AbuseIPDB

JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

User Agaman joined AbuseIPDB in November 2019 and has reported 2,073 IP addresses.

Standing (weight) is good.

ACTIVE USER

IP	Date	Comment	Categories
🇩🇪 213.209.159.133	15 hours ago	Exploit and secret-file scanning on HTTP(S) port 80/443. 5 requests, 2026-11-03 13:05 UTC. Samples: ... show more Exploit and secret-file scanning on HTTP(S) port 80/443. 5 requests, 2026-11-03 13:05 UTC. Samples: GET /.env 444. UA: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome. Detected by fail2ban. show less	Web App Attack
🇦🇺 34.151.135.73	15 hours ago	Exploit and secret-file scanning on HTTP(S) port 80/443. 5 requests, 2026-11-03 12:57 UTC. Samples: ... show more Exploit and secret-file scanning on HTTP(S) port 80/443. 5 requests, 2026-11-03 12:57 UTC. Samples: GET /.git/config 444; GET /.env 444; GET /.env.local 444. UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like. Detected by fail2ban. show less	Web App Attack
🇩🇪 93.152.221.41	15 hours ago	Exploit and secret-file scanning on HTTP(S) port 80/443. 5 requests, 2026-11-03 12:48 UTC. Samples: ... show more Exploit and secret-file scanning on HTTP(S) port 80/443. 5 requests, 2026-11-03 12:48 UTC. Samples: GET /phpinfo 444; GET /_profiler/phpinfo 444; GET /_profiler/phpinfo.php 444. UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 14_7) AppleWebKit/605.1.15 (KHTML, like G. Detected by fail2ban. show less	Web App Attack
🇺🇸 34.29.4.130	16 hours ago	Exploit and secret-file scanning on HTTP(S) port 80/443. 5 requests, 2026-11-03 12:35 UTC. Samples: ... show more Exploit and secret-file scanning on HTTP(S) port 80/443. 5 requests, 2026-11-03 12:35 UTC. Samples: GET //wp-includes/wlwmanifest.xml 444; GET //xmlrpc.php 444. UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko). Detected by fail2ban. show less	Web App Attack
🇳🇱 217.60.102.51	16 hours ago	Exploit and secret-file scanning on HTTP(S) port 80/443. 5 requests, 2026-11-03 12:04 UTC. Samples: ... show more Exploit and secret-file scanning on HTTP(S) port 80/443. 5 requests, 2026-11-03 12:04 UTC. Samples: GET /.env 444; GET /.env.production 444; GET /.env.save 444. UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko). Detected by fail2ban. show less	Web App Attack
🇺🇸 136.64.27.197	16 hours ago	Exploit and secret-file scanning on HTTP(S) port 80/443. 5 requests, 2026-11-03 11:57 UTC. Samples: ... show more Exploit and secret-file scanning on HTTP(S) port 80/443. 5 requests, 2026-11-03 11:57 UTC. Samples: GET /.git/config 444; GET /.env 444; GET /.env.local 444. UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko). Detected by fail2ban. show less	Web App Attack
🇫🇷 169.40.142.132	16 hours ago	Exploit and secret-file scanning on HTTP(S) port 80/443. 5 requests, 2026-11-03 12:01 UTC. Samples: ... show more Exploit and secret-file scanning on HTTP(S) port 80/443. 5 requests, 2026-11-03 12:01 UTC. Samples: GET /.env.bak 444; GET /.env.old 444; GET /.env.dev 444. UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko). Detected by fail2ban. show less	Web App Attack
🇳🇱 2a0f:ca80:b00b:60ee::5	16 hours ago	Exploit and secret-file scanning on HTTP(S) port 80/443. 5 requests, 2026-11-02 12:12 UTC. Samples: ... show more Exploit and secret-file scanning on HTTP(S) port 80/443. 5 requests, 2026-11-02 12:12 UTC. Samples: GET /.git/config 444; GET /phpinfo 444; GET /_profiler/phpinfo 444. UA: Mozilla/5.0 (iPhone; CPU iPhone OS 18_4 like Mac OS X) AppleWebKit/605.1.15 (KHT. Detected by fail2ban. show less	Web App Attack
