AbuseIPDB » 2.57.122.158

2.57.122.158 was found in our database!

This IP was reported 4,331 times. Confidence of Abuse is 67%: ?

67%

ISP	TECHOFF SRV LIMITED
Usage Type	Data Center/Web Hosting/Transit
ASN	AS47890
Domain Name	dmzhost.co
Country	Romania
City	Timisoara, Timiș County

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated biweekly.

Report 2.57.122.158

Whois 2.57.122.158

IP Abuse Reports for 2.57.122.158:

This IP address has been reported a total of 4,331 times from 379 distinct sources. 2.57.122.158 was first reported on July 15th 2021, and the most recent report was 7 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp in UTC	Comment	Categories
security.rdmc.fr	2021-09-19 05:39:22 (3 years ago)	Automatic report - Banned IP Access	Web App Attack
CrystalMaker	2021-09-19 04:51:47 (3 years ago)	Vulnerability scan - GET /.env; GET /.env; GET /.env; GET /sendgrid.env; GET /.aws/credentials; GET ... show moreVulnerability scan - GET /.env; GET /.env; GET /.env; GET /sendgrid.env; GET /.aws/credentials; GET /config.json; GET /config.js; GET /.env show less	Hacking
SecondEdge	2021-09-19 00:56:35 (3 years ago)	Web scan/attack: detected 8 distinct attempt(s) within a 12-hour window (Git Variable Scan)	Web App Attack
SecondEdge	2021-09-18 00:56:26 (3 years ago)	Web scan/attack: detected 1 distinct attempt(s) within a 12-hour window (Git Variable Scan)	Web App Attack
Vieira Filho	2021-09-17 23:32:45 (3 years ago)	2.57.122.158 - - [18/Sep/2021:00:32:45 -0300] [35.198.31.82] "35.198.31.82" "GET /.env HTTP/1.1" 40 ... show more2.57.122.158 - - [18/Sep/2021:00:32:45 -0300] [35.198.31.82] "35.198.31.82" "GET /.env HTTP/1.1" 404 169 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0" 0.000 ... show less	Brute-Force Exploited Host Web App Attack
FireballDWF	2021-09-17 22:50:16 (3 years ago)	404 NOT FOUND	Web App Attack
FireballDWF	2021-09-16 01:40:16 (3 years ago)	404 NOT FOUND	Web App Attack
netfactotum	2021-09-16 01:31:57 (3 years ago)		Hacking Bad Web Bot Exploited Host Web App Attack
unifr	2021-09-15 20:16:27 (3 years ago)	Unauthorized IMAP connection attempt	Brute-Force
IrisFlower	2021-09-15 18:41:16 (3 years ago)	Unauthorized connection attempt detected from IP address 2.57.122.158 to port 80 [J]	Port Scan Hacking
IrisFlower	2021-09-15 06:54:25 (3 years ago)	Unauthorized connection attempt detected from IP address 2.57.122.158 to port 80 [J]	Port Scan Hacking
4server	2021-09-14 16:14:30 (3 years ago)	[TueSep1422:14:23.3860082021][:error][pid929:tid47941058483968][client2.57.122.158:41528][client2.57 ... show more[TueSep1422:14:23.3860082021][:error][pid929:tid47941058483968][client2.57.122.158:41528][client2.57.122.158]ModSecurity:Accessdeniedwithcode403$phase2$.Patternmatch\"$\?:\\\\\\\\b\(\?:\\\\\\\\.\(\?:ht\(\?:access\\|passwd\\|group$\\|www_\?acl\)\\|global\\\\\\\\.asa\\|httpd\\\\\\\\.conf\\|boot\\\\\\\\.ini\\|web.config\)\\\\\\\\b\\|$\\|\^\\|\\\\\\\\.\\\\\\\\.$/etc/\\|/\\\\\\\\.$\?:history\\|bash_history\\|sh_history\\|env$\$\)\"atREQUEST_FILENAME.[file\"/etc/apache2/conf.d/modsec_rules/10_asl_rules.conf\"][line\"212\"][id\"390709\"][rev\"30\"][msg\"Atomicorp.comWAFRules:Attempttoaccessprotectedfileremotely\"][data\"/.env\"][severity\"CRITICAL\"][hostname\"136.243.224.56\"][uri\"/.env\"][unique_id\"YUECn_WVcmDWJKa7o82LbAAAAAo\"][TueSep1422:14:23.4625432021][:error][pid27195:tid47941047977728][client2.57.122.158:41542][client2.57.122.158]ModSecurity:Accessdeniedwithcode403$phase2$.Patternmatch\"$\?:\\\\\\\\b\(\?:\\\\\\\\.\(\?:ht\(\?:access\\|passwd\\|group$\\|www_\?acl\)\\|global\\\\\\\\.asa\\|httpd\\\\\\\\.conf\\|boot\\ show less	Port Scan Brute-Force Web App Attack
xyz.rip	2021-09-14 16:08:23 (3 years ago)	WAF Violation...	Hacking Web App Attack
tmiland	2021-09-11 17:13:36 (3 years ago)	(nginx_404) Dot directory Honeypot Trap 2.57.122.158 (NL/Netherlands/mail.gergatewayuserinfos.xyz): ... show more(nginx_404) Dot directory Honeypot Trap 2.57.122.158 (NL/Netherlands/mail.gergatewayuserinfos.xyz): 2 in the last 3600 secs show less	Brute-Force Bad Web Bot
Anonymous	2021-09-10 19:16:11 (3 years ago)	port scan and connect, tcp 80 (http)	Port Scan