353/_/;/META-INF/maven/com.atlassian.jira/jira-webapp-dist/pom.properties -> 301 show less	Hacking Web App Attack
🇩🇪 159.89.12.166	22 Sep 2026	Detected by CrowdSec IDS on a self-hosted server. Target: HTTP/HTTPS (ports 80/443). Triggered rules ... show more Detected by CrowdSec IDS on a self-hosted server. Target: HTTP/HTTPS (ports 80/443). Triggered rules: jira_cve-2021-26086. 1 matching log event at 2026-09-21T18:18:23Z (UTC). Sample requests: GET /s/138313e2934323e2832313e27353/_/;/META-INF/maven/com.atlassian.jira/jira-webapp-dist/pom.properties -> 400 show less	Hacking Web App Attack
🇺🇸 209.141.56.109	22 Sep 2026	Detected by CrowdSec IDS on a self-hosted server. Target: HTTP/HTTPS (ports 80/443). Triggered rules ... show more Detected by CrowdSec IDS on a self-hosted server. Target: HTTP/HTTPS (ports 80/443). Triggered rules: http-open-proxy. 1 matching log event at 2026-09-21T22:06:23Z (UTC). Sample requests: CONNECT cloudflare.com:443 -> 400 show less	Open Proxy Web App Attack
🇩🇪 213.209.159.16	22 Sep 2026	Detected by CrowdSec IDS on a self-hosted server. Target: HTTP/HTTPS (ports 80/443). Triggered rules ... show more Detected by CrowdSec IDS on a self-hosted server. Target: HTTP/HTTPS (ports 80/443). Triggered rules: http-open-proxy. 1 matching log event at 2026-09-21T12:52:19Z (UTC). Sample requests: CONNECT checkip.amazonaws.com:443 -> 400 show less	Open Proxy Web App Attack
🇩🇪 213.209.159.17	22 Sep 2026	Detected by CrowdSec IDS on a self-hosted server. Target: HTTP/HTTPS (ports 80/443). Triggered rules ... show more Detected by CrowdSec IDS on a self-hosted server. Target: HTTP/HTTPS (ports 80/443). Triggered rules: http-open-proxy. 1 matching log event at 2026-09-21T12:52:19Z (UTC). Sample requests: CONNECT api64.ipify.org:443 -> 400 show less	Open Proxy Web App Attack
🇩🇪 213.209.159.20	22 Sep 2026	Detected by CrowdSec IDS on a self-hosted server. Target: HTTP/HTTPS (ports 80/443). Triggered rules ... show more Detected by CrowdSec IDS on a self-hosted server. Target: HTTP/HTTPS (ports 80/443). Triggered rules: http-open-proxy. 1 matching log event at 2026-09-21T12:52:19Z (UTC). Sample requests: CONNECT icanhazip.com:443 -> 400 show less	Open Proxy Web App Attack
🇩🇪 213.209.159.84	22 Sep 2026	Detected by CrowdSec IDS on a self-hosted server. Target: HTTP/HTTPS (ports 80/443). Triggered rules ... show more Detected by CrowdSec IDS on a self-hosted server. Target: HTTP/HTTPS (ports 80/443). Triggered rules: http-sensitive-files. 5 matching log events at 2026-09-22T03:24:55Z (UTC). Sample requests: GET /.env -> 200; GET /.env.development -> 200; GET /.env.save -> 200; GET /.env.prod -> 200; GET /backend/.env -> 200 show less	Hacking Web App Attack
🇩🇪 213.209.159.154	22 Sep 2026	Detected by CrowdSec IDS on a self-hosted server. Target: HTTP/HTTPS (ports 80/443). Triggered rules ... show more Detected by CrowdSec IDS on a self-hosted server. Target: HTTP/HTTPS (ports 80/443). Triggered rules: http-admin-interface-probing, http-probing, http-sensitive-files, http-technology-probing. 20 matching log events between 2026-09-21T21:33:56Z and 21:33:58Z (UTC). Sample requests: GET //info.php -> 404; GET / -> 404; GET /.env -> 404; GET /api/.env -> 404; GET /backend/.env -> 404; GET /sendgrid.env -> 404; GET /admin/.env -> 404; GET /server/.env -> 404; GET /laravel/.env -> 404; GET /phpinfo/ -> 404; GET /.env.example -> 404; GET /phpinfo.php -> 404 show less	Port Scan Hacking Web App Attack
