JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

64.23.218.208

Recent Activity

Abuse Confidence Score

100% Critical

7,437 reports

1,035 reporters · latest 30 minutes ago

ISP: DigitalOcean, LLC
Usage Type: Data Center/Web Hosting/Transit
ASN: AS14061
Hostname(s): ed93d36780.scan.leakix.org
Domain Name: digitalocean.com
Country: 🇺🇸 United States of America
City: Santa Clara, California

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Example preview

Account required for the enhanced features Log in Sign up

Abuse Reports

Export reports CSV

Total reports

7,437 from 1,035 distinct reporters

First reported

October 18th 2023

Most recent report

30 minutes ago

Last 60 days

Top reporter locations 🇺🇸 United States of America 216 🇵🇱 Poland 192 🇩🇪 Germany 172

Most common categories Web App Attack 757 Bad Web Bot 393 Brute-Force 227 Hacking 216 Port Scan 191

Recent reports We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 1gz	2026-11-03 01:32:51 (30 minutes ago)	Triggered Cloudflare WAF (firewallCustom) from US. Action taken: CHALLENGE Protocol: HTTP/1.1 (GET method) Endpoint: /debug/default/view UA: Mozilla/5.0 (l9scan/2.0.933313e22313e26323e2430313; +https://leakix.net) This report was generated by: https ... show more Triggered Cloudflare WAF (firewallCustom) from US. Action taken: CHALLENGE Protocol: HTTP/1.1 (GET method) Endpoint: /debug/default/view UA: Mozilla/5.0 (l9scan/2.0.933313e22313e26323e2430313; +https://leakix.net) This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
🇫🇷 masterguru	2026-11-03 01:32:27 (31 minutes ago)	BAD BOT - Detected and Blocked.. Matched phrase "l9scan" at REQUEST_HEADERS:User-Agent. (1100000-201)	Bad Web Bot
🇯🇵 HeliJP	2026-11-03 00:45:48 (1 hour ago)	2026-11-03T00:18:48Z - Recognized attacks\bad behavior from IP address 64.23.218.208 on port 443\80 (27 daily hits): Request Missing an Accept Header, URL file extension is restricted by policy, client denied by server configuration, Restricted File ... show more 2026-11-03T00:18:48Z - Recognized attacks\bad behavior from IP address 64.23.218.208 on port 443\80 (27 daily hits): Request Missing an Accept Header, URL file extension is restricted by policy, client denied by server configuration, Restricted File Access Attempt show less	Hacking Port Scan SQL Injection Brute-Force Web App Attack
🇮🇹 mgarofano80	2026-11-03 00:16:18 (1 hour ago)		Brute-Force Web App Attack
🇺🇸 rhandorf	2026-11-02 23:42:23 (2 hours ago)	Multiple web server 400 error codes from same source ip. (64 events) - reported by a home network SIEM	Port Scan Web App Attack
🇦🇺 Klaverstyn	2026-11-02 23:22:15 (2 hours ago)	Cross-vhost secrets/RCE probing campaign	Web App Attack Hacking
🇪🇸 Yoeph	2026-11-02 23:16:45 (2 hours ago)	Attacking server service nginx-movimientos-forbidden (Permanently Banned by Fail2ban on TurnoControlPro VPS)	Hacking Brute-Force Bad Web Bot Web App Attack
🇩🇪 DocNetzwerk	2026-11-02 22:16:08 (3 hours ago)	(mod_security) mod_security triggered on hostname [redacted] 64.23.218.208 (US/United States/ed93d36780.scan.leakix.org)	SQL Injection
