JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 211.175.22.56

211.175.22.56 was found in our database!

This IP was reported 110 times. Confidence of Abuse is 100%: ?

100%

ISP	Tianfeng (Hongkong) Communications Limited
Usage Type	Fixed Line ISP
ASN	AS9457
Domain Name	tftel.com
Country	🇰🇷 Korea (the Republic of)
City	Seoul, Seoul

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 211.175.22.56

Whois 211.175.22.56

IP Abuse Reports for 211.175.22.56:

This IP address has been reported a total of 110 times from 79 distinct sources. 211.175.22.56 was first reported on June 25th 2026, and the most recent report was 5 minutes ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 Ba-Yu	2026-07-01 14:38:40 (5 minutes ago)	General hacking/exploits/scanning	Web Spam Hacking Brute-Force Exploited Host Web App Attack
Anonymous	2026-07-01 14:31:55 (12 minutes ago)	(caddyscan) Scanner path probe from 211.175.22.56 (KR/South Korea/-): 5 in the last 3600 secs; Ports ... show more (caddyscan) Scanner path probe from 211.175.22.56 (KR/South Korea/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 211.175.22.56 - - [01/Jul/2026:14:31:51 +0000] "GET /wp-config.php.bak HTTP/1.1" [REDACTED] 200 2627 211.175.22.56 - - [01/Jul/2026:14:31:52 +0000] "GET /wp-config.php.old HTTP/1.1" [REDACTED] 200 2627 211.175.22.56 - - [01/Jul/2026:14:31:52 +0000] "GET /wp-config.php.save HTTP/1.1" [REDACTED] 200 2627 211.175.22.56 - - [01/Jul/2026:14:31:52 +0000] "GET /wp-config.php.txt HTTP/1.1" [REDACTED] 200 2627 211.175.22.56 - - [01/Jul/2026:14:31:53 +0000] "GET /wp-config.php~ HTTP/1.1" show less	Port Scan
🇬🇧 foxxelabs	2026-07-01 13:52:10 (51 minutes ago)	Automated report from FoxxeLabs Sentinel. Path probed: /.env \| Project: anseo \| Reason(s): Known exp ... show more Automated report from FoxxeLabs Sentinel. Path probed: /.env \| Project: anseo \| Reason(s): Known exploit path: /.env; AbuseIPDB score: 100/100 \| User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Sa show less	Web App Attack
🇷🇴 SpamStopper	2026-07-01 12:04:59 (2 hours ago)	Fail2Ban - WordPress\(Anomis\) Looking for CMS/PHP/SQL vulnerabilities and hacked web hosts servers	Hacking Brute-Force Bad Web Bot Web App Attack
🇮🇹 VHosting	2026-07-01 11:50:08 (2 hours ago)	Detected WordPress attack from 4 different servers	Brute-Force Web App Attack
🇩🇪 on-com	2026-07-01 11:44:06 (2 hours ago)	URL scan	Brute-Force Web App Attack
Anonymous	2026-07-01 11:27:52 (3 hours ago)	(caddyscan) Scanner path probe from 211.175.22.56 (KR/South Korea/-): 5 in the last 3600 secs; Ports ... show more (caddyscan) Scanner path probe from 211.175.22.56 (KR/South Korea/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 211.175.22.56 - - [01/Jul/2026:11:27:47 +0000] "GET /.env.save HTTP/1.1" [REDACTED] 200 2627 211.175.22.56 - - [01/Jul/2026:11:27:48 +0000] "GET /.env.old HTTP/1.1" [REDACTED] 200 2627 211.175.22.56 - - [01/Jul/2026:11:27:48 +0000] "GET /.env.bak HTTP/1.1" [REDACTED] 200 2627 211.175.22.56 - - [01/Jul/2026:11:27:49 +0000] "GET /.env.tmp HTTP/1.1" [REDACTED] 200 2627 211.175.22.56 - - [01/Jul/2026:11:27:49 +0000] "GET /.env.swp HTTP/1.1" show less	Port Scan
