This IP address has been reported a total of
70
times from
59 distinct
sources.
104.199.239.42 was first reported on
, and the most recent report was
.
In the last 60 days, the top reporter locations were:
Netherlands
with 12
reports;
Germany
with 11
reports;
United States of America
with 10
reports.
The most common categories in these recent reports were:
Web App Attack
53
times;
Brute-Force
25
times;
Bad Web Bot
20
times;
Hacking
13
times;
SQL Injection
4
times;
Other
12
times.
Recent Reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
{"level":"info","ts":1792940997.4879012,"logger":"http.log.access.log1","msg":"handled request","req ...
show more{"level":"info","ts":1792940997.4879012,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"104.199.239.42","remote_port":"34852","client_ip":"104.199.239.42","proto":"HTTP/2.0","method":"GET","host":"status.quadhelion.engineering","uri":"/7h6fxxuzw9fc64q2lunx","headers":{"User-Agent":["Mozilla/5.0 (compatible; ChatGLM-Spider/1.0; +https://zhipuai.cn/)"],"Accept":["*/*"],"Accept-Encoding":["gzip"],"X-Middleware-Subrequest":["src/middleware:nowaf:src/middleware:src/middleware:src/middleware:src/middleware:middleware:middleware:nowaf:middleware:middleware:middleware:pages/_middleware"],"X-Nextjs-Data":["1"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"h2","server_name":"status.quadhelion.engineering","ech":false}},"bytes_read":0,"user_id":"","duration":0.000119358,"size":0,"status":429,"resp_headers":{"Retry-After":["1"],"Server":["Caddy"],"Alt-Svc":["h3=\":443\"; ma=2592000"]}}
{"level":"info","ts":1792940997.8631997,"logger":"http.log.a
...
show less
2450 attacks on directory traversals, password/key grabbing URLs, VC URLs, PHP URLs, env grabbing UR ...
show more2450 attacks on directory traversals, password/key grabbing URLs, VC URLs, PHP URLs, env grabbing URLs (type 2), env grabbing URLs, config grabbing URLs (type 2):
GET /..%2f.env HTTP/1.1
GET /Dockerrun.aws.json HTTP/1.1
GET /.git/HEAD HTTP/1.1
GET /document.php?modulepart=systemtools&file=../conf/conf.php&hashp=shared HTTP/1.1
GET /userfiles/x?path=../../../../proc/self/environ HTTP/1.1
GET /userfiles/x?path=../../.env HTTP/1.1
GET /config/gcp-credentials.json HTTP/1.1
show less
ET EXPLOIT Apache HTTP Server 2.4.49 - Path Traversal Attempt (CVE-2021-41773) M2
ET EXPLOIT Grafa ...
show moreET EXPLOIT Apache HTTP Server 2.4.49 - Path Traversal Attempt (CVE-2021-41773) M2
ET EXPLOIT Grafana 8.x Path Traversal (CVE-2021-43798)
ET EXPLOIT Local File Inclusion with Shell Execution via proc/self/environ
ET EXPLOIT VMware Spring Cloud Directory Traversal (CVE-2020-5410)
ET INFO Request to Hidden Environment File - Inbound
ET POLICY POSSIBLE Crawl using Fetch
ET SCAN Bing Webcrawler User-Agent (BingBot)
ET WEB_SERVER Likely Malicious Request for /proc/self/environ
ET WEB_SERVER Next.js Middleware Authorization Bypass (CVE-2025-29927)
ET WEB_SPECIFIC_APPS Kibana Attempted LFI Exploitation (CVE-2018-17246)
ET WEB_SPECIFIC_APPS Vite Arbitrary File Read Via raw parameter (CVE-2025-30208)
ET WEB_SPECIFIC_APPS Vite Unauthenticated Arbitrary File Read (CVE-2025-31486)
GPL WEB_SERVER .htpasswd access
GPL WEB_SERVER 403 Forbidden
show less
Bot / scanning and/or hacking attempts: GET /sitemap_index.xml HTTP/2.0, GET /.git/config HTTP/2.0, ...
show moreBot / scanning and/or hacking attempts: GET /sitemap_index.xml HTTP/2.0, GET /.git/config HTTP/2.0, GET /wp-content/cache/min/1/wp-content/themes/buzzmag/js/owl.ca, GET /team HTTP/2.0, GET /dashboard/settings HTTP/2.0
show less
