This IP address has been reported a total of
21
times from
10 distinct
sources.
109.238.87.252 was first reported on
, and the most recent report was
.
In the last 60 days, the top reporter locations were:
Germany
with 8
reports;
United States of America
with 8
reports;
Netherlands
with 2
reports.
The most common categories in these recent reports were:
Port Scan
18
times;
Hacking
7
times;
Bad Web Bot
3
times;
DDoS Attack
2
times;
Web App Attack
2
times;
Other
3
times.
Recent Reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Automatically generated from firewall_v2 logs on SID:VTMI1
Category: Port Scan
Occurrences: 20
Un ...
show moreAutomatically generated from firewall_v2 logs on SID:VTMI1
Category: Port Scan
Occurrences: 20
Unique Ports: 13
Destination Ports:
5443, 3443, 9443, 2443, 4433, 8443, 7443, 10443, 444, 4443, 443, 1443, 11443
First Seen:
2026-10-23 03:40 UTC
Last Seen:
2026-10-24 12:05 UTC
show less
Oct 24 07:02:18 109.238.87.252 TCP SPT=61020 DPT=7443 SYN
Oct 24 08:35:50 109.238.87.252 TCP SPT=610 ...
show moreOct 24 07:02:18 109.238.87.252 TCP SPT=61020 DPT=7443 SYN
Oct 24 08:35:50 109.238.87.252 TCP SPT=61035 DPT=4443 SYN
Oct 24 08:39:43 109.238.87.252 TCP SPT=61082 DPT=1443 SYN
...
show less
Automatically generated from firewall_v2 logs on SID:VTMI2
Category: Port Scan
Occurrences: 20
Un ...
show moreAutomatically generated from firewall_v2 logs on SID:VTMI2
Category: Port Scan
Occurrences: 20
Unique Ports: 13
Destination Ports:
11443, 7443, 444, 2443, 3443, 10443, 9443, 443, 4433, 1443, 4443, 8443, 5443
First Seen:
2026-10-23 05:25 UTC
Last Seen:
2026-10-24 08:25 UTC
show less
Oct 23 19:46:32 109.238.87.252 TCP SPT=61028 DPT=9443 SYN
Oct 23 19:46:57 109.238.87.252 TCP SPT=610 ...
show moreOct 23 19:46:32 109.238.87.252 TCP SPT=61028 DPT=9443 SYN
Oct 23 19:46:57 109.238.87.252 TCP SPT=61076 DPT=11443 SYN
Oct 23 20:40:16 109.238.87.252 TCP SPT=61072 DPT=4433
...
show less
portscan on multiple TCP ports :
Firewall: Within 2026-10-23 07:08:16 - 2026-10-23 14:24:10 CEST(+02 ...
show moreportscan on multiple TCP ports :
Firewall: Within 2026-10-23 07:08:16 - 2026-10-23 14:24:10 CEST(+0200) identified: port scan from 109.238.87.252/32 on uncommon port/s: 1443(tcp:1443),4443(tcp:4443),9443(tcp:9443),7443(tcp:7443),444(snpp) (5 trials)
Fail2ban: Within 2026-10-23 07:08:16 - 2026-10-23 14:24:10 CEST(+0200) banned: 10 times by fail2ban[firewall]; 10 times by fail2ban[recidive]
show less
Oct 23 09:19:30 109.238.87.252 TCP SPT=61070 DPT=7443 SYN
Oct 23 11:05:18 109.238.87.252 TCP SPT=610 ...
show moreOct 23 09:19:30 109.238.87.252 TCP SPT=61070 DPT=7443 SYN
Oct 23 11:05:18 109.238.87.252 TCP SPT=61085 DPT=4443 SYN
Oct 23 11:09:52 109.238.87.252 TCP SPT=61032 DPT=1443
...
show less
fail2ban:recidive:2026-10-23 07:11:08,866 fail2ban.actions [982513]: NOTICE [firewall] Ban 1 ...
show morefail2ban:recidive:2026-10-23 07:11:08,866 fail2ban.actions [982513]: NOTICE [firewall] Ban 109.238.87.252
2026-10-23 14:24:10,741 fail2ban.actions [982513]: NOTICE [firewall] Ban 109.238.87.252
show less
Port Scan on Honeypot | Ports: 8443/HTTPS-alt | Proto: TCP(1) | Flags: all SYN | TTL: 116 | Len: 44B ...
show morePort Scan on Honeypot | Ports: 8443/HTTPS-alt | Proto: TCP(1) | Flags: all SYN | TTL: 116 | Len: 44B | Win: 1024(1) | F2B/ufw-honeypot@2026-10-23T10:13:49Z
show less
This IP was detected by CrowdSec triggering crowdsecurity/suricata-major-severity(ET DROP Spamhaus D ...
show moreThis IP was detected by CrowdSec triggering crowdsecurity/suricata-major-severity(ET DROP Spamhaus DROP Listed Traffic Inbound group 24).
show less
Port Scan on Honeypot | Ports: 8443/HTTPS-alt | Proto: TCP(1) | Flags: all SYN | TTL: 104 | Len: 44B ...
show morePort Scan on Honeypot | Ports: 8443/HTTPS-alt | Proto: TCP(1) | Flags: all SYN | TTL: 104 | Len: 44B | Win: 1024(1) | F2B/ufw-honeypot@2026-10-23T07:07:58Z
show less
2026/10/23 07:52:27 [error] 977306#977306: *16240 FastCGI sent in stderr: "PHP message: BOT WARNING: ...
show more2026/10/23 07:52:27 [error] 977306#977306: *16240 FastCGI sent in stderr: "PHP message: BOT WARNING: visitor used the honeypot: 109.238.87.252, url was '192.248.152.121' and abuseipdb '29', function: ELP_site_live" while reading upstream, client: 109.238.87.252, server: www.elivecd.org, request: "GET / HTTP/1.1", upstream: "fastcgi://unix:/run/php/php8.4-fpm-elivewp.sock:", host: "192.248.152.121"
...
show less
