AbuseIPDB

JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

User el-brujo , the webmaster of elhacker.net, joined AbuseIPDB in January 2021 and has reported 4,247,823 IP addresses.

Standing (weight) is good.

ACTIVE USER WEBMASTER SUPPORTER

IP	Date	Comment	Categories
🇺🇸 35.255.22.29	9 hours ago	04/Nov/2026:08:54:01.142244 +0100Apache-Error: [file "apache2_util.c"] [line 271] [level 3] [client ... show more 04/Nov/2026:08:54:01.142244 +0100Apache-Error: [file "apache2_util.c"] [line 271] [level 3] [client 35.255.22.29] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/httpd/modsecurity.d/activated_rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1056"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".resources"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.5"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "vlc.elhacker.net"] [uri "/vlc-winrt/3.0.1/VLC ... show less	Hacking Web App Attack
🇧🇷 186.215.197.13	9 hours ago	Cowrie Honeypot: 2 unauthorised SSH/Telnet login attempts between 2026-11-04T07:53:52Z and 2026-11-0 ... show more Cowrie Honeypot: 2 unauthorised SSH/Telnet login attempts between 2026-11-04T07:53:52Z and 2026-11-04T07:53:55Z show less	Brute-Force SSH
🇰🇷 20.194.27.148	9 hours ago	04/Nov/2026:08:53:34 +0100cf-connecting-ip: 20.194.27.148 04/Nov/2026:08:53:34 +0100 04/Nov/2026:08: ... show more 04/Nov/2026:08:53:34 +0100cf-connecting-ip: 20.194.27.148 04/Nov/2026:08:53:34 +0100 04/Nov/2026:08:53:34 +0100---JhB95xaR---D-- 04/Nov/2026:08:53:34 +0100 04/Nov/2026:08:53:34 +0100---JhB95xaR---E-- 04/Nov/2026:08:53:34 +0100<html>\x0d\x0a<head><title>403 Forbidden</title></head>\x0d\x0a<body>\x0d\x0a<center><h1>403 Forbidden</h1></center>\x0d\x0a<hr><center>nginx</center>\x0d\x0a</body>\x0d\x0a</html>\x0d\x0a<!-- a padding to disable MSIE and Chrome friendly error page -->\x0d\x0a<!-- a padding to disable MSIE and Chrome friendly error page -->\x0d\x0a<!-- a padding to disable MSIE and Chrome friendly error page -->\x0d\x0a<!-- a padding to disable MSIE and Chrome friendly error page -->\x0d\x0a<!-- a padding to disable MSIE and Chrome friendly error page -->\x0d\x0a<!-- a padding to disable MSIE and Chrome friendly error page -->\x0d\x0a 04/Nov/2026:08:53:34 +0100 04/Nov/2026:08:53:34 +0100---JhB95xaR---F-- 04/Nov/2026:08:53:34 +0100HTTP/2.0 403 ... show less	Hacking Web App Attack
🇮🇳 103.191.204.229	9 hours ago	2026-11-04T07:14:15.066715 ns2.elhacker.net postfix/smtpd[238570]: warning: unknown[103.191.204.229] ... show more 2026-11-04T07:14:15.066715 ns2.elhacker.net postfix/smtpd[238570]: warning: unknown[103.191.204.229]: SASL PLAIN authentication failed: authentication failure, [email protected] 2026-11-04T08:52:07.646570 ns2.elhacker.net postfix/smtpd[283834]: warning: unknown[103.191.204.229]: SASL PLAIN authentication failed: authentication failure, sasl_username=christian010 ... show less	Hacking Brute-Force
🇲🇾 59.153.151.174	9 hours ago	T-Pot Honeypot (Cowrie): Automated attack on port 22/SSH	Brute-Force SSH
🇰🇷 119.204.122.94	9 hours ago	T-Pot Honeypot (Cowrie): Automated attack on port 22/SSH	Brute-Force SSH
🇺🇸 216.25.90.102	9 hours ago	T-Pot Honeypot (Honeypots): Automated attack on port 389/LDAP	Port Scan Hacking