🇷🇺 Deynekin.com	2026-11-02 19:23:45 (6 hours ago)	Automated fail2ban report from server 176.99.5.35. Attack type: web application vulnerability scanning/exploitation attempts (jails: nginx-attack-scan). Observed: 2026-11-02T22:23:45+03:00. Detections: 1 ban event(s), 5 failed attempts. Ban duration: ... show more Automated fail2ban report from server 176.99.5.35. Attack type: web application vulnerability scanning/exploitation attempts (jails: nginx-attack-scan). Observed: 2026-11-02T22:23:45+03:00. Detections: 1 ban event(s), 5 failed attempts. Ban duration: 4d. Sample requests/indicators: GET /.DS_Store -> 200 GET /.env -> 200 No personal data included. -- Reported via Fail2Ban_AbuseIPDB Monitor: https://github.com/paulmann/Fail2Ban_AbuseIPDB show less	Bad Web Bot Web App Attack
Anonymous	2026-11-02 16:21:52 (9 hours ago)	Automated report: 1 malicious HTTP request(s) blocked by WAF/IPS on public web services. Requested: ["/s/331313e2537313e27363e2237313/_/;/META-INF/maven/com.atlassian.jira/jira-web	Hacking Web App Attack
🇩🇪 ghostwarriors	2026-11-02 15:50:39 (10 hours ago)	Webpage scraping	Brute-Force Bad Web Bot Web App Attack
🇵🇱 Budyn	2026-11-02 14:34:51 (11 hours ago)	[Budyn Honeypot Sinkhole] \| Attack type: Enterprise & Framework Recon Scanner \| Summary: Web scanner triggered an emulated security trap. \| Evidence: \| Host: metrics.goblinpot.online \| Path: /.env \| User-Agent: Mozilla/5.0 (l9scan/2.0.2323e21323e2132 ... show more [Budyn Honeypot Sinkhole] \| Attack type: Enterprise & Framework Recon Scanner \| Summary: Web scanner triggered an emulated security trap. \| Evidence: \| Host: metrics.goblinpot.online \| Path: /.env \| User-Agent: Mozilla/5.0 (l9scan/2.0.2323e21323e21323e2430313; +https://leakix.net) \| Request: [Empty / GET Request] show less	Bad Web Bot Web App Attack
Anonymous	2026-11-02 14:30:48 (11 hours ago)	64.23.218.208 - - [02/Nov/2026:22:30:48 +0800] "GET /.env HTTP/1.1" 301 235 "-" "Mozilla/5.0 (l9scan/2.0.93e2837313e2834323e2535313; +https://leakix.net)" ...	Bad Web Bot Web App Attack
🇵🇱 Budyn	2026-11-02 12:28:31 (13 hours ago)	[Budyn Honeypot Sinkhole] \| Attack type: CRITICAL: ModSecurity WAF Exploit Block \| Summary: Request triggered an emulated security trap. \| Evidence: \| Host: portal.teddypot.store \| Path: /.DS_Store \| User-Agent: Mozilla/5.0 (l9scan/2.0.232313e28343e2 ... show more [Budyn Honeypot Sinkhole] \| Attack type: CRITICAL: ModSecurity WAF Exploit Block \| Summary: Request triggered an emulated security trap. \| Evidence: \| Host: portal.teddypot.store \| Path: /.DS_Store \| User-Agent: Mozilla/5.0 (l9scan/2.0.232313e28343e21323e2430313; +https://leakix.net) \| Request: [Empty / GET Request] show less	Hacking Web App Attack
Anonymous	2026-11-02 11:52:11 (14 hours ago)	Honeypot: http-public probing for vulnerable paths	Web App Attack

Showing 1 to 15 of 7437 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇧🇷 205.210.31.152

🇺🇸 205.210.31.107

🇹🇼 198.235.24.90

🇲🇽 187.188.45.32

🇷🇺 178.74.122.119

🇺🇸 176.46.129.135

🇺🇸 172.234.218.245

🇭🇰 150.5.145.88

🇹🇼 111.70.43.40

🇨🇳 111.30.98.26

🇨🇳 106.13.124.251

🇹🇼 104.199.178.117

🇧🇩 103.51.53.94

🇷🇴 92.118.39.71

🇺🇸 91.230.168.87

🇫🇷 86.253.190.19

🇺🇸 74.81.223.59

🇺🇸 70.167.235.132

🇺🇸 68.227.77.59

🇱🇹 62.60.134.134