JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 158.180.48.70

158.180.48.70 was found in our database!

This IP was reported 62 times. Confidence of Abuse is 100%: ?

100%

ISP	oracle
Usage Type	Data Center/Web Hosting/Transit
ASN	AS31898
Domain Name	m-oracle.com
Country	🇩🇪 Germany
City	Frankfurt am Main, Hesse

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 158.180.48.70

Whois 158.180.48.70

IP Abuse Reports for 158.180.48.70:

This IP address has been reported a total of 62 times from 47 distinct sources. 158.180.48.70 was first reported on June 25th 2026, and the most recent report was 1 day ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇨🇭 4server	2026-07-06 16:17:49 (1 day ago)	[MonJul0618:17:43.5955202026][security2:error][pid4159282:tid4159338][client158.180.48.70:0]ModSecur ... show more [MonJul0618:17:43.5955202026][security2:error][pid4159282:tid4159338][client158.180.48.70:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Matchedphrase\".env\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"365\"][id\"960720\"][msg\"Forbiddenfileaccess\"][hostname\"viaggi-marocco-lugano.ch.flyingberber.com\"][uri\"/.env\"][unique_id\"akvVJzIfC1j11KVDCBKXmwAAANQ\"] show less	Hacking Web App Attack
🇫🇷 LRob	2026-07-06 13:31:17 (1 day ago)	CrowdSec: crowdsecurity/http-probing \| req: ["/settings.py","/config.py","/secrets.py","/config/secr ... show more CrowdSec: crowdsecurity/http-probing \| req: ["/settings.py","/config.py","/secrets.py","/config/secrets.yml","/config/master.key","/wp-config.php.bak","/wp-config.php.old","/wp-config.php.save","/wp-config.php.txt","/wp-config.php~","/config/app.php"] \| UA: ["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 (Silvy X Ran)"] show less	Port Scan Web App Attack
Anonymous	2026-07-06 03:42:58 (2 days ago)	(caddyscan) Scanner path probe from 158.180.48.70 (DE/Germany/-): 5 in the last 3600 secs; Ports: ; ... show more (caddyscan) Scanner path probe from 158.180.48.70 (DE/Germany/-): 5 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 158.180.48.70 - - [06/Jul/2026:03:42:54 +0000] "GET /.env HTTP/1.1" [REDACTED] 200 2627 158.180.48.70 - - [06/Jul/2026:03:42:55 +0000] "GET /.env.local HTTP/1.1" [REDACTED] 200 2627 158.180.48.70 - - [06/Jul/2026:03:42:55 +0000] "GET /.env.production HTTP/1.1" [REDACTED] 200 2627 158.180.48.70 - - [06/Jul/2026:03:42:55 +0000] "GET /.env.development HTTP/1.1" [REDACTED] 200 2627 158.180.48.70 - - [06/Jul/2026:03:42:56 +0000] "GET /.env.dev HTTP/1.1" show less	Port Scan
🇳🇱 Site.eu	2026-07-05 23:23:15 (2 days ago)	Excessive multi-domain requests	Brute-Force
🇺🇸 Matthew Ping	2026-07-05 23:00:02 (2 days ago)	ModSecurity rule 949110 triggered on dedicated. Web application attack blocked by CSF/LFD.	Web App Attack Hacking
🇨🇦 Aleigo Abuse	2026-07-05 18:55:32 (2 days ago)	SIP auth challenge (INVITE) fraud attempt detected.	Web App Attack Brute-Force Fraud VoIP Hacking
🇩🇪 IVski	2026-07-05 17:48:34 (2 days ago)	IVski WAF \| Sensitive file probe detected - looking for .env	Port Scan Brute-Force Web App Attack
