This IP address has been reported a total of
385
times from
287 distinct
sources.
192.222.53.104 was first reported on
, and the most recent report was
.
In the last 60 days, the top reporter locations were:
Germany
with 84
reports;
United States of America
with 81
reports;
France
with 41
reports.
The most common categories in these recent reports were:
Web App Attack
291
times;
Bad Web Bot
127
times;
Hacking
80
times;
Brute-Force
68
times;
Port Scan
38
times;
Other
26
times.
Recent Reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Automated web scanning detected by Wazuh (rule 100241): repeated 400/404 errors from mass probing of ...
show moreAutomated web scanning detected by Wazuh (rule 100241): repeated 400/404 errors from mass probing of admin/backdoor paths (e.g. wp-login.php, known CMS shell filenames) on an Apache web server, on 2026-10-09 17:18 UTC.
show less
[fail2ban]
2026-10-09T17:15:17.114654+00:00 arson caddy[1712]: {"level":"info","ts":1791566117.11448 ...
show more[fail2ban]
2026-10-09T17:15:17.114654+00:00 arson caddy[1712]: {"level":"info","ts":1791566117.1144829,"logger":"http.log.access.default","msg":"handled request","request":{"remote_ip":"192.222.53.104","remote_port":"41518","client_ip":"192.222.53.104","proto":"HTTP/1.1","method":"GET","host":"r.arson.gg","uri":"/.git/config","headers":{"User-Agent":["Mozilla/5.0 (compatible; YandexBot/3.0; +http://yandex.com/bots)"],"Accept-Charset":["utf-8"],"Accept-Encoding":["gzip"],"Connection":["close"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"","server_name":"r.arson.gg","ech":false}},"bytes_read":0,"user_id":"","duration":0.000116659,"size":7,"status":418,"resp_headers":{"Server":["Caddy"],"Alt-Svc":["h3=\":443\"; ma=2592000"],"Content-Type":["text/plain; charset=utf-8"]}}
...
show less
Bad Web Bot
Anonymous
[BunkerWeb] block (reason: blacklist)
GET /.git/config
UA: Mozilla/5.0 (Windows NT 6.1; Win64; x64) ...
show more[BunkerWeb] block (reason: blacklist)
GET /.git/config
UA: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.108 Safari/537.36
show less
Probed planted web canary URI (not a real app path).
HTTP request completed against planted URIs (.e ...
show moreProbed planted web canary URI (not a real app path).
HTTP request completed against planted URIs (.env/wp-login/xmlrpc/phpmyadmin/.git).
jail=nginx-canary proto=tcp port=80,443 failures>=2 class=web-app-probe
these paths are not real apps on this host; hit is hostile recon
when=2026-10-09T17:00:25Z sensor=fail2ban role=web-canary
src=192.222.53.104
show less
Detected empty referer, indicating web scraping / abusive scanning with UA: "Mozilla/5.0 (Windows NT ...
show moreDetected empty referer, indicating web scraping / abusive scanning with UA: "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko" and uri: "/index.php"
show less
