AbuseIPDB

JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

User Agaman joined AbuseIPDB in November 2019 and has reported 1,478 IP addresses.

Standing (weight) is good.

ACTIVE USER

IP	Date	Comment	Categories
🇸🇬 104.28.254.47	15 hours ago	Exploit and secret-file scanning on HTTP(S) port 80/443. 5 requests, 2026-10-30 19:57 UTC. Samples: ... show more Exploit and secret-file scanning on HTTP(S) port 80/443. 5 requests, 2026-10-30 19:57 UTC. Samples: GET /.env.dist 444; GET /.env.test 444. Fake crawler: the User-Agent claims "ChatGPT-User", but this IP is not a verified ChatGPT-User address. UA: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ChatGPT-User/1.0;. Detected by fail2ban. show less	Web App Attack
🇫🇷 143.244.57.92	15 hours ago	Exploit and secret-file scanning on HTTP(S) port 80/443. 10 requests across 2 of our servers, 2026-1 ... show more Exploit and secret-file scanning on HTTP(S) port 80/443. 10 requests across 2 of our servers, 2026-10-30 02:34-07:57 UTC. Samples: GET /ALFA_DATA/ 444; GET /vendor/phpunit/phpunit/src/Util/PHP/ 444. Detected by fail2ban. show less	Web App Attack
🇫🇷 82.102.18.180	15 hours ago	Exploit and secret-file scanning on HTTP(S) port 80/443. 5 requests, 2026-10-30 19:42 UTC. Samples: ... show more Exploit and secret-file scanning on HTTP(S) port 80/443. 5 requests, 2026-10-30 19:42 UTC. Samples: GET //wp-includes/wlwmanifest.xml 444; GET //xmlrpc.php 444. UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko). Detected by fail2ban. show less	Web App Attack
🇳🇱 64.227.70.2	16 hours ago	Exploit and secret-file scanning on HTTP(S) port 80/443. 5 requests, 2026-10-30 19:25 UTC. Samples: ... show more Exploit and secret-file scanning on HTTP(S) port 80/443. 5 requests, 2026-10-30 19:25 UTC. Samples: GET /server-status 444; GET /.DS_Store 444; GET /.env 444. UA: Mozilla/5.0 (l9scan/2.0.535313e2131313e2131313e2538313; +https://leakix.net). Detected by fail2ban. show less	Web App Attack
🇳🇱 68.183.9.16	16 hours ago	Exploit and secret-file scanning on HTTP(S) port 80/443. 5 requests, 2026-10-30 19:27 UTC. Samples: ... show more Exploit and secret-file scanning on HTTP(S) port 80/443. 5 requests, 2026-10-30 19:27 UTC. Samples: GET /server-status 444; GET /.DS_Store 444; GET /.env 444. UA: Mozilla/5.0 (l9scan/2.0.535313e2131313e2131313e2538313; +https://leakix.net). Detected by fail2ban. show less	Web App Attack
🇳🇱 81.171.72.93	16 hours ago	Exploit and secret-file scanning on HTTP(S) port 80/443. 5 requests, 2026-10-30 19:27 UTC. Samples: ... show more Exploit and secret-file scanning on HTTP(S) port 80/443. 5 requests, 2026-10-30 19:27 UTC. Samples: GET /dump.sql 444; GET /backup.zip 444. UA: Go-http-client/2.0. Detected by fail2ban. show less	Web App Attack
🇸🇬 206.189.95.232	16 hours ago	Exploit and secret-file scanning on HTTP(S) port 80/443. 5 requests, 2026-10-30 19:24 UTC. Samples: ... show more Exploit and secret-file scanning on HTTP(S) port 80/443. 5 requests, 2026-10-30 19:24 UTC. Samples: GET /server-status 444; GET /.DS_Store 444; GET /.env 444. UA: Mozilla/5.0 (l9scan/2.0.535313e2131313e2131313e2538313; +https://leakix.net). Detected by fail2ban. show less	Web App Attack
🇳🇱 81.171.72.135	16 hours ago	Exploit and secret-file scanning on HTTP(S) port 80/443. 5 requests, 2026-10-30 19:15 UTC. Samples: ... show more Exploit and secret-file scanning on HTTP(S) port 80/443. 5 requests, 2026-10-30 19:15 UTC. Samples: GET /dump.sql 444. UA: Go-http-client/2.0. Detected by fail2ban. show less	Web App Attack