🇺🇸 35.245.31.204	16 hours ago	Exploit and secret-file scanning on HTTP(S) port 80/443. 5 requests, 2026-11-03 11:38 UTC. Samples: ... show more Exploit and secret-file scanning on HTTP(S) port 80/443. 5 requests, 2026-11-03 11:38 UTC. Samples: GET /assets../.env 444. Fake crawler: the User-Agent claims "Baiduspider", but this IP is not a verified Baiduspider address. UA: Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.ht. Detected by fail2ban. show less	Web App Attack
🇺🇸 45.92.229.26	17 hours ago	WordPress login brute force on HTTP(S) port 80/443. 20 requests, 2026-11-03 11:20 UTC. Samples: POST ... show more WordPress login brute force on HTTP(S) port 80/443. 20 requests, 2026-11-03 11:20 UTC. Samples: POST /wp-login.php 302; GET /wp-admin/index.php 302. UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, lik. Detected by fail2ban. show less	Brute-Force Web App Attack
🇺🇸 216.73.161.150	17 hours ago	WordPress login brute force on HTTP(S) port 80/443. 20 requests, 2026-11-03 11:23 UTC. Samples: POST ... show more WordPress login brute force on HTTP(S) port 80/443. 20 requests, 2026-11-03 11:23 UTC. Samples: POST /wp-login.php 302; GET /wp-admin/index.php 302. UA: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91. Detected by fail2ban. show less	Brute-Force Web App Attack
🇺🇸 45.92.229.15	17 hours ago	WordPress login brute force on HTTP(S) port 80/443. 20 requests, 2026-11-03 11:19 UTC. Samples: POST ... show more WordPress login brute force on HTTP(S) port 80/443. 20 requests, 2026-11-03 11:19 UTC. Samples: POST /wp-login.php 302; GET /wp-admin/index.php 302. UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/605.1.15 (KHTML, like Geck. Detected by fail2ban. show less	Brute-Force Web App Attack
🇺🇸 216.73.161.142	17 hours ago	WordPress login brute force on HTTP(S) port 80/443. 20 requests, 2026-11-03 11:16 UTC. Samples: POST ... show more WordPress login brute force on HTTP(S) port 80/443. 20 requests, 2026-11-03 11:16 UTC. Samples: POST /wp-login.php 302; GET /wp-admin/index.php 302. UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/605.1.15 (KHTML, like Geck. Detected by fail2ban. show less	Brute-Force Web App Attack
🇺🇸 45.92.229.14	17 hours ago	WordPress login brute force on HTTP(S) port 80/443. 20 requests, 2026-11-03 11:10 UTC. Samples: POST ... show more WordPress login brute force on HTTP(S) port 80/443. 20 requests, 2026-11-03 11:10 UTC. Samples: POST /wp-login.php 302; GET /wp-admin/index.php 302. UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like. Detected by fail2ban. show less	Brute-Force Web App Attack
🇺🇸 45.92.229.16	17 hours ago	WordPress login brute force on HTTP(S) port 80/443. 20 requests, 2026-11-03 11:11 UTC. Samples: POST ... show more WordPress login brute force on HTTP(S) port 80/443. 20 requests, 2026-11-03 11:11 UTC. Samples: POST /wp-login.php 302; GET /wp-admin/index.php 302. UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko). Detected by fail2ban. show less	Brute-Force Web App Attack
🇺🇸 45.92.229.34	17 hours ago	WordPress login brute force on HTTP(S) port 80/443. 20 requests, 2026-11-03 11:12 UTC. Samples: POST ... show more WordPress login brute force on HTTP(S) port 80/443. 20 requests, 2026-11-03 11:12 UTC. Samples: POST /wp-login.php 302; GET /wp-admin/index.php 302. UA: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko). Detected by fail2ban. show less	Brute-Force Web App Attack
🇮🇩 34.50.121.36	18 hours ago	Exploit and secret-file scanning on HTTP(S) port 80/443. 5 requests, 2026-11-03 10:26 UTC. Samples: ... show more Exploit and secret-file scanning on HTTP(S) port 80/443. 5 requests, 2026-11-03 10:26 UTC. Samples: GET /.git/config 444; GET /.env 444; GET /.env.local 444. UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko). Detected by fail2ban. show less	Web App Attack
