Renee Kraft - AbuseIPDB User Profile

JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

User Renee Kraft joined AbuseIPDB in August 2022 and has reported 24 IP addresses.

Standing (weight) is good.

INACTIVE USER

IP	Date	Comment	Categories
🇺🇸 43.231.234.223	26 Sep 2023	Checking for WP vulnerabilities	Web App Attack
🇺🇸 172.173.122.196	12 Sep 2023	WP vulnerability scan	Web App Attack
🇺🇸 172.173.124.147	12 Sep 2023	WP vulnerability scan	Web App Attack
🇺🇸 74.249.173.54	12 Sep 2023	WP vulnerability scan	Web Spam
🇺🇸 104.128.67.14	12 Sep 2023	Vulnerability scan	Web App Attack
🇺🇸 104.128.67.14	30 Aug 2023	Vulnerability scan	Web App Attack
🇮🇳 154.61.75.95	16 Aug 2023	Tried to access exploited host files: /PRN.Ms4u10ut.cer， /js/EiDIA.asp，/js/RKY6d2.php, etc.	Exploited Host
🇺🇸 66.55.68.172	16 Aug 2023	Wordpress probing (WP is not installed on our server)	Web App Attack
🇺🇸 40.78.159.84	16 Aug 2023	Wordpress attack (not installed on our server)	Web App Attack
🇩🇪 3.124.3.208	19 Jul 2023	450 .git/HEAD attempts, almost all in this format: /14046/.git/HEAD /8636/.git/HEAD	Bad Web Bot
🇷🇺 109.237.96.179	19 Jul 2023	Scanning for non-existing ALFA_DATA files	Bad Web Bot
🇺🇸 4.150.53.167	19 Jul 2023	240 hits on non-existing wp php files	Bad Web Bot
🇮🇳 45.64.104.2	08 Jun 2023	Tried to access files previously infiltrated, such as (fake) .cer files and files hidden in js subfo ... show more Tried to access files previously infiltrated, such as (fake) .cer files and files hidden in js subfolders, for example PRN.Ms4u10ut.cer and js/EiDIA.asp. show less	Hacking Web App Attack
🇱🇹 141.98.11.132	08 Jun 2023	Scanning for website/db backups	Web App Attack
🇹🇷 37.148.211.128	10 May 2023	Tried to access files previously infiltrated, such as (fake) .cer files and files hidden in js subfo ... show more Tried to access files previously infiltrated, such as (fake) .cer files and files hidden in js subfolders, for example PRN.Ms4u10ut.cer and js/EiDIA.asp. show less	Hacking Web App Attack
🇫🇷 20.199.10.161	26 Apr 2023	Attempts to exploit CMS vulnerabilities, etc.	Hacking SQL Injection Web App Attack
🇨🇭 51.103.219.212	13 Apr 2023	/ysyqq.php - 80 - 51.103.219.212 HTTP/1.1 Mozilla/5.0+(Windows;+U;+Windows+NT+6.0;+en-US)+AppleWebKi ... show more /ysyqq.php - 80 - 51.103.219.212 HTTP/1.1 Mozilla/5.0+(Windows;+U;+Windows+NT+6.0;+en-US)+AppleWebKit/530.5+(KHTML,+like+Gecko)+Chrome/2.0.172.40+Safari/530.5 http://www.greenvalue.de/ysyqq.php www.greenvalue.de 301 0 0 418 566 10 Line 23712: 2023-04-10 12:21:43 78.159.119.242 GET / s=/index/%5Cthink%5Capp/invokefunction&function=call_user_func_array&vars%5B0%5D=file_put_contents&vars%5B1%5D%5B%5D=kkaov.php&vars%5B1%5D%5B%5D=%3C?php%20mb_ere... show less	Hacking SQL Injection Web App Attack
