JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 207.154.212.47

207.154.212.47 was found in our database!

This IP was reported 9,047 times. Confidence of Abuse is 100%: ?

100%

ISP	DigitalOcean, LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS14061
Hostname(s)	a4d39b522e.scan.leakix.org
Domain Name	digitalocean.com
Country	🇩🇪 Germany
City	Frankfurt am Main, Hesse

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 207.154.212.47

Whois 207.154.212.47

IP Abuse Reports for 207.154.212.47:

This IP address has been reported a total of 9,047 times from 1,177 distinct sources. 207.154.212.47 was first reported on October 18th 2023, and the most recent report was 17 minutes ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇵🇱 Budyn	2026-10-27 12:20:22 (17 minutes ago)	Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scan ... show more Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: jenkins.teddypot.site \| URI: /.env \| UA: Mozilla/5.0 (l9scan/2.0.5373e2438313e27363e2237313; +https://leakix.net) \| BODY: [Empty / GET Request] \| HEADERS: {"X-Forwarded-Proto":"https","Cf-Visitor":"{\"scheme\":\"https\"}","Cf-Ipcountry":"DE","Cf-Connecting-Ip":"207.154.212.47","Cdn-Loop":"cloudflare; loops=1","Cf-Ray":"a511a7852aa4f381-FRA","Connection":"Keep-Alive","Accept-Encoding":"gzip, br","X-Forwarded-For":"207.154.212.47"} show less	Bad Web Bot Web App Attack
Anonymous	2026-10-27 11:16:29 (1 hour ago)	IP matched detection query 20 more in short time bad rqs.	Brute-Force Web App Attack Hacking
🇬🇧 neo101	2026-10-27 06:42:17 (5 hours ago)	Secret Hunting & Credential Harvesting: Automated scanner (Nuclei (Secret Hunter)) probed decoy secr ... show more Secret Hunting & Credential Harvesting: Automated scanner (Nuclei (Secret Hunter)) probed decoy secrets path '/.env'. Delivered poisoned decoy AWS credentials (KEY-60: AKIATU7L4S6WWNL7D3QN). Active canary forensic tracking. show less	Hacking Web App Attack
🇩🇪 IVski.com	2026-10-27 06:25:34 (6 hours ago)	IVski WAF \| Banner grab scan - zgrab probing service fingerprint	Hacking Brute-Force Web App Attack
🇩🇪 snhosting	2026-10-27 05:25:13 (7 hours ago)	207.154.212.47 - - [27/Oct/2026:06:24:58 +0100] "GET /console/ HTTP/1.1" 404 147 "-" "Mozilla/5.0 (l ... show more 207.154.212.47 - - [27/Oct/2026:06:24:58 +0100] "GET /console/ HTTP/1.1" 404 147 "-" "Mozilla/5.0 (l9scan/2.0.534313e29353e293e2637313; +https://leakix.net)" 207.154.212.47 - - [27/Oct/2026:06:24:59 +0100] "GET /server HTTP/1.1" 404 145 "-" "Mozilla/5.0 (l9scan/2.0.534313e29353e293e2637313; +https://leakix.net)" 207.154.212.47 - - [27/Oct/2026:06:25:00 +0100] "GET /server-status HTTP/1.1" 404 151 "-" "Mozilla/5.0 (l9scan/2.0.534313e29353e293e2637313; +https://leakix.net)" 207.154.212.47 - - [27/Oct/2026:06:25:02 +0100] "GET /about HTTP/1.1" 404 144 "-" "Mozilla/5.0 (l9scan/2.0.534313e29353e293e2637313; +https://leakix.net)" 207.154.212.47 - - [27/Oct/2026:06:25:03 +0100] "GET /login.action HTTP/1.1" 404 150 "-" "Mozilla/5.0 (l9scan/2.0.534313e29353e293e2637313; +https://leakix.net)" ... show less	DNS Compromise DNS Poisoning Phishing Email Spam Brute-Force Web App Attack SSH
🇫🇷 Quarks Solutions	2026-10-27 04:00:00 (8 hours ago)	crowdsecurity/jira_cve-2021-26086	Web App Attack Hacking
🇳🇱 Alt255	2026-10-27 03:36:13 (9 hours ago)	[ti-hosboov] Web exploit scanning: 1 suspicious requests detected by fail2ban jail <name>. Example: ... show more [ti-hosboov] Web exploit scanning: 1 suspicious requests detected by fail2ban jail <name>. Example: 207.154.212.47 - - \[27/Oct/2026:04:35:50 +0100\] "GET /.env HTTP/1.1" 301 733 "-" "Mozilla/5.0 \(l9scan/2.0.133323e2838313e2434313e2633313\; +https://leakix.net\)" ... show less	Bad Web Bot Web App Attack
