AbuseIPDB » 31.171.130.46

31.171.130.46 was found in our database!

This IP was reported 128 times. Confidence of Abuse is 100%: ?

100%

ISP	Netrouting B.V.
Usage Type	Fixed Line ISP
ASN	AS206092
Domain Name	expressvpn.com
Country	United Kingdom of Great Britain and Northern Ireland
City	London, England

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated biweekly.

Report 31.171.130.46

Whois 31.171.130.46

IP Abuse Reports for 31.171.130.46:

This IP address has been reported a total of 128 times from 72 distinct sources. 31.171.130.46 was first reported on December 4th 2024, and the most recent report was 4 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp in UTC	Comment	Categories
Mr-Money	2025-07-12 23:44:23 (4 days ago)	31.171.130.46 - - [13/Jul/2025:01:44:22 +0200] "POST /.env.development%20 HTTP/1.1" 404 492 "-" "Moz ... show more31.171.130.46 - - [13/Jul/2025:01:44:22 +0200] "POST /.env.development%20 HTTP/1.1" 404 492 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36" ... show less	Hacking SQL Injection Bad Web Bot Exploited Host Web App Attack
barbarella	2025-07-09 05:00:11 (1 week ago)	Multiple (6) times attack on https port 443: Configuration snooping with .env file (GET /api/.env) < ... show moreMultiple (6) times attack on https port 443: Configuration snooping with .env file (GET /api/.env) 05:00:12 Configuration snooping in .env file (GET /app/.env%20) 05:00:15 Configuration snooping with .env file (GET /system/.env) 05:00:37 Configuration snooping with modified .env.* file (POST /enviroments/.env.production) 05:02:17 Configuration snooping in .env file (GET /..;/env.js) 05:02:39 Illegal access to local filesystem (GET /_profiler/phpinfo) show less	Hacking Web App Attack
Holger	2025-07-08 12:02:02 (1 week ago)	URL probing: GET /rest/.env	Web App Attack
Not Fake	2025-07-07 22:15:07 (1 week ago)	$f2bV_matches	Web App Attack
barbarella	2025-07-07 06:16:34 (1 week ago)	Multiple (4) times attack on http port 80: Configuration snooping with .env file (POST /cms/.env) 89 ... show moreMultiple (4) times attack on http port 80: Configuration snooping with .env file (POST /cms/.env) 8971E07C 06:17:16 configuration snooping of .json files (GET /.vscode/sftp.json) 8957F7FB 06:17:41 Configuration snooping (GET /src/api/config.js) 895B18F6 06:18:20 PHP Configuration snooping with phpinfo file (GET /tool/view/phpinfo.view.php) 896DB6AA show less	Hacking Web App Attack
psauxit	2025-07-07 03:29:48 (1 week ago)	Fail2Ban - NGINX bad requests 400-401-403-404-444, high level vulnerability scanning, commonly xmlrp ... show moreFail2Ban - NGINX bad requests 400-401-403-404-444, high level vulnerability scanning, commonly xmlrpc_attack, wp-login brute force, excessive crawling/scraping show less	Hacking Web App Attack
Anonymous	2025-07-06 21:47:38 (1 week ago)		DNS Compromise DDoS Attack
v1nc	2025-07-06 20:33:05 (1 week ago)	31.171.130.46 - - [06/Jul/2025:20:33:05 +0000] "GET /_info-backoffice.php HTTP/1.1" 404 548 "-" "Moz ... show more31.171.130.46 - - [06/Jul/2025:20:33:05 +0000] "GET /_info-backoffice.php HTTP/1.1" 404 548 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36" ... show less	Hacking
ThreatBook.io	2025-07-05 22:41:30 (1 week ago)	ThreatBook Intelligence: Zombie,Spam more details on https://threatbook.io/ip/31.171.130.46 20 ... show moreThreatBook Intelligence: Zombie,Spam more details on https://threatbook.io/ip/31.171.130.46 2025-07-05 08:58:12 /shared/.env%20,{"body":"0x%5B%5D=DTAB","content_type":"application/x-www-form-urlencoded","header":{"Accept":["/"],"Accept-Encoding":["*"],"Connection":["keep-alive"],"Content-Length":["13"],"Content-Type":["application/x-www-form-urlencoded"],"User-Agent":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36"]},"host":"121.199.1.55","method":"POST","proto":"HTTP/1.1","remote_addr":"31.171.130.46:51675","status_code":200,"url":"/shared/.env%20","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36"} show less	Web App Attack
lid3rc	2025-07-05 18:36:04 (1 week ago)	According to the AbuseIPDB risk analysis, the IP address is too high risk.	Web App Attack
0xffffffff	2025-07-05 03:10:11 (1 week ago)	[2025-07-05 06:09:44.590113] [authz_core:error] [pid 445570:tid 136013714499264] [client 31.171.130. ... show more[2025-07-05 06:09:44.590113] [authz_core:error] [pid 445570:tid 136013714499264] [client 31.171.130.46:22333] AH01630: client denied by server configuration: /var/www//app , error_notes:wrong-host , URI:'/app/.env%20' [2025-07-05 06:09:53.110690] [authz_core:error] [pid 445571:tid 136013586343616] [client 31.171.130.46:9175] AH01630: client denied by server configuration: /var/www//script , error_notes:wrong-host , URI:'/script/.env' [2025-07-05 06:09:55.084687] [authz_core:error] [pid 445570:tid 136013714499264] [client 31.171.130.46:35901] AH01630: client denied by server configuration: /var/www/html/AwsConfig.json , error_notes:wrong-host , URI:'/AwsConfig.json' show less	Bad Web Bot Web App Attack
sdos.es	2025-07-04 20:25:29 (1 week ago)	"Restricted File Access Attempt - Matched Data: /.env found within REQUEST_FILENAME: /cp/.env"	Web App Attack
Don Felip	2025-07-03 06:26:15 (2 weeks ago)	Web Exploiter - Banned by Fail2Ban	Hacking Web App Attack
Starburst SysOp Team	2025-07-03 04:43:34 (2 weeks ago)	Host header is a numeric IP address. Pattern match "(?:^( (920350-nue6-2)	Hacking Bad Web Bot
Security_Whaller	2025-07-02 19:44:58 (2 weeks ago)	Malicious activity detected on Honeypot.	Hacking Brute-Force Web App Attack