This IP address has been reported a total of
35
times from
30 distinct
sources.
104.196.116.54 was first reported on
, and the most recent report was
.
In the last 60 days, the top reporter locations were:
Germany
with 8
reports;
United States of America
with 6
reports;
United Kingdom of Great Britain and Northern Ireland
with 5
reports.
The most common categories in these recent reports were:
Web App Attack
26
times;
Bad Web Bot
8
times;
Hacking
6
times;
Brute-Force
6
times;
Exploited Host
3
times;
Other
6
times.
Recent Reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Automated secret-file probing: 312 requests 2026-10-12 to 10-15 for .env variants, .git/config, SSH ...
show moreAutomated secret-file probing: 312 requests 2026-10-12 to 10-15 for .env variants, .git/config, SSH private keys, cloud credential files (.aws, .s3cfg, .dockercfg) and Spring actuator endpoints, including path-traversal variants (..;/, %2e%2e). Rotates spoofed search/AI crawler user agents (GPTBot, CCBot, Amazonbot, Baiduspider, KimiBot) and generic Chrome 131. Part of a coordinated pool of 100+ cloud IPs.
show less
{"level":"info","ts":1791937010.426966,"logger":"http.log.access.log1","msg":"handled request","requ ...
show more{"level":"info","ts":1791937010.426966,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"104.196.116.54","remote_port":"38468","client_ip":"104.196.116.54","proto":"HTTP/2.0","method":"POST","host":"status.korni22.org","uri":"/cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh","headers":{"Content-Type":["text/plain"],"User-Agent":["Mozilla/5.0 (compatible; MoonshotBot/1.0; +https://kimi.ai/)"],"Content-Length":["90"],"Accept-Encoding":["gzip"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"h2","server_name":"status.korni22.org","ech":false}},"bytes_read":0,"user_id":"","duration":0.000197877,"size":0,"status":429,"resp_headers":{"Server":["Caddy"],"Alt-Svc":["h3=\":443\"; ma=2592000"],"Retry-After":["1"]}}
{"level":"info","ts":1791937010.6516354,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"104.196.116.54","remote_port":"38468","client_ip":"104.196.116.54","proto":"HTTP/2.0","method":"GET
...
show less
(mod_security) mod_security (id:949110) triggered by 104.196.116.54 (US/United States/54.116.196.104 ...
show more(mod_security) mod_security (id:949110) triggered by 104.196.116.54 (US/United States/54.116.196.104.bc.googleusercontent.com): N in the last X secs
show less
[Laravel HoneypotPlus] Automated report - Honeypot access detected on path: /config/firebase-admin.j ...
show more[Laravel HoneypotPlus] Automated report - Honeypot access detected on path: /config/firebase-admin.json via rule: /config
show less
Malicious activity in general-malicious. Evidence: (apache_probe) Failed Access (403/404) 104.196.11 ...
show moreMalicious activity in general-malicious. Evidence: (apache_probe) Failed Access (403/404) 104.196.116.54 (US/United States/[REDACTED_DOMAIN]): 20 in the last 3600 secs | UA: (apache_probe) Failed Access (403/404) 104.196.116.54 (US/United States/54.116.196.104.bc.googleusercontent.com): 20 in the last 3600 secs
show less