🇵🇪 200.107.163.195	9 hours ago	2026-11-04T05:18:21.315332 ns2.elhacker.net postfix/smtpd[183658]: warning: unknown[200.107.163.195] ... show more 2026-11-04T05:18:21.315332 ns2.elhacker.net postfix/smtpd[183658]: warning: unknown[200.107.163.195]: SASL PLAIN authentication failed: authentication failure, [email protected] 2026-11-04T08:51:33.838490 ns2.elhacker.net postfix/smtpd[283834]: warning: unknown[200.107.163.195]: SASL PLAIN authentication failed: authentication failure, [email protected] ... show less	Hacking Brute-Force
🇺🇸 38.107.226.171	9 hours ago	04/Nov/2026:08:50:27.186587 +0100Apache-Error: [file "apache2_util.c"] [line 271] [level 3] [client ... show more 04/Nov/2026:08:50:27.186587 +0100Apache-Error: [file "apache2_util.c"] [line 271] [level 3] [client 38.107.226.171] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/httpd/modsecurity.d/activated_rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1056"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.5"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "tails.elhacker.net"] [uri "/.svn/wc.db"] [unique_i ... show less	Hacking Web App Attack
🇺🇸 34.56.240.66	9 hours ago	04/Nov/2026:08:49:38.432264 +0100Apache-Error: [file "apache2_util.c"] [line 271] [level 3] [client ... show more 04/Nov/2026:08:49:38.432264 +0100Apache-Error: [file "apache2_util.c"] [line 271] [level 3] [client 34.56.240.66] ModSecurity: Access denied with code 406 (phase 2). Pattern match "\\\\\\\\.\\\\\\\\./" at REQUEST_URI. [file "/etc/httpd/conf.d/mod_security.conf"] [line "127"] [id "500002"] [hostname "warzone.elhacker.net"] [uri "/laravel../config/database.php"] [unique_id "aurjkseY4D1YUIeF1bNdCgAAsAg"] ... show less	Hacking Web App Attack
🇺🇸 38.114.122.234	9 hours ago	04/Nov/2026:08:47:00.264521 +0100Apache-Error: [file "apache2_util.c"] [line 271] [level 3] [client ... show more 04/Nov/2026:08:47:00.264521 +0100Apache-Error: [file "apache2_util.c"] [line 271] [level 3] [client 38.114.122.234] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/httpd/modsecurity.d/activated_rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1056"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.5"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "vlc.elhacker.net"] [uri "/.svn/wc.db"] [unique_id ... show less	Hacking Web App Attack
🇺🇸 38.99.82.124	9 hours ago	04/Nov/2026:08:46:10.607045 +0100Apache-Error: [file "apache2_util.c"] [line 271] [level 3] [client ... show more 04/Nov/2026:08:46:10.607045 +0100Apache-Error: [file "apache2_util.c"] [line 271] [level 3] [client 38.99.82.124] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/httpd/modsecurity.d/activated_rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1056"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.5"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "parrot.elhacker.net"] [uri "/.svn/wc.db"] [unique_id ... show less	Hacking Web App Attack
🇮🇱 46.210.82.75	9 hours ago	T-Pot Honeypot (Honeypots): Automated attack on port 5900/VNC	Hacking Web App Attack
🇺🇸 67.220.85.68	9 hours ago	Cloudflare WAF: Request Path: /.svn/entries Request Query: Host: cloudflare.elhacker.net userAgent: ... show more Cloudflare WAF: Request Path: /.svn/entries Request Query: Host: cloudflare.elhacker.net userAgent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:115.0) Gecko/20100101 Firefox/115.0 Action: block Source: firewallManaged ASN Description: GTHost Country: US Method: GET Timestamp: 2026-11-04T07:44:34Z ruleId: 23548ee2b36547a1be09bb2c0550c529. show less	Hacking SQL Injection Web App Attack