🇧🇷 Halux	2026-10-27 02:26:53 (10 hours ago)	207.154.212.47 Probing protected path or service	Web App Attack
🇳🇴 Bots.go.to.hell	2026-10-27 02:02:38 (10 hours ago)	This IP was detected by CrowdSec triggering custom/ip-honeypot	Web App Attack Bad Web Bot
🇺🇸 itxworks.com	2026-10-27 00:50:40 (11 hours ago)	Honeypot hit: web probing / scanner. Auto-reported by CrowdSec.	Web App Attack Bad Web Bot
🇩🇪 ghostwarriors	2026-10-27 00:21:21 (12 hours ago)	Webpage scraping	Brute-Force Bad Web Bot Web App Attack
🇵🇱 Budyn	2026-10-27 00:18:28 (12 hours ago)	Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scan ... show more Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: cluster.astropot.space \| URI: /.env \| UA: Mozilla/5.0 (l9scan/2.0.632323e2039313e27363e2237313; +https://leakix.net) \| BODY: [Empty / GET Request] \| HEADERS: {"X-Forwarded-Proto":"https","Cf-Visitor":"{\"scheme\":\"https\"}","Cf-Ipcountry":"DE","Cf-Connecting-Ip":"207.154.212.47","Cdn-Loop":"cloudflare; loops=1","Cf-Ray":"a50d860ecac0d27a-FRA","Connection":"Keep-Alive","Accept-Encoding":"gzip, br","X-Forwarded-For":"207.154.212.47"} show less	Bad Web Bot Web App Attack
🇬🇧 matbargob	2026-10-26 23:34:37 (13 hours ago)	CrowdSec crowdsecurity/appsec-vpatch: 2 events 2026-10-26 23:34:37 - 23:34:40 UTC. Paths: /.env, /.g ... show more CrowdSec crowdsecurity/appsec-vpatch: 2 events 2026-10-26 23:34:37 - 23:34:40 UTC. Paths: /.env, /.git/config. WAF rules: crowdsecurity/vpatch-env-access, crowdsecurity/vpatch-git-config. show less	Hacking Web App Attack
Anonymous	2026-10-26 21:17:26 (15 hours ago)	207.154.212.47 - - [26/Oct/2026:23:17:04 +0200] "GET /console/ HTTP/1.1" 404 124 "-" "Mozilla/5.0 (l ... show more 207.154.212.47 - - [26/Oct/2026:23:17:04 +0200] "GET /console/ HTTP/1.1" 404 124 "-" "Mozilla/5.0 (l9scan/2.0.3313e2939313e2737313e2933313; +https://leakix.net)" 207.154.212.47 - - [26/Oct/2026:23:17:05 +0200] "GET /server HTTP/1.1" 404 124 "-" "Mozilla/5.0 (l9scan/2.0.3313e2939313e2737313e2933313; +https://leakix.net)" 207.154.212.47 - - [26/Oct/2026:23:17:06 +0200] "GET /server-status HTTP/1.1" 404 124 "-" "Mozilla/5.0 (l9scan/2.0.3313e2939313e2737313e2933313; +https://leakix.net)" 207.154.212.47 - - [26/Oct/2026:23:17:08 +0200] "GET /about HTTP/1.1" 404 124 "-" "Mozilla/5.0 (l9scan/2.0.3313e2939313e2737313e2933313; +https://leakix.net)" 207.154.212.47 - - [26/Oct/2026:23:17:09 +0200] "GET /login.action HTTP/1.1" 404 124 "-" "Mozilla/5.0 (l9scan/2.0.3313e2939313e2737313e2933313; +https://leakix.net)" 207.154.212.47 - - [26/Oct/2026:23:17:11 +0200] "GET /___proxy_subdomain_whm/login HTTP/1.1" 404 124 "-" "Mozilla/5.0 (l9scan/2.0.3313e2939313e2737313e2933313; +https://leakix.net)" 207. ... show less	Bad Web Bot Web App Attack
🇵🇱 Budyn	2026-10-26 18:57:47 (17 hours ago)	Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scan ... show more Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: api.budyn.top \| URI: /.env \| UA: Mozilla/5.0 (l9scan/2.0.138313e28383e21323e2430313; +https://leakix.net) \| BODY: [Empty / GET Request] \| HEADERS: {"X-Forwarded-Proto":"https","Cf-Visitor":"{\"scheme\":\"https\"}","Cf-Ipcountry":"DE","Cf-Connecting-Ip":"207.154.212.47","Cdn-Loop":"cloudflare; loops=1","Cf-Ray":"a50bb04e7b8bdca8-FRA","Connection":"Keep-Alive","Accept-Encoding":"gzip, br","X-Forwarded-For":"207.154.212.47"} show less	Bad Web Bot Web App Attack

Showing 1 to 15 of 9047 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇴 190.60.242.28

🇬🇧 154.16.44.194

🇧🇷 45.184.48.247

🇩🇪 195.182.16.183

🇫🇷 185.194.178.15

🇦🇫 180.94.74.146

🇨🇴 177.93.61.202

🇧🇷 168.205.190.245

🇵🇰 163.61.1.240

🇺🇸 162.248.100.97

🇺🇸 143.42.1.185

🇷🇺 141.101.194.32

🇨🇳 121.31.210.125

🇷🇺 93.170.107.86

🇺🇸 54.160.247.72

🇵🇱 45.138.12.47

🇮🇩 43.133.131.35

🇦🇺 27.32.183.30

🇧🇷 16.5.0.218

🇦🇱 185.89.157.225