This IP address has been reported a total of
48
times from
35 distinct
sources.
104.196.179.108 was first reported on
, and the most recent report was
.
In the last 60 days, the top reporter locations were:
United States of America
with 14
reports;
Germany
with 7
reports;
Netherlands
with 6
reports.
The most common categories in these recent reports were:
Web App Attack
40
times;
Brute-Force
22
times;
Bad Web Bot
18
times;
Hacking
8
times;
SSH
4
times;
Other
6
times.
Old Reports
The most recent abuse report for this IP address is from
. It is possible that this IP is no
longer involved in abusive activities.
392 attacks on PHP URLs, VC URLs, config grabbing URLs (type 2), password grabbing URLs, site downlo ...
show more392 attacks on PHP URLs, VC URLs, config grabbing URLs (type 2), password grabbing URLs, site downloads, env grabbing URLs:
GET /config/.env.php HTTP/1.1
GET /.git/HEAD HTTP/1.1
GET /config/auth.json HTTP/1.1
GET /static../.aws/credentials HTTP/1.1
GET /dump.sql HTTP/1.1
GET /config/.env.production HTTP/1.1
show less
{"level":"info","ts":1787919099.2195795,"logger":"http.log.access.log0","msg":"handled request","req ...
show more{"level":"info","ts":1787919099.2195795,"logger":"http.log.access.log0","msg":"handled request","request":{"remote_ip":"104.196.179.108","remote_port":"29696","client_ip":"104.196.179.108","proto":"HTTP/1.1","method":"GET","host":"9r8q.status.updown.io","uri":"/","headers":{"Accept":["*/*"],"Accept-Encoding":["gzip"],"User-Agent":["Mozilla/5.0 (iPhone; CPU iPhone OS 18_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.4 Mobile/15E148 Safari/604.1"]}},"bytes_read":0,"user_id":"","duration":0.000096774,"size":0,"status":308,"resp_headers":{"Connection":["close"],"Location":["https://9r8q.status.updown.io/"],"Content-Type":[],"Server":["Caddy"]}}
{"level":"info","ts":1787919104.1159587,"logger":"http.log.access.log0","msg":"handled request","request":{"remote_ip":"104.196.179.108","remote_port":"49400","client_ip":"104.196.179.108","proto":"HTTP/1.1","method":"GET","host":"9r8q.status.updown.io","uri":"/@fs/..%252f..%252f..%252f..%252f..%252froot/.env?raw??","headers":{
...
show less
Scanning for config & TelegramBot User Agent Spoofing [GET /config.json.js] [Mozilla/5.0 (compatible ...
show moreScanning for config & TelegramBot User Agent Spoofing [GET /config.json.js] [Mozilla/5.0 (compatible; TelegramBot/1.0)]
show less
(modsec_5080) ModSec 5080: Infrastructure subdomain probe from 104.196.179.108 (US/United States/108 ...
show more(modsec_5080) ModSec 5080: Infrastructure subdomain probe from 104.196.179.108 (US/United States/108.179.196.104.bc.googleusercontent.com): 2 in the last 3600 secs (0-196)
show less
caddy probes: env-probe: GET /.docker/.env(DROP), GET /.env(DROP), GET /.env.development(DROP), GET ...
show morecaddy probes: env-probe: GET /.docker/.env(DROP), GET /.env(DROP), GET /.env.development(DROP), GET /.hermes/.env(DROP), GET /@fs/.env.production?raw??(DROP), GET /@fs/src/.env?raw??(DROP), GET /@fs/var/task/.env?raw??(DROP), GET /assets../.env(DROP), GET /backup/.env(DROP), GET /config.env(DROP), GET /public/.env(DROP), GET /secrets.env(DROP) | path-traversal: GET /@fs/../.env?raw??(DROP), GET /_nuxt/../.env(DROP) | web: GET /.azure/credentials(DROP), GET /.gcloud/credentials(DROP), GET /.git-credentials(DROP), GET /.hermes/auth.json(DROP), GET /.htpasswd(DROP), GET /.openai/config.json(DROP), GET /aws.json(DROP), GET /config.php.bak(DROP), GET /config/secrets.yml(DROP), GET /server.key(DROP), GET /settings.json(DROP)
show less