🇺🇸 67.220.74.251	9 hours ago	04/Nov/2026:08:44:14.302402 +0100Apache-Error: [file "apache2_util.c"] [line 271] [level 3] [client ... show more 04/Nov/2026:08:44:14.302402 +0100Apache-Error: [file "apache2_util.c"] [line 271] [level 3] [client 67.220.74.251] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/httpd/modsecurity.d/activated_rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1056"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.5"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "alpine.elhacker.net"] [uri "/.svn/wc.db"] [unique_i ... show less	Hacking Web App Attack
🇮🇶 65.20.138.3	9 hours ago	T-Pot Honeypot (Cowrie): Automated attack on port 25/SMTP	Email Spam Hacking
🇹🇼 211.22.222.251	9 hours ago	T-Pot Honeypot (Cowrie): Automated attack on port 22/SSH	Brute-Force SSH
172.17.252.49	9 hours ago	04/Nov/2026:08:42:14 +0100x-originating-ip: 172.17.252.49 04/Nov/2026:08:42:14 +0100cf-visitor: {"sc ... show more 04/Nov/2026:08:42:14 +0100x-originating-ip: 172.17.252.49 04/Nov/2026:08:42:14 +0100cf-visitor: {"scheme":"https"} 04/Nov/2026:08:42:14 +0100 04/Nov/2026:08:42:14 +0100---NHBFpQnT---D-- 04/Nov/2026:08:42:14 +0100 04/Nov/2026:08:42:14 +0100---NHBFpQnT---E-- 04/Nov/2026:08:42:14 +0100<html>\x0d\x0a<head><title>403 Forbidden</title></head>\x0d\x0a<body>\x0d\x0a<center><h1>403 Forbidden</h1></center>\x0d\x0a<hr><center>nginx</center>\x0d\x0a</body>\x0d\x0a</html>\x0d\x0a 04/Nov/2026:08:42:14 +0100 04/Nov/2026:08:42:14 +0100---NHBFpQnT---F-- 04/Nov/2026:08:42:14 +0100HTTP/2.0 403 ... show less	Hacking Web App Attack
10.108.196.114	9 hours ago	04/Nov/2026:08:42:14 +0100x-custom-ip-authorization: 10.108.196.114 04/Nov/2026:08:42:14 +0100cf-vis ... show more 04/Nov/2026:08:42:14 +0100x-custom-ip-authorization: 10.108.196.114 04/Nov/2026:08:42:14 +0100cf-visitor: {"scheme":"https"} 04/Nov/2026:08:42:14 +0100 04/Nov/2026:08:42:14 +0100---SE84zpbV---D-- 04/Nov/2026:08:42:14 +0100 04/Nov/2026:08:42:14 +0100---SE84zpbV---E-- 04/Nov/2026:08:42:14 +0100<html>\x0d\x0a<head><title>403 Forbidden</title></head>\x0d\x0a<body>\x0d\x0a<center><h1>403 Forbidden</h1></center>\x0d\x0a<hr><center>nginx</center>\x0d\x0a</body>\x0d\x0a</html>\x0d\x0a 04/Nov/2026:08:42:14 +0100 04/Nov/2026:08:42:14 +0100---SE84zpbV---F-- 04/Nov/2026:08:42:14 +0100HTTP/2.0 403 ... show less	Hacking Web App Attack
172.20.254.114	9 hours ago	04/Nov/2026:08:42:13 +0100x-custom-ip-authorization: 172.20.254.114 04/Nov/2026:08:42:13 +0100cf-vis ... show more 04/Nov/2026:08:42:13 +0100x-custom-ip-authorization: 172.20.254.114 04/Nov/2026:08:42:13 +0100cf-visitor: {"scheme":"https"} 04/Nov/2026:08:42:13 +0100 04/Nov/2026:08:42:13 +0100---WaiisYFa---D-- 04/Nov/2026:08:42:13 +0100 04/Nov/2026:08:42:13 +0100---WaiisYFa---E-- 04/Nov/2026:08:42:13 +0100<html>\x0d\x0a<head><title>403 Forbidden</title></head>\x0d\x0a<body>\x0d\x0a<center><h1>403 Forbidden</h1></center>\x0d\x0a<hr><center>nginx</center>\x0d\x0a</body>\x0d\x0a</html>\x0d\x0a 04/Nov/2026:08:42:13 +0100 04/Nov/2026:08:42:13 +0100---WaiisYFa---F-- 04/Nov/2026:08:42:13 +0100HTTP/2.0 403 ... show less	Hacking Web App Attack
10.85.170.13	9 hours ago	04/Nov/2026:08:42:13 +0100x-custom-ip-authorization: 10.85.170.13 04/Nov/2026:08:42:13 +0100cf-visit ... show more 04/Nov/2026:08:42:13 +0100x-custom-ip-authorization: 10.85.170.13 04/Nov/2026:08:42:13 +0100cf-visitor: {"scheme":"https"} 04/Nov/2026:08:42:13 +0100 04/Nov/2026:08:42:13 +0100---ezcP1JsN---D-- 04/Nov/2026:08:42:13 +0100 04/Nov/2026:08:42:13 +0100---ezcP1JsN---E-- 04/Nov/2026:08:42:13 +0100<html>\x0d\x0a<head><title>403 Forbidden</title></head>\x0d\x0a<body>\x0d\x0a<center><h1>403 Forbidden</h1></center>\x0d\x0a<hr><center>nginx</center>\x0d\x0a</body>\x0d\x0a</html>\x0d\x0a 04/Nov/2026:08:42:13 +0100 04/Nov/2026:08:42:13 +0100---ezcP1JsN---F-- 04/Nov/2026:08:42:13 +0100HTTP/2.0 403 ... show less	Hacking Web App Attack
