JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 14.18.95.245

14.18.95.245 was found in our database!

This IP was reported 20 times. Confidence of Abuse is 72%: ?

72%

ISP	CHINANET Guangdong province network
Usage Type	Commercial
ASN	AS58466
Domain Name	chinatelecom.cn
Country	🇨🇳 China
City	Shenzhen, Guangdong

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 14.18.95.245

Whois 14.18.95.245

IP Abuse Reports for 14.18.95.245:

This IP address has been reported a total of 20 times from 13 distinct sources. 14.18.95.245 was first reported on June 25th 2026, and the most recent report was 2 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 CounterScrape	2026-07-03 01:03:33 (2 hours ago)	CounterScrape Deception: Bot identified as HONEYTOKEN_HIT (Unauthorized access attempt to leaked hon ... show more CounterScrape Deception: Bot identified as HONEYTOKEN_HIT (Unauthorized access attempt to leaked honeytoken infrastructure subdomain). Trapped in honeypot. Concurrency hits: 2. Bandwidth drained: 0.0 MB. show less	Bad Web Bot Port Scan
🇺🇸 CounterScrape	2026-07-02 00:03:45 (1 day ago)	CounterScrape Deception: Bot identified as HONEYTOKEN_HIT (Unauthorized access attempt to leaked hon ... show more CounterScrape Deception: Bot identified as HONEYTOKEN_HIT (Unauthorized access attempt to leaked honeytoken infrastructure subdomain). Trapped in honeypot. Concurrency hits: 2. Bandwidth drained: 0.0 MB. show less	Bad Web Bot Port Scan
🇺🇸 CounterScrape	2026-07-01 00:02:41 (2 days ago)	CounterScrape Deception: Bot identified as HONEYTOKEN_HIT (Unauthorized access attempt to leaked hon ... show more CounterScrape Deception: Bot identified as HONEYTOKEN_HIT (Unauthorized access attempt to leaked honeytoken infrastructure subdomain). Trapped in honeypot. Concurrency hits: 2. Bandwidth drained: 0.0 MB. show less	Bad Web Bot Port Scan
Anonymous	2026-06-30 23:42:04 (2 days ago)	Bot / scanning and/or hacking attempts: GET /.env.development HTTP/1.1, GET /.env.production HTTP/1. ... show more Bot / scanning and/or hacking attempts: GET /.env.development HTTP/1.1, GET /.env.production HTTP/1.1, GET /.env.local HTTP/1.1 show less	Hacking Web App Attack
Anonymous	2026-06-30 23:33:35 (2 days ago)	(caddyscan) Scanner path probe from 14.18.95.245 (CN/China/-): 5 in the last 3600 secs; Ports: ; Di ... show more (caddyscan) Scanner path probe from 14.18.95.245 (CN/China/-): 5 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 14.18.95.245 - - [30/Jun/2026:23:33:30 +0000] "GET /.env.production HTTP/1.1" [REDACTED] 200 2627 14.18.95.245 - - [30/Jun/2026:23:33:30 +0000] "GET /.env.development HTTP/1.1" [REDACTED] 200 2627 14.18.95.245 - - [30/Jun/2026:23:33:31 +0000] "GET /.env.dev HTTP/1.1" [REDACTED] 200 2627 14.18.95.245 - - [30/Jun/2026:23:33:31 +0000] "GET /.env.prod HTTP/1.1" [REDACTED] 200 2627 14.18.95.245 - - [30/Jun/2026:23:33:32 +0000] "GET /.env.test HTTP/1.1" show less	Port Scan
🇩🇪 DEV-DNS	2026-06-30 21:05:04 (2 days ago)	(mod_security) mod_security triggered on hostname [redacted])	SQL Injection
🇩🇪 big-cloud.nl	2026-06-30 20:08:50 (2 days ago)	Try to access /app/.env	Web App Attack
🇺🇸 TPI-Abuse	2026-06-30 14:12:16 (2 days ago)	(mod_security) mod_security (id:210492) triggered by 14.18.95.245 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 14.18.95.245 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 30 10:12:07.969106 2026] [security2:error] [pid 10864:tid 10864] [client 14.18.95.245:56873] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.micasafrontgate.joepaladino.com"] [uri "/.env.dev"] [unique_id "akPOt75JOUoTjtV7mhxR_gAAACA"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-06-30 12:24:09 (2 days ago)	2026/06/30 09:24:07 [error] 785144#785144: 70523 access forbidden by rule, client: 