JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

104.131.163.128

Activity Trending Down

Abuse Confidence Score

89% Critical

189 reports

102 reporters · latest 2 weeks ago

ISP: DigitalOcean, LLC
Usage Type: Data Center/Web Hosting/Transit
ASN: AS14061
Domain Name: digitalocean.com
Country: 🇺🇸 United States of America
City: Clifton, New Jersey

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Example preview

Account required for the enhanced features Log in Sign up

Abuse Reports

Export reports CSV

Total reports

189 from 102 distinct reporters

First reported

March 8th 2021

Most recent report

2 weeks ago

Last 60 days

Top reporter locations 🇩🇪 Germany 31 🇺🇸 United States of America 20 🇳🇱 Netherlands 15

Most common categories Web App Attack 92 Bad Web Bot 36 Hacking 16 Brute-Force 14 Exploited Host 14

Old reports The most recent abuse report for this IP address is from 2 weeks ago. It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 Mailguard-FRD	2026-10-11 04:21:36 (2 weeks ago)	Oct 11 06:21:35 [redacted] postfix/smtps/smtpd[23011]: lost connection after CONNECT from unknown[104.131.163.128] ...	Email Spam Brute-Force
Anonymous	2026-10-11 03:44:43 (2 weeks ago)	denied traffic to a honeypot network. destination port 53.	Port Scan Hacking
🇦🇺 PetePK	2026-10-11 02:29:03 (2 weeks ago)	Probed 1 time(s): TCP/8000	Port Scan
🇳🇱 Alt255	2026-10-09 04:33:03 (3 weeks ago)	[cb-01vi] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 104.131.163.128 - - [09/Oct/2026:06:32:44 +0200] "GET /.env HTTP/1.1" 301 518 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 ( ... show more [cb-01vi] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 104.131.163.128 - - [09/Oct/2026:06:32:44 +0200] "GET /.env HTTP/1.1" 301 518 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" ... show less	Bad Web Bot Web App Attack
🇬🇧 consul.to	2026-10-08 08:03:12 (3 weeks ago)	Web attack/malicious scanning detected	Web App Attack
🇫🇷 masterguru	2026-10-08 06:41:14 (3 weeks ago)	Restricted File Access Attempt. Matched phrase ".env" at REQUEST_FILENAME. (930130-201)	Hacking Web App Attack
🇺🇦 URAN Publishing Service	2026-10-08 01:00:11 (3 weeks ago)	[08/Oct/2026:04:00:04 +0300] -- 104.131.163.128 Ban reason: Scanner [SENSITIVE_FILES] \| Request: GET /api/.env HTTP/1.1	Bad Web Bot Web App Attack
🇳🇱 e.fierstra	2026-10-07 15:56:38 (3 weeks ago)	ModSecurity hits exceeded	Bad Web Bot Web App Attack
🇳🇱 debestelapp	2026-10-07 13:50:08 (3 weeks ago)		Web App Attack
Anonymous	2026-10-07 13:05:02 (3 weeks ago)	Blocked: Reason='Suspicious traffic score=80 (review-based detection)'; Requests=26	Hacking
🇳🇱 Alt255	2026-10-07 06:34:31 (3 weeks ago)	[ti-03tr] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 104.131.163.128 - - [07/Oct/2026:08:34:25 +0200] "GET /.env HTTP/1.1" 404 2105 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 ... show more [ti-03tr] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 104.131.163.128 - - [07/Oct/2026:08:34:25 +0200] "GET /.env HTTP/1.1" 404 2105 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" ... show less	Bad Web Bot Web App Attack
🇬🇧 WebNiraj	2026-10-07 00:34:20 (3 weeks ago)	(mod_security) mod_security (id:949110) triggered by 104.131.163.128 (US/United States/-): 5 in the last 3600 secs [SIGMA]	Brute-Force
🇳🇱 Alt255	2026-10-07 00:19:03 (3 weeks ago)	[ti-14al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail <name>. Example: 104.131.163.128 - - \[07/Oct/2026:02:18:50 +0200\] "GET /.env HTTP/1.1" 404 2140 "-" "Mozilla/5.0 \(Windows NT 10.0\; Win64\; x64\) AppleWebKit/537.36 \( ... show more [ti-14al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail <name>. Example: 104.131.163.128 - - \[07/Oct/2026:02:18:50 +0200\] "GET /.env HTTP/1.1" 404 2140 "-" "Mozilla/5.0 \(Windows NT 10.0\; Win64\; x64\) AppleWebKit/537.36 \(KHTML, like Gecko\) Chrome/125.0.0.0 Safari/537.36" ... show less	Bad Web Bot Web App Attack
🇺🇸 brightenfield	2026-10-06 23:43:40 (3 weeks ago)	Web App Attack	Web App Attack
🇩🇪 webanyone	2026-10-06 22:17:26 (3 weeks ago)	This address is looking for secret files on our sites: .git directories, .env files, credential and configuration files, database dumps, backups. This is a targeted search for credentials to break into the sites, blocked at the first request. Please ... show more This address is looking for secret files on our sites: .git directories, .env files, credential and configuration files, database dumps, backups. This is a targeted search for credentials to break into the sites, blocked at the first request. Please check the machine behind it for an attack tool or malware. \| method: GET \| path: /.env \| ua: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 show less	Hacking Web App Attack

Showing 1 to 15 of 189 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇨🇳 182.44.4.202

🇩🇪 217.154.9.93

🇨🇦 159.203.60.150

🇺🇸 136.144.42.213

🇺🇸 129.121.123.73

🇨🇳 125.113.45.92

🇧🇩 103.214.202.108

🇺🇸 72.202.229.8

🇩🇪 49.13.73.188

🇩🇪 2a01:4f8:13b:3786::2

🇲🇽 201.141.111.212

🇺🇸 198.23.52.200

🇧🇷 192.140.33.95

🇺🇸 185.238.28.27

🇳🇱 185.223.235.5

🇫🇷 185.177.72.13

🇹🇼 165.154.227.243

🇵🇪 161.132.55.210

🇺🇸 143.42.1.191

🇺🇸 143.42.1.189