🇭🇰 193.227.121.6	13 Apr 2023	600 entries in our log file, many different approaches to inject and execute code, such as: /plus/m ... show more 600 entries in our log file, many different approaches to inject and execute code, such as: /plus/mytag_js.php dopost=saveedit&arrs1%5B%5D=99&arrs1%5B%5D=102&arrs1%5B%5D=103&arrs1%5B%5D=95&arrs1%5B%5D=100&arrs1%5B%5D=98&arrs1%5B%5D=112&a... show less	Hacking SQL Injection
🇭🇰 203.91.85.91	21 Mar 2023	Uploaded a file "admins.php" into to php-mailer and a js subfolder.	Hacking Exploited Host
🇺🇸 173.225.99.68	09 Mar 2023	Unsuccessful attempt to access infiltrated files /PRN.Ms4u10ut.cer /js/TtBj762d.aspx /js/EiDIA.a ... show more Unsuccessful attempt to access infiltrated files /PRN.Ms4u10ut.cer /js/TtBj762d.aspx /js/EiDIA.as /js/RKY6d2.php /PRN.Ms4u10ut.cer etc. show less	Web App Attack
🇮🇳 164.52.194.26	09 Mar 2023	Attempt to access infiltrated files /PRN.Ms4u10ut.cer /js/EiDIA.asp /js/RKY6d2.php /js/TtBj762d ... show more Attempt to access infiltrated files /PRN.Ms4u10ut.cer /js/EiDIA.asp /js/RKY6d2.php /js/TtBj762d.aspx etc. show less	Hacking Web App Attack
🇲🇾 202.75.62.167	26 Oct 2022	Over 4200 probes for vulnerable files, uploaded x.cer (fake certificate file). Also found in logfile ... show more Over 4200 probes for vulnerable files, uploaded x.cer (fake certificate file). Also found in logfiles on another server in another country. show less	Hacking Web App Attack
🇬🇧 88.214.25.4	27 Sep 2022	SQL Injection	SQL Injection
🇹🇷 147.78.47.32	13 Sep 2022	ViewState (possibly “Praying Mantis” or “TG1021”) exploit. Over 900 lines in IIS log on Nov 11, 202 ... show more ViewState (possibly “Praying Mantis” or “TG1021”) exploit. Over 900 lines in IIS log on Nov 11, 2022: 2022-09-11 16:19:20 159.122.211.116 GET /68 ID=&__VIEWSTATE=&__VIEWSTATEGENERATOR= 80 - 147.78.47.32 HTTP/1.1 Mozilla/5.0+(X11;+U;+Linux+x86_64;+el-GR;+rv:1.9.2.10)+Gecko/20100922+Ubuntu/10.10+(maverick)+Firefox/3.6.10 - www.greenvalue.de 301 0 0 508 463 10 2022-09-11 16:19:22 159.122.211.116 GET /68 ID=&__VIEWSTATE=&__VIEWSTATEGENERATOR=&bPkz%3D6036%20AND%201%3D1%20UNION%20ALL%20SELECT%201%2CNULL%2C%27%3Cscript%3Ealert%28%22XSS%22%29%3C%2Fscript%3E%27%2Ctable_name%20FROM%20information_schema.tables%20WHERE%202%3E1--%2F%2A%2A%2F%3B%20EXEC%20xp_cmdshell%28%27cat%20..%2F..%2F..%2Fetc%2Fpasswd%27%29%23 80 - 147.78.47.32 HTTP/1.1 Mozilla/5.0+(X11;+U;+Linux+x86_64;+el-GR;+rv:1.9.2.10)+Gecko/20100922+Ubuntu/10.10+(maverick)+Firefox/3.6.10 - www.greenvalue.de 301 0 0 1044 729 50 2022-09-11 16:19:23 159.122.211.116 GET /68 ID=&__VIEWSTATE=&__VIEWSTATEGENERATOR= 80 - 147.78.47.32 HTTP/1.1 Mozilla/5.0+ show less	SQL Injection