10.115.196.96	9 hours ago	04/Nov/2026:08:42:09 +0100x-remote-ip: 10.115.196.96 04/Nov/2026:08:42:09 +0100cf-visitor: {"scheme" ... show more 04/Nov/2026:08:42:09 +0100x-remote-ip: 10.115.196.96 04/Nov/2026:08:42:09 +0100cf-visitor: {"scheme":"https"} 04/Nov/2026:08:42:09 +0100 04/Nov/2026:08:42:09 +0100---ult9CHsW---D-- 04/Nov/2026:08:42:09 +0100 04/Nov/2026:08:42:09 +0100---ult9CHsW---E-- 04/Nov/2026:08:42:09 +0100<html>\x0d\x0a<head><title>403 Forbidden</title></head>\x0d\x0a<body>\x0d\x0a<center><h1>403 Forbidden</h1></center>\x0d\x0a<hr><center>nginx</center>\x0d\x0a</body>\x0d\x0a</html>\x0d\x0a 04/Nov/2026:08:42:09 +0100 04/Nov/2026:08:42:09 +0100---ult9CHsW---F-- 04/Nov/2026:08:42:09 +0100HTTP/2.0 403 ... show less	Hacking Web App Attack
192.168.67.32	9 hours ago	04/Nov/2026:08:42:07 +0100x-custom-ip-authorization: 192.168.67.32 04/Nov/2026:08:42:07 +0100cf-visi ... show more 04/Nov/2026:08:42:07 +0100x-custom-ip-authorization: 192.168.67.32 04/Nov/2026:08:42:07 +0100cf-visitor: {"scheme":"https"} 04/Nov/2026:08:42:07 +0100 04/Nov/2026:08:42:07 +0100---8tpcERQj---D-- 04/Nov/2026:08:42:07 +0100 04/Nov/2026:08:42:07 +0100---8tpcERQj---E-- 04/Nov/2026:08:42:07 +0100<html>\x0d\x0a<head><title>403 Forbidden</title></head>\x0d\x0a<body>\x0d\x0a<center><h1>403 Forbidden</h1></center>\x0d\x0a<hr><center>nginx</center>\x0d\x0a</body>\x0d\x0a</html>\x0d\x0a 04/Nov/2026:08:42:07 +0100 04/Nov/2026:08:42:07 +0100---8tpcERQj---F-- 04/Nov/2026:08:42:07 +0100HTTP/2.0 403 ... show less	Hacking Web App Attack
172.18.96.130	9 hours ago	04/Nov/2026:08:42:09 +0100x-custom-ip-authorization: 172.18.96.130 04/Nov/2026:08:42:09 +0100cf-visi ... show more 04/Nov/2026:08:42:09 +0100x-custom-ip-authorization: 172.18.96.130 04/Nov/2026:08:42:09 +0100cf-visitor: {"scheme":"https"} 04/Nov/2026:08:42:09 +0100 04/Nov/2026:08:42:09 +0100---lI5NfqxX---D-- 04/Nov/2026:08:42:09 +0100 04/Nov/2026:08:42:09 +0100---lI5NfqxX---E-- 04/Nov/2026:08:42:09 +0100<html>\x0d\x0a<head><title>403 Forbidden</title></head>\x0d\x0a<body>\x0d\x0a<center><h1>403 Forbidden</h1></center>\x0d\x0a<hr><center>nginx</center>\x0d\x0a</body>\x0d\x0a</html>\x0d\x0a 04/Nov/2026:08:42:09 +0100 04/Nov/2026:08:42:09 +0100---lI5NfqxX---F-- 04/Nov/2026:08:42:09 +0100HTTP/2.0 403 ... show less	Hacking Web App Attack
10.77.60.177	9 hours ago	04/Nov/2026:08:42:07 +0100x-custom-ip-authorization: 10.77.60.177 04/Nov/2026:08:42:07 +0100cf-visit ... show more 04/Nov/2026:08:42:07 +0100x-custom-ip-authorization: 10.77.60.177 04/Nov/2026:08:42:07 +0100cf-visitor: {"scheme":"https"} 04/Nov/2026:08:42:07 +0100 04/Nov/2026:08:42:07 +0100---zWeugQHT---D-- 04/Nov/2026:08:42:07 +0100 04/Nov/2026:08:42:07 +0100---zWeugQHT---E-- 04/Nov/2026:08:42:07 +0100<html>\x0d\x0a<head><title>403 Forbidden</title></head>\x0d\x0a<body>\x0d\x0a<center><h1>403 Forbidden</h1></center>\x0d\x0a<hr><center>nginx</center>\x0d\x0a</body>\x0d\x0a</html>\x0d\x0a 04/Nov/2026:08:42:07 +0100 04/Nov/2026:08:42:07 +0100---zWeugQHT---F-- 04/Nov/2026:08:42:07 +0100HTTP/2.0 403 ... show less	Hacking Web App Attack