JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 105.112.24.124

105.112.24.124 was found in our database!

This IP was reported 17 times. Confidence of Abuse is 0%: ?

ISP	Airtel Networks Limited
Usage Type	Mobile ISP
ASN	AS36873
Domain Name	airtel.in
Country	🇳🇬 Nigeria
City	Lagos, Lagos

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 105.112.24.124

Whois 105.112.24.124

IP Abuse Reports for 105.112.24.124:

This IP address has been reported a total of 17 times from 13 distinct sources. 105.112.24.124 was first reported on July 25th 2023, and the most recent report was 2 months ago.

Old Reports: The most recent abuse report for this IP address is from 2 months ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇬🇧 openstrike.co.uk	2026-08-27 05:14:21 (2 months ago)	6 attacks on env grabbing URLs: GET /.env HTTP/1.1	Hacking
🇨🇭 jebla.ch	2026-08-27 02:52:12 (2 months ago)	Busted by the WatchPost edge sentinel: this host was probing web-app endpoints for a way in. Blocked ... show more Busted by the WatchPost edge sentinel: this host was probing web-app endpoints for a way in. Blocked at the edge, logged, and shared with the community. Last seen 2026-08-26 03:02 UTC. show less	Web App Attack
🇩🇪 LRob	2026-08-26 20:16:13 (2 months ago)	Probing for secret files (.git, .env, credentials, database dumps, wp-config) \| method: GET \| path: ... show more Probing for secret files (.git, .env, credentials, database dumps, wp-config) \| method: GET \| path: /.env \| 2026-08-26 20:16 UTC show less	Hacking Web App Attack
🇬🇧 openstrike.co.uk	2026-08-26 05:16:30 (2 months ago)	2 attacks on env grabbing URLs: GET /.env HTTP/1.1	Hacking
🇩🇪 Gwyneth Llewelyn	2026-08-26 03:48:05 (2 months ago)	2026/08/26 04:48:02 [error] 380594#380594: 607636 access forbidden by rule, client: 105.112.24.124, ... show more 2026/08/26 04:48:02 [error] 380594#380594: 607636 access forbidden by rule, client: 105.112.24.124, server: zonadetestes.com, request: "GET /.env HTTP/2.0", host: "zonadetestes.com" 105.112.24.124 - - [26/Aug/2026:04:48:02 +0100] "GET /.env HTTP/2.0" 403 1045 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36" 2026/08/26 04:48:02 [error] 380594#380594: *607637 access forbidden by rule, client: 105.112.24.124, server: zonadetestes.com, request: "GET /.env HTTP/2.0", host: "zonadetestes.com" show less	Brute-Force Web App Attack
🇨🇭 jebla.ch	2026-08-26 02:52:02 (2 months ago)	Busted by the WatchPost edge sentinel: this host was probing web-app endpoints for a way in. Blocked ... show more Busted by the WatchPost edge sentinel: this host was probing web-app endpoints for a way in. Blocked at the edge, logged, and shared with the community. Last seen 2026-08-26 02:36 UTC. show less	Web App Attack
🇮🇹 VHosting	2026-08-26 01:20:03 (2 months ago)	Detected WordPress attack from different servers	Brute-Force Web App Attack
🇬🇧 consul.to	2026-08-26 00:35:43 (2 months ago)	Web attack/malicious scanning detected	Web App Attack
🇺🇸 interbiznw.com	2026-08-26 00:22:49 (2 months ago)	fail2ban-ban	Hacking Brute-Force Exploited Host Web App Attack
🇩🇪 tall1oN	2026-08-25 22:04:54 (2 months ago)	105.112.24.124 - - [26/Aug/2026:00:04:31 +0200] "GET /.env HTTP/2.0" 200 14880 "-" "AuthorizedEnvExp ... show more 105.112.24.124 - - [26/Aug/2026:00:04:31 +0200] "GET /.env HTTP/2.0" 200 14880 "-" "AuthorizedEnvExposureDetector/2.0 (authorized security assessment)" "tallion.de" 105.112.24.124 - - [26/Aug/2026:00:04:54 +0200] "GET /.env HTTP/2.0" 200 19955 "-" "AuthorizedEnvExposureDetector/2.0 (authorized security assessment)" "tallion.de" ... show less	Web App Attack Port Scan Hacking
🇺🇸 TPI-Abuse	2026-08-25 21:39:53 (2 months ago)	(mod_security) mod_security (id:210492) triggered by 105.112.24.124 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 105.112.24.124 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Aug 25 17:39:46.076374 2026] [security2:error] [pid 13620:tid 13620] [client 105.112.24.124:29052] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "coolray.net"] [uri "/.env"] [unique_id "ao4LopRYVKpf7PFPW8yxwgAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-08-25 21:14:05 (2 months ago)	(mod_security) mod_security (id:210492) triggered by 105.112.24.124 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 105.112.24.124 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Aug 25 17:14:02.197071 2026] [security2:error] [pid 15822:tid 15822] [client 105.112.24.124:23078] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.151.20"] [uri "/.env"] [unique_id "ao4FmkeJkli15lQ5rNep4gAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack
🇨🇦 polycoda	2026-08-25 21:01:53 (2 months ago)	AutoBlock: 🎯 Vulnerability Scanner (Non Decay-Based)	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-08-25 20:57:45 (2 months ago)	(mod_security) mod_security (id:210492) triggered by 105.112.24.124 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 105.112.24.124 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Aug 25 16:57:41.214882 2026] [security2:error] [pid 14236:tid 14236] [client 105.112.24.124:39826] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.215"] [uri "/.env"] [unique_id "ao4BxeC9jadeOF57wJFqXAAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 Baking333	2026-08-25 20:42:28 (2 months ago)	[redacted] 105.112.24.124 - - [25/Aug/2026:21:42:26 +0100] "GET /.env HTTP/1.1" 302 6773 0/54531 "-" ... show more [redacted] 105.112.24.124 - - [25/Aug/2026:21:42:26 +0100] "GET /.env HTTP/1.1" 302 6773 0/54531 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36" [redacted] 105.112.24.124 - - [25/Aug/2026:21:42:27 +0100] "GET /.env HTTP/1.1" 302 6773 0/95590 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36" show less	Bad Web Bot Web App Attack

Showing 1 to 15 of 17 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇪🇸 217.150.222.221

🇵🇪 190.233.134.229

🇧🇷 177.39.134.150

🇭🇰 152.32.169.155

🇺🇸 136.80.38.229

🇧🇩 123.200.2.25

🇬🇧 118.193.64.186

🇧🇩 103.177.48.17

🇿🇦 102.129.62.141

🇫🇷 85.217.140.12

🇳🇱 77.91.71.25

🇨🇳 42.240.164.208

🇺🇸 2602:80d:1007::58

🇦🇷 191.84.192.142

🇫🇷 156.67.27.137

🇺🇸 147.185.132.196

🇧🇷 131.72.201.222

🇨🇳 123.13.94.164

🇿🇦 105.214.62.44

🇧🇩 103.236.107.103