🇫🇷 5.135.14.53	21 Sep 2026	Phishing delivered via completed SMTP/TLS session from 5.135.14.53 to a Gmail MX. Sending host's PTR ... show more Phishing delivered via completed SMTP/TLS session from 5.135.14.53 to a Gmail MX. Sending host's PTR is e-presidentielle.lesechos.fr, unrelated to forged HELO 'docs.google.com'. SPF pass only for attacker's own domain (sb023.systemesavances.biz.id, self-authorized) - not legitimacy evidence. DKIM: permerror, no key (unverifiable, not broken). From spoofs recipient's name as display name; sender [email protected] uses non-existent TLD '.apr'. Headers include a second, injected fake block simulating a trusted Gmail chain: bogus Received from efianalytics.com/216.244.76.116 (never an actual relay), fake 'X-Google-Sender-Delegation: Trusted Sender', fabricated X-Originating-IP 217.18.210.147, Message-ID under same fake TLD. Payload: HTML 'Cloud storage payment failed' page, 'Update payment method' link to storage.googleapis.com/devilex/devilex1.html (tracking params, not opened) - abuses GCS as phishing host. Hidden filler text and malformed encoding for spam-filter evasion. No attachments, no ransom/BTC. show less	Spoofing Email Spam Phishing
🇺🇸 3.82.141.143	21 Sep 2026	Detected by CrowdSec IDS on a self-hosted server. Target: HTTP/HTTPS (ports 80/443). Triggered rules ... show more Detected by CrowdSec IDS on a self-hosted server. Target: HTTP/HTTPS (ports 80/443). Triggered rules: http-probing, http-sensitive-files. 47 matching log events between 2026-09-20T06:42:38Z and 23:41:36Z (UTC). Sample requests: GET /.aws/credentials -> 302; GET /.bash_history -> 302; GET /.docker/config.json -> 302; GET /.aws/config -> 302; GET /.env -> 302; GET /.aws/config -> 200; GET /.bash_history -> 200; GET /.docker/config.json -> 404; GET /.aws/credentials -> 200; GET /.env -> 200; GET /.aws/credentials -> 401; GET /.bash_history -> 401; GET /.docker/config.json -> 401; GET /.aws/config -> 401; GET /.env -> 401; GET /.aws/config -> 404; GET /.bash_history -> 404; GET /.aws/credentials -> 404; GET /.env.backup -> 404; GET /.composer-auth.json -> 404; GET /.config/sftp.json -> 404; GET /.credentials -> 404; GET /.circleci/ssh-config -> 404; GET /.dockercfg -> 404; GET /.drone.yml -> 404; GET /.auth.json -> 404; GET /.boto -> 404; GET /.config/gcloud/credentials.db -> 404; GET /.aws/config -> 301 show less	Port Scan Hacking Web App Attack
🇺🇸 20.112.235.238	21 Sep 2026	Detected by CrowdSec IDS on a self-hosted server. Target: HTTP/HTTPS (ports 80/443). Triggered rules ... show more Detected by CrowdSec IDS on a self-hosted server. Target: HTTP/HTTPS (ports 80/443). Triggered rules: http-cve-probing. 1 matching log event at 2026-09-20T10:00:08Z (UTC). Sample requests: GET /developmentserver/metadatauploader -> 404 show less	Hacking Web App Attack