🇩🇪 SCHAPPY	2026-07-05 15:53:48 (2 days ago)	Brute-force attack to non-existent web resources, HTTP code 404.	Brute-Force Web App Attack
Anonymous	2026-07-05 12:06:05 (3 days ago)	Bot / scanning and/or hacking attempts: GET /env HTTP/1.1, GET /env.json HTTP/1.1, GET /.flaskenv HT ... show more Bot / scanning and/or hacking attempts: GET /env HTTP/1.1, GET /env.json HTTP/1.1, GET /.flaskenv HTTP/1.1, GET /.envrc HTTP/1.1, GET /frontend/.env HTTP/1.1, GET /config/.env HTTP/1.1, GET /server/.env HTTP/1.1, GET /env.js HTTP/1.1, GET /src/.env HTTP/1.1, GET /backend/.env HTTP/1.1, GET /api/.env HTTP/1.1, GET /app/.env HTTP/1.1, GET /.env.production.local HTTP/1.1, GET /.env.test.local HTTP/1.1, GET /.env.template HTTP/1.1, GET /.env.staging HTTP/1.1, GET /.env.backup HTTP/1.1, GET /.env.development.local HTTP/1.1, GET /client/.env HTTP/1.1 show less	Hacking Web App Attack
🇳🇱 debestelapp	2026-07-05 11:35:05 (3 days ago)		Web App Attack
🇮🇹 Inartis	2026-07-05 06:30:44 (3 days ago)	158.180.48.70 - - [05/Jul/2026:08:30:43 +0200] "GET /.env.old HTTP/1.1" 403 5047 "-" "Mozilla/5.0 (W ... show more 158.180.48.70 - - [05/Jul/2026:08:30:43 +0200] "GET /.env.old HTTP/1.1" 403 5047 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 (Silvy X Ran)" ... show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-07-05 05:34:38 (3 days ago)	Aggressive web scan	Web App Attack
🇬🇧 openstrike.co.uk	2026-07-05 05:15:44 (3 days ago)	5 attacks on password grabbing URLs: GET /.aws/credentials HTTP/1.1	Hacking
Anonymous	2026-07-05 01:51:49 (3 days ago)	158.180.48.70 - - [05/Jul/2026:03:51:46 +0200] "GET /config/default.json HTTP/1.1" 403 829 "-" "Mozi ... show more 158.180.48.70 - - [05/Jul/2026:03:51:46 +0200] "GET /config/default.json HTTP/1.1" 403 829 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 (Silvy X Ran)" 158.180.48.70 - - [05/Jul/2026:03:51:46 +0200] "GET /config/default.json HTTP/1.1" 403 288 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 (Silvy X Ran)" 158.180.48.70 - - [05/Jul/2026:03:51:46 +0200] "GET /config/local.json HTTP/1.1" 403 829 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 (Silvy X Ran)" 158.180.48.70 - - [05/Jul/2026:03:51:46 +0200] "GET /config/local.json HTTP/1.1" 403 288 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 (Silvy X Ran)" 158.180.48.70 - - [05/Jul/2026:03:51:47 +0200] "GET /conf/settings.json HTTP/1.1" 404 826 "-" "Mozilla/5.0 (Wind ... show less	Bad Web Bot Web App Attack
🇩🇪 paissangroup	2026-07-05 01:28:55 (3 days ago)	Multiple WAF Violations	Web App Attack

Showing 1 to 15 of 62 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇧🇬 79.124.40.138

🇺🇸 65.49.20.100

🇦🇷 45.183.123.18

🇺🇸 44.202.123.149

🇯🇵 40.115.138.243

🇺🇸 34.223.114.98

🇸🇬 20.212.16.67

🇯🇵 15.152.52.61

🇮🇹 5.179.138.136

🇺🇸 172.217.36.23

🇿🇦 147.136.76.16

🇨🇳 115.190.60.214

🇫🇮 65.108.252.22

🇳🇱 31.14.32.8

🇮🇷 195.214.235.99

🇳🇱 185.242.226.104

🇳🇱 185.226.197.70

🇻🇳 180.93.246.62

🇳🇱 176.65.148.25

🇨🇳 116.236.222.106