JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 123.58.47.228

123.58.47.228 was found in our database!

This IP was reported 17 times. Confidence of Abuse is 63%: ?

63%

ISP	Beijing CNISP Technology Co., Ltd.
Usage Type	Fixed Line ISP
ASN	AS17623
Domain Name	cnisp.org.cn
Country	🇨🇳 China
City	Shenzhen, Guangdong

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 123.58.47.228

Whois 123.58.47.228

IP Abuse Reports for 123.58.47.228:

This IP address has been reported a total of 17 times from 10 distinct sources. 123.58.47.228 was first reported on June 18th 2026, and the most recent report was 2 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
Anonymous	2026-07-01 06:07:04 (2 hours ago)	Bot / scanning and/or hacking attempts: GET /js/app.js HTTP/1.1, GET /wp-config.php~ HTTP/1.1, GET / ... show more Bot / scanning and/or hacking attempts: GET /js/app.js HTTP/1.1, GET /wp-config.php~ HTTP/1.1, GET /application.yml HTTP/1.1, GET /appsettings.json HTTP/1.1, GET /serverless.yml HTTP/1.1, GET /application.yaml HTTP/1.1, GET /application-dev.properties HTTP/1.1, GET /config.py HTTP/1.1, GET /application-prod.properties HTTP/1.1, GET /appsettings.Development.json HTTP/1.1, GET /config.yml HTTP/1.1, GET /appsettings.Production.json HTTP/1.1, GET /config.yaml HTTP/1.1, GET /config.toml HTTP/1.1, GET /wp-config.php.old HTTP/1.1 show less	Hacking Web App Attack
🇺🇸 xserverx.ru	2026-07-01 04:57:10 (3 hours ago)	Honeypot triggered: IP: 123.58.47.228 Request to: https://xserverx.ru/.env Method: GET Host: xserver ... show more Honeypot triggered: IP: 123.58.47.228 Request to: https://xserverx.ru/.env Method: GET Host: xserverx.ru User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 (Silvy X Ran) Referer: Direct Country: CN ASN: Unknown Triggered rules: (\.env\|\.env\.local\|\.env\.production) Timestamp: 2026-07-01T04:57:09.499Z show less	Hacking Bad Web Bot Web App Attack
🇳🇱 wlt-blocker	2026-06-30 23:30:51 (9 hours ago)	Unauthorized access to webpage admin	Web App Attack
🇫🇮 as211431.net	2026-06-30 22:48:51 (10 hours ago)	Triggered Cloudflare WAF (firewallCustom) from CN. Action taken: BLOCK Protocol: HTTP/1.1 (GET metho ... show more Triggered Cloudflare WAF (firewallCustom) from CN. Action taken: BLOCK Protocol: HTTP/1.1 (GET method) Endpoint: /.env.development UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 (Silvy X Ran) This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
🇺🇸 TPI-Abuse	2026-06-30 13:54:44 (18 hours ago)	(mod_security) mod_security (id:210492) triggered by 123.58.47.228 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 123.58.47.228 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 30 09:54:35.026846 2026] [security2:error] [pid 17029:tid 17029] [client 123.58.47.228:50611] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "vitality-web.com"] [uri "/.env.staging"] [unique_id "akPKmwcKlgzgzRTcz4wp2AAAAAc"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 mnsf	2026-06-30 13:05:07 (19 hours ago)	Abuse Detected (1)	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-06-30 10:05:07 (22 hours ago)	(mod_security) mod_security (id:210492) triggered by 123.58.47.228 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 123.58.47.228 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 30 06:05:02.098871 2026] [security2:error] [pid 12882:tid 12882] [client 123.58.47.228:15394] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "edscontracting.com"] [uri "/config/.env"] [unique_id "akOUzoJZ7K4Ewjo193yY3QAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-06-30 09:08:58 (23 hours ago)	[30/Jun/2026:12:08:57 +0300] 178281053741.241676 123.58.47.228 12184 148.251.76.218 443 [30/Jun/2026 ... show more [30/Jun/2026:12:08:57 +0300] 178281053741.241676 123.58.47.228 12184 148.251.76.218 443 [30/Jun/2026:12:08:57 +0300] 178281053763.270249 123.58.47.228 12184 148.251.76.218 443 show less	Web App Attack