🇳🇱 34.7.128.134	21 Sep 2026	Detected by CrowdSec IDS on a self-hosted server. Target: HTTP/HTTPS (ports 80/443). Triggered rules ... show more Detected by CrowdSec IDS on a self-hosted server. Target: HTTP/HTTPS (ports 80/443). Triggered rules: http-sensitive-files. 5 matching log events at 2026-09-20T16:57:24Z (UTC). Sample requests: GET /.git/config -> 200; GET /.env -> 200; GET /.env.local -> 200; GET /.env.staging -> 200; GET /.env.development -> 200 show less	Hacking Web App Attack
🇺🇸 34.11.127.147	21 Sep 2026	Detected by CrowdSec IDS on a self-hosted server. Target: HTTP/HTTPS (ports 80/443). Triggered rules ... show more Detected by CrowdSec IDS on a self-hosted server. Target: HTTP/HTTPS (ports 80/443). Triggered rules: http-probing. 11 matching log events at 2026-09-21T03:27:59Z (UTC). Sample requests: GET /html/.codex/auth.json -> 404; GET /.codex/config.json -> 404; GET /htdocs/.codex/auth.json -> 404; GET /root/.codex/auth.json -> 404; GET /.codex/auth.json -> 404; GET /web/.codex/auth.json -> 404; GET /.claude/credentials.json -> 404; GET /bak/.codex/auth.json -> 404; GET /tmp/.codex/auth.json -> 404; GET /data/.codex/auth.json -> 404; GET /public/.claude/credentials.json -> 404 show less	Port Scan Web App Attack
🇮🇹 34.17.142.77	21 Sep 2026	Detected by CrowdSec IDS on a self-hosted server. Target: HTTP/HTTPS (ports 80/443). Triggered rules ... show more Detected by CrowdSec IDS on a self-hosted server. Target: HTTP/HTTPS (ports 80/443). Triggered rules: http-admin-interface-probing, http-probing, http-sensitive-files, http-technology-probing. 31 matching log events between 2026-09-20T16:42:52Z and 17:02:56Z (UTC). Sample requests: GET /phpinfo.php -> 404; GET /info.php -> 404; GET /php.php -> 404; GET /i.php -> 404; GET /pi.php -> 404; GET /pinfo.php -> 404; GET /test.php -> 404; GET /phpinfo/ -> 404; GET /p.php -> 404; GET /debug.php -> 404; GET /admin/phpinfo.php -> 404; GET /.git/config/ -> 404; GET /.env.local -> 404; GET /.env.production -> 404; GET /.env.staging -> 404; GET /.env.development -> 404; GET /.env.test -> 404; GET /.env.remote -> 404; GET /.env.bak -> 404; GET /.env.backup -> 404; GET /.env.save -> 404; GET /.env.old -> 404; GET /.git/config -> 301 show less	Port Scan Hacking Web App Attack
🇺🇸 34.20.239.27	21 Sep 2026	Detected by CrowdSec IDS on a self-hosted server. Target: HTTP/HTTPS (ports 80/443). Triggered rules ... show more Detected by CrowdSec IDS on a self-hosted server. Target: HTTP/HTTPS (ports 80/443). Triggered rules: http-probing, http-sensitive-files. 16 matching log events between 2026-09-20T15:40:22Z and 15:40:23Z (UTC). Sample requests: GET /.git/config -> 404; GET /.env -> 404; GET /.env.local -> 404; GET /.env.production -> 404; GET /.env.staging -> 404; GET /.env.development -> 404; GET /.env.test -> 404; GET /.env.remote -> 404; GET /.env.bak -> 404; GET /.env.backup -> 404; GET /.env.save -> 404 show less	Port Scan Hacking Web App Attack
🇧🇪 34.77.137.207	21 Sep 2026	Detected by CrowdSec IDS on a self-hosted server. Target: HTTP/HTTPS (ports 80/443). Triggered rules ... show more Detected by CrowdSec IDS on a self-hosted server. Target: HTTP/HTTPS (ports 80/443). Triggered rules: http-sensitive-files. 5 matching log events at 2026-09-20T09:25:21Z (UTC). Sample requests: GET /.env -> 200; GET /.docker/laravel/app/.env -> 200; GET /.docker/secrets.json -> 200; GET /.docker/config.json -> 200; GET /.docker/.env -> 200 show less	Hacking Web App Attack
