This IP address has been reported a total of
59
times from
50 distinct
sources.
23.94.145.124 was first reported on
, and the most recent report was
.
In the last 60 days, the top reporter locations were:
Germany
with 17
reports;
United States of America
with 12
reports;
France
with 9
reports.
The most common categories in these recent reports were:
Web App Attack
29
times;
Port Scan
20
times;
Hacking
18
times;
Brute-Force
10
times;
Bad Web Bot
10
times;
Other
3
times.
Recent Reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
UFW blocked a suspicious connection attempt to a closed or denied port. This activity is commonly as ...
show moreUFW blocked a suspicious connection attempt to a closed or denied port. This activity is commonly associated with port scanning, service discovery, or automated internet probing. Technical: source_ip=23.94.145.124; proto=TCP; source_port=56962; target_port=8000
show less
Port Scan
Anonymous
[05/Oct/2026:18:07:23 +0000] host=213.32.24.28 server=_ ip=23.94.145.124 method=POST req=/vendor/php ...
show more[05/Oct/2026:18:07:23 +0000] host=213.32.24.28 server=_ ip=23.94.145.124 method=POST req=/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php uri=/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php status=301 bytes=162 rt=0.000 urt=- ref="-" ua="Mozilla/5.0 (iPhone; CPU iPhone OS 16_6 like Mac OS X) AppleWebKit/605.1.15"
...
show less
2026-10-05 05:00:47,485 fail2ban.actions [1402623]: NOTICE [threat-detection] Ban 23.94.145. ...
show more2026-10-05 05:00:47,485 fail2ban.actions [1402623]: NOTICE [threat-detection] Ban 23.94.145.124
2026-10-05 18:00:48,355 fail2ban.actions [1402623]: NOTICE [threat-detection] Ban 23.94.145.124
...
show less
2026-10-05T09:06:35.405586-06:00 derpamp-oci derper[1053]: 2026/10/05 09:06:35 http: TLS handshake e ...
show more2026-10-05T09:06:35.405586-06:00 derpamp-oci derper[1053]: 2026/10/05 09:06:35 http: TLS handshake error from 23.94.145.124:57694: acme/autocert: missing server name
2026-10-05T09:06:35.405971-06:00 derpamp-oci derper[1053]: 2026/10/05 09:06:35 http: TLS handshake error from 23.94.145.124:57678: acme/autocert: missing server name
2026-10-05T09:06:35.406493-06:00 derpamp-oci derper[1053]: 2026/10/05 09:06:35 http: TLS handshake error from 23.94.145.124:57692: acme/autocert: missing server name
...
show less
CrowdSec: suspicious activity detected by CrowdSec. Scenario=crowdsecurity/CVE-2017-9841; events=1; ...
show moreCrowdSec: suspicious activity detected by CrowdSec. Scenario=crowdsecurity/CVE-2017-9841; events=1; window=2026-10-05T15:02:38.748977209Z .. 2026-10-05T15:02:38.748977209Z. Tried: POST /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php. Automated report, no manual review.
show less
Attempted to exploit CVE-2017-9841 (PHPUnit Remote Code Execution) by POSTing to /vendor/phpunit/php ...
show moreAttempted to exploit CVE-2017-9841 (PHPUnit Remote Code Execution) by POSTing to /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php.
show less