🇺🇸 TPI-Abuse	2026-06-30 07:37:26 (1 day ago)	(mod_security) mod_security (id:210492) triggered by 123.58.47.228 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 123.58.47.228 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 30 03:37:13.039508 2026] [security2:error] [pid 6676:tid 6676] [client 123.58.47.228:59380] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "bvidisplay.com"] [uri "/.env.swp"] [unique_id "akNyKels0WeGEG8u4enYRgAAABE"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-30 06:53:04 (1 day ago)	(mod_security) mod_security (id:210492) triggered by 123.58.47.228 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 123.58.47.228 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 30 02:52:52.468913 2026] [security2:error] [pid 21919:tid 21919] [client 123.58.47.228:65523] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "tekrav.com"] [uri "/.env.dev"] [unique_id "akNnxKCM7hFxzkAXqfkVjgAAAAo"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 4server	2026-06-30 04:23:27 (1 day ago)	[TueJun3006:23:15.9336512026][security2:error][pid3900796:tid3900881][client123.58.47.228:0]ModSecur ... show more [TueJun3006:23:15.9336512026][security2:error][pid3900796:tid3900881][client123.58.47.228:0]ModSecurity:Accessdeniedwithcode403$phase1$.Patternmatch\"$\?i$$\?:/\(\?:\^\\|/$\\\\\\\\.$env\\|git\\|svn\\|hg\\|DS_Store$\\|/$\?:wp-config\\|\\\\\\\\.htaccess\\|\\\\\\\\.htpasswd$\\|\\\\\\\\.$\?:sql\\|bak\\|old\\|log$\$\)\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"156\"][id\"960720\"][msg\"Forbiddenfileaccessattempt\"][severity\"CRITICAL\"][hostname\"globalhorizon.ch.136-243-54-122.cpanel.site\"][uri\"/wp-config.php.bak\"][unique_id\"akNEsykUeYPvMi7efz5HCwAAAJQ\"] show less	Port Scan Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-06-29 20:38:39 (1 day ago)	(mod_security) mod_security (id:210492) triggered by 123.58.47.228 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 123.58.47.228 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 29 16:38:26.512481 2026] [security2:error] [pid 28478:tid 28569] [client 123.58.47.228:57930] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.buy-directv.com.exede-sales.com"] [uri "/.env.swp"] [unique_id "akLXwpcj9rJ7buc_XrgSpQAAAZg"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 homeshowdomain.nl	2026-06-26 22:02:26 (4 days ago)	Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ... show more Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-06-25. show less	Web App Attack SSH Hacking
🇳🇱 homeshowdomain.nl	2026-06-25 21:59:25 (5 days ago)	Auto-ban: >3000 req/min op 2026-06-25	Web App Attack SSH Hacking
🇺🇸 mnsf	2026-06-25 21:30:27 (5 days ago)	Abuse Detected (1)	Brute-Force Web App Attack

Showing 1 to 15 of 17 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇲🇾 47.250.155.102

🇧🇷 177.221.143.39

🇧🇷 177.36.17.149

🇺🇸 172.234.199.8

🇸🇬 119.28.101.155

🇮🇳 119.18.55.118

🇹🇭 110.164.228.242

🇻🇳 103.172.236.241

🇧🇭 95.84.65.167

🇺🇸 81.30.98.81

🇰🇷 49.247.136.191

🇸🇬 47.84.139.77

🇺🇸 35.188.112.111

🇻🇳 27.79.6.170

🇸🇬 8.219.249.135

🇩🇪 2a00:1450:4001:c02::125

🇫🇷 2603:1062:0:350::11

🇮🇩 223.25.96.181

🇧🇷 187.57.56.84

🇧🇷 177.221.143.174