🇦🇺 34.116.97.128	21 Sep 2026	Detected by CrowdSec IDS on a self-hosted server. Target: HTTP/HTTPS (ports 80/443). Triggered rules ... show more Detected by CrowdSec IDS on a self-hosted server. Target: HTTP/HTTPS (ports 80/443). Triggered rules: http-sensitive-files. 10 matching log events between 2026-09-20T15:14:50Z and 15:34:55Z (UTC). Sample requests: GET /terraform/.env -> 200; GET /ansible/.env -> 200; GET /.git/.env -> 200; GET /ci/.env -> 200; GET /cd/.env -> 200; GET /.git/config -> 200; GET /.env -> 200; GET /.env.local -> 200; GET /.env.staging -> 200; GET /.env.development -> 200 show less	Hacking Web App Attack
🇩🇪 34.141.53.204	21 Sep 2026	Detected by CrowdSec IDS on a self-hosted server. Target: HTTP/HTTPS (ports 80/443). Triggered rules ... show more Detected by CrowdSec IDS on a self-hosted server. Target: HTTP/HTTPS (ports 80/443). Triggered rules: http-sensitive-files. 5 matching log events at 2026-09-20T17:15:07Z (UTC). Sample requests: GET /.git/config -> 401; GET /.env -> 401; GET /.env.local -> 401; GET /.env.staging -> 401; GET /.env.development -> 401 show less	Hacking Web App Attack
🇭🇰 34.150.95.202	21 Sep 2026	Detected by CrowdSec IDS on a self-hosted server. Target: HTTP/HTTPS (ports 80/443). Triggered rules ... show more Detected by CrowdSec IDS on a self-hosted server. Target: HTTP/HTTPS (ports 80/443). Triggered rules: http-probing, http-sensitive-files. 32 matching log events between 2026-09-20T20:21:09Z and 20:41:19Z (UTC). Sample requests: GET /jenkins/.env/ -> 404; GET /gitlab/.env/ -> 404; GET /github/.env/ -> 404; GET /actions/.env/ -> 404; GET /circleci/.env/ -> 404; GET /travis/.env/ -> 404; GET /buildkite/.env/ -> 404; GET /mysql/.env/ -> 404; GET /postgres/.env/ -> 404; GET /mongodb/.env/ -> 404; GET /redis/.env/ -> 404; GET /jenkins/.env -> 301; GET /gitlab/.env -> 301; GET /github/.env -> 301; GET /actions/.env -> 301; GET /circleci/.env -> 301; GET /.git/config/ -> 404; GET /.env/ -> 404; GET /.env.local -> 404; GET /.env.production -> 404; GET /.env.staging -> 404; GET /.env.development -> 404; GET /.env.test -> 404; GET /.env.remote -> 404; GET /.env.bak -> 404; GET /.env.backup -> 404; GET /.env.save -> 404; GET /.git/config -> 301; GET /.env -> 301 show less	Port Scan Hacking Web App Attack
🇮🇹 34.154.142.76	21 Sep 2026	Detected by CrowdSec IDS on a self-hosted server. Target: HTTP/HTTPS (ports 80/443). Triggered rules ... show more Detected by CrowdSec IDS on a self-hosted server. Target: HTTP/HTTPS (ports 80/443). Triggered rules: http-probing, http-sensitive-files. 16 matching log events at 2026-09-20T13:12:58Z (UTC). Sample requests: GET /.git/config/ -> 404; GET /.env/ -> 404; GET /.env.local -> 404; GET /.env.production -> 404; GET /.env.staging -> 404; GET /.env.development -> 404; GET /.env.test -> 404; GET /.env.remote -> 404; GET /.env.bak -> 404; GET /.env.backup -> 404; GET /.env.save -> 404; GET /.git/config -> 301; GET /.env -> 301 show less	Port Scan Hacking Web App Attack