This IP address has been reported a total of
65
times from
55 distinct
sources.
136.85.57.243 was first reported on
, and the most recent report was
.
In the last 60 days, the top reporter locations were:
Germany
with 16
reports;
Netherlands
with 9
reports;
United States of America
with 6
reports.
The most common categories in these recent reports were:
Web App Attack
47
times;
Brute-Force
19
times;
Bad Web Bot
17
times;
Hacking
15
times;
SQL Injection
4
times;
Other
12
times.
Recent Reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
{"level":"info","ts":"2026-10-25T14:59:53Z","logger":"http.log.access.log9","msg":"handled request", ...
show more{"level":"info","ts":"2026-10-25T14:59:53Z","logger":"http.log.access.log9","msg":"handled request","request":{"remote_ip":"136.85.57.243","remote_port":"38148","client_ip":"136.85.57.243","proto":"HTTP/2.0","method":"GET","host":"botwork.se","uri":"/7fxntc6zke23hgtxcqzr","headers":{"User-Agent":["Mozilla/5.0 (compatible; Meta-ExternalAgent/1.0; +https://developers.facebook.com/docs/sharing/webmasters/crawler)"],"Accept-Encoding":["gzip"],"Accept":["*/*"],"X-Middleware-Subrequest":["src/middleware:nowaf:src/middleware:src/middleware:src/middleware:src/middleware:middleware:middleware:nowaf:middleware:middleware:middleware:pages/_middleware"],"X-Nextjs-Data":["1"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"h2","server_name":"botwork.se","ech":false}},"bytes_read":0,"user_id":"","duration":0,"size":65536,"status":404,"resp_headers":{"X-Content-Type-Options":["nosniff"],"Permissions-Policy":["interest-cohort=()"],"Content-Type":["text/html; charset=UTF-8"],"Vary":[
...
show less
Multiple unauthorized attempts to access using wrong credentials. Attack automatically blocked by Sk ...
show moreMultiple unauthorized attempts to access using wrong credentials. Attack automatically blocked by SkyDancer Ai. EXT-SYS-Vx
show less
Multiple Next.js internal path accesses from 136.85.57.243 - Possible reconnaissance or attack. Thre ...
show moreMultiple Next.js internal path accesses from 136.85.57.243 - Possible reconnaissance or attack. Threat Score: 7.5/10 (HIGH). Reported by TangerangKota-CSIRT. Status: MALICIOUS
show less
Multiple Next.js internal path accesses from 136.85.57.243 - Possible reconnaissance or attack. Thre ...
show moreMultiple Next.js internal path accesses from 136.85.57.243 - Possible reconnaissance or attack. Threat Score: 7.6/10 (HIGH). Reported by TangerangKota-CSIRT. Status: MALICIOUS
show less
ET EXPLOIT Apache HTTP Server 2.4.49 - Path Traversal Attempt (CVE-2021-41773) M2
ET EXPLOIT Grafa ...
show moreET EXPLOIT Apache HTTP Server 2.4.49 - Path Traversal Attempt (CVE-2021-41773) M2
ET EXPLOIT Grafana 8.x Path Traversal (CVE-2021-43798)
ET EXPLOIT Local File Inclusion with Shell Execution via proc/self/environ
ET EXPLOIT VMware Spring Cloud Directory Traversal (CVE-2020-5410)
ET INFO ChatGPT-User Traffic Detected Inbound M1
ET INFO ChatGPT-User Traffic Detected Inbound M2
ET INFO Request to Hidden Environment File - Inbound
ET POLICY POSSIBLE Crawl using Fetch
ET SCAN Bing Webcrawler User-Agent (BingBot)
ET WEB_SERVER Likely Malicious Request for /proc/self/environ
ET WEB_SERVER Next.js Middleware Authorization Bypass (CVE-2025-29927)
ET WEB_SPECIFIC_APPS Kibana Attempted LFI Exploitation (CVE-2018-17246)
ET WEB_SPECIFIC_APPS Vite Arbitrary File Read Via raw parameter (CVE-2025-30208)
ET WEB_SPECIFIC_APPS Vite Unauthenticated Arbitrary File Read (CVE-2025-31486)
GPL WEB_SERVER .htpasswd access
GPL WEB_SERVER 403 Forbidden
show less