🇺🇸 45.61.188.238	18 hours ago	Exploit and secret-file scanning on HTTP(S) port 80/443. 5 requests, 2026-11-03 10:22 UTC. Samples: ... show more Exploit and secret-file scanning on HTTP(S) port 80/443. 5 requests, 2026-11-03 10:22 UTC. Samples: GET /wp-content/plugins/wp_ukjnoiy/wp_ukjnoiy.php 444. UA: python-requests/2.34.2. Detected by fail2ban. show less	Web App Attack
🇺🇦 213.139.213.36	18 hours ago	Exploit and secret-file scanning on HTTP(S) port 80/443. 5 requests, 2026-11-03 10:20 UTC. Samples: ... show more Exploit and secret-file scanning on HTTP(S) port 80/443. 5 requests, 2026-11-03 10:20 UTC. Samples: GET /.env.backup 444; GET /.env 444; GET /.env.bak 444. UA: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/11. Detected by fail2ban. show less	Web App Attack
🇦🇺 34.40.227.174	18 hours ago	Exploit and secret-file scanning on HTTP(S) port 80/443. 5 requests, 2026-11-03 10:05 UTC. Samples: ... show more Exploit and secret-file scanning on HTTP(S) port 80/443. 5 requests, 2026-11-03 10:05 UTC. Samples: GET /.git/config 444; GET /.env 444; GET /.env.local 444. UA: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/13. Detected by fail2ban. show less	Web App Attack
🇺🇸 34.127.30.239	18 hours ago	Exploit and secret-file scanning on HTTP(S) port 80/443. 5 requests, 2026-11-03 09:49 UTC. Samples: ... show more Exploit and secret-file scanning on HTTP(S) port 80/443. 5 requests, 2026-11-03 09:49 UTC. Samples: GET /.env 444; GET /api/.env 444. UA: Go-http-client/2.0. Detected by fail2ban. show less	Web App Attack
🇩🇪 64.89.163.34	18 hours ago	Exploit and secret-file scanning on HTTP(S) port 80/443. 5 requests, 2026-11-03 09:38 UTC. Samples: ... show more Exploit and secret-file scanning on HTTP(S) port 80/443. 5 requests, 2026-11-03 09:38 UTC. Samples: GET /wp-content/themes/seotheme/db.php 444; GET /wp-content/plugins/fix/up.php 444; POST /ALFA_DATA/alfacgiapi/perl.alfa 444. UA: Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (. Detected by fail2ban. show less	Web App Attack
🇦🇪 20.74.238.220	18 hours ago	Webshell/backdoor probing + exploit and secret-file scanning on HTTP(S) port 80/443. 5 requests, 202 ... show more Webshell/backdoor probing + exploit and secret-file scanning on HTTP(S) port 80/443. 5 requests, 2026-11-03 09:38 UTC. Samples: GET /wp-content/plugins/hellopress/wp_filemanager.php 444. Detected by fail2ban. show less	Hacking Web App Attack
🇩🇪 20.218.73.251	18 hours ago	Webshell/backdoor probing + exploit and secret-file scanning on HTTP(S) port 80/443. 6 requests acro ... show more Webshell/backdoor probing + exploit and secret-file scanning on HTTP(S) port 80/443. 6 requests across 2 of our servers, 2026-11-02 18:25-20:57 UTC. Samples: GET /wp-content/plugins/hellopress/wp_filemanager.php 404; GET /wp-content/plugins/hellopress/wp_filemanager.php 444. Detected by fail2ban. show less	Hacking Web App Attack
🇫🇷 185.194.178.36	18 hours ago	Webshell/backdoor probing + exploit and secret-file scanning on HTTP(S) port 80/443. 5 requests, 202 ... show more Webshell/backdoor probing + exploit and secret-file scanning on HTTP(S) port 80/443. 5 requests, 2026-11-03 09:38 UTC. Samples: GET /.well-known/acme-challenge/install.php 444; GET /.well-known/acme-challenge/plugins.php 444; GET /.well-known/acme-challenge/license.php 444. UA: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko). Detected by fail2ban. show less	Hacking Web App Attack