🇩🇪 159.89.12.166	16 hours ago	Exploit and secret-file scanning on HTTP(S) port 80/443. 5 requests, 2026-10-30 19:15 UTC. Samples: ... show more Exploit and secret-file scanning on HTTP(S) port 80/443. 5 requests, 2026-10-30 19:15 UTC. Samples: GET /server-status 444; GET /.DS_Store 444; GET /.env 444. UA: Mozilla/5.0 (l9scan/2.0.735313e2131313e2131313e2538313; +https://leakix.net). Detected by fail2ban. show less	Web App Attack
🇺🇸 206.81.12.187	16 hours ago	Exploit and secret-file scanning on HTTP(S) port 80/443. 5 requests, 2026-10-30 19:19 UTC. Samples: ... show more Exploit and secret-file scanning on HTTP(S) port 80/443. 5 requests, 2026-10-30 19:19 UTC. Samples: GET /server-status 444; GET /.DS_Store 444; GET /.env 444. UA: Mozilla/5.0 (l9scan/2.0.435313e2131313e2131313e2538313; +https://leakix.net). Detected by fail2ban. show less	Web App Attack
🇫🇷 84.17.60.251	16 hours ago	Exploit and secret-file scanning on HTTP(S) port 80/443. 5 requests, 2026-10-30 18:55 UTC. Samples: ... show more Exploit and secret-file scanning on HTTP(S) port 80/443. 5 requests, 2026-10-30 18:55 UTC. Samples: GET /ALFA_DATA/ 444. Detected by fail2ban. show less	Web App Attack
🇫🇷 85.204.70.106	16 hours ago	Exploit and secret-file scanning on HTTP(S) port 80/443. 5 requests, 2026-10-30 18:55 UTC. Samples: ... show more Exploit and secret-file scanning on HTTP(S) port 80/443. 5 requests, 2026-10-30 18:55 UTC. Samples: GET /ALFA_DATA/ 444. Detected by fail2ban. show less	Web App Attack
🇫🇷 85.204.70.90	16 hours ago	Exploit and secret-file scanning on HTTP(S) port 80/443. 5 requests, 2026-10-30 18:46 UTC. Samples: ... show more Exploit and secret-file scanning on HTTP(S) port 80/443. 5 requests, 2026-10-30 18:46 UTC. Samples: GET //wp-includes/wlwmanifest.xml 444; GET //xmlrpc.php 444. UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko). Detected by fail2ban. show less	Web App Attack
🇫🇷 84.17.60.236	17 hours ago	Exploit and secret-file scanning on HTTP(S) port 80/443. 5 requests, 2026-10-30 18:13 UTC. Samples: ... show more Exploit and secret-file scanning on HTTP(S) port 80/443. 5 requests, 2026-10-30 18:13 UTC. Samples: GET /ALFA_DATA/ 444; GET /vendor/phpunit/phpunit/src/Util/PHP/ 444. Detected by fail2ban. show less	Web App Attack
🇹🇼 34.81.10.126	17 hours ago	Exploit and secret-file scanning on HTTP(S) port 80/443. 5 requests, 2026-10-30 17:58 UTC. Samples: ... show more Exploit and secret-file scanning on HTTP(S) port 80/443. 5 requests, 2026-10-30 17:58 UTC. Samples: GET /.git/config 444; GET /.env 444; GET /.env.local 444. UA: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/13. Detected by fail2ban. show less	Web App Attack
🇳🇱 45.156.128.156	17 hours ago	Exploit and secret-file scanning on HTTP(S) port 80/443. 5 requests, 2026-10-30 17:57 UTC. Samples: ... show more Exploit and secret-file scanning on HTTP(S) port 80/443. 5 requests, 2026-10-30 17:57 UTC. Samples: GET /cgi-bin/authLogin.cgi 444; GET /wp-content/plugins/litespeed-cache/readme.txt 444; GET /wp-content/plugins/woocommerce/readme.txt 444. UA: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/5. Detected by fail2ban. show less	Web App Attack
🇳🇱 45.156.128.157	17 hours ago	Exploit and secret-file scanning on HTTP(S) port 80/443. 5 requests, 2026-10-30 17:57 UTC. Samples: ... show more Exploit and secret-file scanning on HTTP(S) port 80/443. 5 requests, 2026-10-30 17:57 UTC. Samples: GET /wp-content/plugins/bbpress/readme.txt 444; GET /wp-content/plugins/code-snippets/readme.txt 444; GET /wp-content/plugins/groma-canary-not-a-real-plugin/readme.txt 444. UA: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/5. Detected by fail2ban. show less	Web App Attack