14.18.95.245, se ... show more 2026/06/30 09:24:07 [error] 785144#785144: 70523 access forbidden by rule, client: 14.18.95.245, server: blogmania.com.br, request: "GET /backup/.env HTTP/1.1", host: "www.blogmania.com.br" 2026/06/30 09:24:08 [error] 785144#785144: 70523 access forbidden by rule, client: 14.18.95.245, server: blogmania.com.br, request: "GET /backups/.env HTTP/1.1", host: "www.blogmania.com.br" 2026/06/30 09:24:08 [error] 785144#785144: 70523 access forbidden by rule, client: 14.18.95.245, server: blogmania.com.br, request: "GET /old/.env HTTP/1.1", host: "www.blogmania.com.br" ... show less	Port Scan
🇩🇪 itsolon	2026-06-30 08:51:58 (2 days ago)	[30/Jun/2026:10:51:54 +0200] 178280951473.982566 14.18.95.245 48957 217.154.7.177 443 [30/Jun/2026:1 ... show more [30/Jun/2026:10:51:54 +0200] 178280951473.982566 14.18.95.245 48957 217.154.7.177 443 [30/Jun/2026:10:51:55 +0200] 178280951586.136095 14.18.95.245 48957 217.154.7.177 443 [30/Jun/2026:10:51:55 +0200] 178280951581.195807 14.18.95.245 48957 217.154.7.177 443 [30/Jun/2026:10:51:57 +0200] 178280951760.571630 14.18.95.245 48957 217.154.7.177 443 [30/Jun/2026:10:51:58 +0200] 178280951897.453266 14.18.95.245 48957 217.154.7.177 443 ... show less	Port Scan Hacking Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-06-30 06:44:10 (2 days ago)	(mod_security) mod_security (id:210492) triggered by 14.18.95.245 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 14.18.95.245 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 30 02:44:03.320517 2026] [security2:error] [pid 16506:tid 16622] [client 14.18.95.245:45617] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "playerintro.beckmon.com"] [uri "/.env.development.local"] [unique_id "akNls76C_80tzeR6c-47KwAAAJM"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-30 06:09:20 (2 days ago)	(mod_security) mod_security (id:210492) triggered by 14.18.95.245 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 14.18.95.245 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 30 02:09:13.941893 2026] [security2:error] [pid 12211:tid 12211] [client 14.18.95.245:56164] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mainescentsecrets.com"] [uri "/laravel/.env"] [unique_id "akNdib8lNcrRGmc7UUbT1QAAAAw"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 masterguru	2026-06-30 06:07:27 (2 days ago)	Restricted File Access Attempt. Matched phrase ".env" at REQUEST_FILENAME. (930130-201)	Hacking Web App Attack
Anonymous	2026-06-30 05:58:47 (2 days ago)	Blocked by ModSec and CSF	Port Scan
🇩🇪 4server	2026-06-29 20:07:46 (3 days ago)	[MonJun2922:07:39.0648082026][security2:error][pid3455034:tid3455112][client14.18.95.245:0]ModSecuri ... show more [MonJun2922:07:39.0648082026][security2:error][pid3455034:tid3455112][client14.18.95.245:0]ModSecurity:Accessdeniedwithcode403\(phase2\).OperatorGEmatched5atTX:anomaly_score.[file\"/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf\"][line\"94\"][id\"949110\"][msg\"InboundAnomalyScoreExceeded\(TotalScore:5\)\"][severity\"CRITICAL\"][ver\"OWASP_CRS/3.3.9\"][tag\"application-multi\"][tag\"language-multi\"][tag\"platform-multi\"][tag\"attack-generic\"][hostname\"sanierung-pilzen-schimmel.ch.risanamento-funghi-muffa.ch\"][uri\"/.envrc\"][unique_id\"akLQixxQNjp-yGeQALs7tgAAANE\"] show less	Port Scan Brute-Force Web App Attack

Showing 1 to 15 of 20 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇷 201.191.38.215

🇧🇷 177.212.155.200

🇦🇷 152.171.118.64

🇫🇮 147.185.133.36

🇭🇰 112.119.21.245

🇮🇩 103.168.135.187

🇧🇩 103.127.56.43

🇫🇷 93.4.191.215

🇳🇱 91.92.40.37

🇬🇧 87.236.176.142

🇺🇸 48.217.82.99

🇳🇱 45.148.10.147

🇸🇬 43.173.181.63

🇴🇲 37.41.52.60

🇯🇵 8.216.2.17

🇵🇭 180.190.85.194

🇳🇱 176.65.148.216

🇺🇸 172.238.160.104

🇫🇮 147.185.133.174

🇭🇰 123.58.215.196