Anonymous	2026-07-01 10:26:23 (4 hours ago)	(wordpress) Failed login wp-login.php or xmlrpc.php	Web App Attack
🇨🇦 polycoda	2026-07-01 10:13:14 (4 hours ago)	📄 Probes for tons of inexistent files and/or PHP scripts	Hacking Web App Attack
Anonymous	2026-07-01 10:10:22 (4 hours ago)	(caddyscan) Scanner path probe from 211.175.22.56 (KR/South Korea/-): 5 in the last 3600 secs; Ports ... show more (caddyscan) Scanner path probe from 211.175.22.56 (KR/South Korea/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 211.175.22.56 - - [01/Jul/2026:10:10:19 +0000] "GET /.env.vault HTTP/1.1" [REDACTED] 200 2627 211.175.22.56 - - [01/Jul/2026:10:10:19 +0000] "GET /.aws/credentials HTTP/1.1" [REDACTED] 200 2627 211.175.22.56 - - [01/Jul/2026:10:10:20 +0000] "GET /.aws/config HTTP/1.1" [REDACTED] 200 2627 211.175.22.56 - - [01/Jul/2026:10:10:20 +0000] "GET /storage/framework/.env HTTP/1.1" [REDACTED] 200 2627 211.175.22.56 - - [01/Jul/2026:10:10:21 +0000] "GET /laravel/.env HTTP/1.1" show less	Port Scan
🇺🇸 alecj.com	2026-07-01 10:10:01 (4 hours ago)	This IP was detected by CrowdSec triggering crowdsecurity/http-sensitive-files	Web App Attack Hacking
🇩🇪 gadix	2026-07-01 09:17:35 (5 hours ago)	[01/Jul/2026:11:17:34.590546 +0200] akTbLmyhwOQzS84Dmaf-fgAAAAk 211.175.22.56 50954 127.0.0.1 7081 [ ... show more [01/Jul/2026:11:17:34.590546 +0200] akTbLmyhwOQzS84Dmaf-fgAAAAk 211.175.22.56 50954 127.0.0.1 7081 [01/Jul/2026:11:17:35.051450 +0200] akTbL4FgobUlguXRLzswHwAAAAE 211.175.22.56 50982 127.0.0.1 7081 [01/Jul/2026:11:17:35.493932 +0200] akTbL0k4lalLW0FUcoDHkgAAAAA 211.175.22.56 50988 127.0.0.1 7081 ... show less	Web App Attack
🇳🇱 Site.eu	2026-07-01 09:13:58 (5 hours ago)	Excessive multi-domain requests	Brute-Force
🇩🇪 onlyops.app	2026-07-01 09:00:07 (5 hours ago)	Web application firewall (ModSecurity) detected malicious traffic \| detected by Fail2Ban (plesk-mods ... show more Web application firewall (ModSecurity) detected malicious traffic \| detected by Fail2Ban (plesk-modsecurity jail) \| onlyops.app show less	Exploited Host
🇺🇦 URAN Publishing Service	2026-07-01 08:46:45 (5 hours ago)	211.175.22.56 - - [01/Jul/2026:11:46:44 +0300] "GET /private/.env HTTP/1.1" 404 4677 "-" "Mozilla/5. ... show more 211.175.22.56 - - [01/Jul/2026:11:46:44 +0300] "GET /private/.env HTTP/1.1" 404 4677 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 (Silvy X Ran)" 211.175.22.56 - - [01/Jul/2026:11:46:44 +0300] "GET /var/.env HTTP/1.1" 404 729 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 (Silvy X Ran)" ... show less	Web App Attack

Showing 1 to 15 of 110 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇳🇱 91.92.40.204

🇩🇪 2001:638:504:8205::6

🇦🇷 186.96.194.72

🇨🇳 150.255.183.36

🇮🇳 137.97.80.58

🇷🇴 80.94.92.65

🇱🇹 62.60.130.219

🇧🇷 20.206.105.139

🇬🇧 193.163.125.231

🇨🇴 190.5.200.98

🇨🇳 150.255.182.115

🇭🇰 141.11.2.185

🇶🇦 78.100.214.75

🇺🇸 66.132.172.151

🇻🇳 58.187.141.39

🇮🇪 34.254.176.76

🇨🇳 220.250.52.111

🇨🇳 150.255.176.179

🇱🇹 141.98.9.55

🇨🇳 124.74.104.42