🇳🇱 45.156.128.158	17 hours ago	Exploit and secret-file scanning on HTTP(S) port 80/443. 5 requests, 2026-10-30 17:57 UTC. Samples: ... show more Exploit and secret-file scanning on HTTP(S) port 80/443. 5 requests, 2026-10-30 17:57 UTC. Samples: GET /wp-content/plugins/wp-fastest-cache/readme.txt 444; GET /wp-content/plugins/wp-central/readme.txt 444; GET /wp-content/plugins/wp-time-capsule/readme.txt 444. UA: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/5. Detected by fail2ban. show less	Web App Attack
🇳🇱 45.156.128.159	17 hours ago	Exploit and secret-file scanning on HTTP(S) port 80/443. 5 requests, 2026-10-30 17:57 UTC. Samples: ... show more Exploit and secret-file scanning on HTTP(S) port 80/443. 5 requests, 2026-10-30 17:57 UTC. Samples: GET /wp-content/plugins/wp-user-avatar/readme.txt 444; GET /wp-content/plugins/wpforms-lite/readme.txt 444; GET /wp-content/plugins/elementskit-lite/readme.txt 444. UA: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/5. Detected by fail2ban. show less	Web App Attack
🇫🇷 85.204.70.104	17 hours ago	Exploit and secret-file scanning on HTTP(S) port 80/443. 5 requests, 2026-10-30 17:57 UTC. Samples: ... show more Exploit and secret-file scanning on HTTP(S) port 80/443. 5 requests, 2026-10-30 17:57 UTC. Samples: GET /ALFA_DATA/ 444; GET /vendor/phpunit/phpunit/src/Util/PHP/ 444. Detected by fail2ban. show less	Web App Attack
🇩🇪 185.220.101.1	17 hours ago	Exploit and secret-file scanning on HTTP(S) port 80/443. 5 requests, 2026-10-30 17:56 UTC. Samples: ... show more Exploit and secret-file scanning on HTTP(S) port 80/443. 5 requests, 2026-10-30 17:56 UTC. Samples: GET /xmlrpc.php 444. UA: Mozilla/5.0 (Linux; U; Android 4.1.1; en-us; CVD601 Build/JRO03H) AppleWebKit/53. Detected by fail2ban. show less	Web App Attack
🇩🇪 43.228.157.194	17 hours ago	Exploit and secret-file scanning on HTTP(S) port 80/443. 5 requests, 2026-10-30 17:56 UTC. Samples: ... show more Exploit and secret-file scanning on HTTP(S) port 80/443. 5 requests, 2026-10-30 17:56 UTC. Samples: GET /wp-content/plugins/fix/up.php 444; GET /wp-content/themes/seotheme/db.php 444; POST /ALFA_DATA/alfacgiapi/perl.alfa 444. UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko). Detected by fail2ban. show less	Web App Attack
🇦🇪 20.46.43.126	18 hours ago	Webshell/backdoor probing + exploit and secret-file scanning on HTTP(S) port 80/443. 5 requests, 202 ... show more Webshell/backdoor probing + exploit and secret-file scanning on HTTP(S) port 80/443. 5 requests, 2026-10-30 17:39 UTC. Samples: GET /alfa.php 444; GET /about.php 444. UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko). Detected by fail2ban. show less	Hacking Web App Attack
🇫🇷 85.204.70.112	18 hours ago	Exploit and secret-file scanning on HTTP(S) port 80/443. 15 requests across 3 of our servers, 2026-1 ... show more Exploit and secret-file scanning on HTTP(S) port 80/443. 15 requests across 3 of our servers, 2026-10-29 21:19 to 2026-10-30 01:49 UTC. Samples: GET //wp-includes/wlwmanifest.xml 444; GET //xmlrpc.php 444. UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko). Detected by fail2ban. show less	Web App Attack
🇺🇸 136.80.26.206	18 hours ago	Exploit and secret-file scanning on HTTP(S) port 80/443. 5 requests, 2026-10-30 17:33 UTC. Samples: ... show more Exploit and secret-file scanning on HTTP(S) port 80/443. 5 requests, 2026-10-30 17:33 UTC. Samples: GET /dist/.vite/manifest.json 444. UA: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome. Detected by fail2ban. show less	Web App Attack