JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 31.56.209.52

31.56.209.52 was found in our database!

This IP was reported 128 times. Confidence of Abuse is 100%: ?

100%

ISP	SWISSNET LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS209373
Domain Name	swissnetwork.io
Country	🇳🇱 Netherlands
City	Kerkrade, Limburg

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 31.56.209.52

Whois 31.56.209.52

IP Abuse Reports for 31.56.209.52:

This IP address has been reported a total of 128 times from 115 distinct sources. 31.56.209.52 was first reported on July 5th 2026, and the most recent report was 15 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇬🇧 sc user	2026-07-21 09:45:54 (15 hours ago)	Fail2Ban nginx: repeated suspicious HTTP requests consistent with automated probing, scanning or bad ... show more Fail2Ban nginx: repeated suspicious HTTP requests consistent with automated probing, scanning or bad bot behaviour. Technical log details and local server identifiers intentionally omitted for privacy. show less	Bad Web Bot Web App Attack Port Scan
🇳🇱 JCB	2026-07-21 08:37:00 (16 hours ago)	31.56.209.52 - - [21/Jul/2026:02:22:35 +0300] "GET /.env.prod HTTP/1.1" 403 239 "-" "Mozilla/5.0 (co ... show more 31.56.209.52 - - [21/Jul/2026:02:22:35 +0300] "GET /.env.prod HTTP/1.1" 403 239 "-" "Mozilla/5.0 (compatible; SecurityAudit/1.0)" 31.56.209.52 - - [21/Jul/2026:02:22:35 +0300] "GET /.env HTTP/1.1" 403 239 "-" "Mozilla/5.0 (compatible; SecurityAudit/1.0)" ... show less	Brute-Force Web App Attack Hacking
🇫🇷 Jager	2026-07-21 05:55:49 (19 hours ago)	Blocked by CrowdSec on homelab for scenario: crowdsecurity/http-sensitive-files	Brute-Force Port Scan Web App Attack
🇳🇱 tpjg	2026-07-21 05:45:36 (19 hours ago)	Automated: 15 requests with error status in 120s window from 31.56.209.52. Evidence: /.env.example:3 ... show more Automated: 15 requests with error status in 120s window from 31.56.209.52. Evidence: /.env.example:301,/backend/.env:301,/vendor/.env:301,/aws/.env:301,/config/.env:301,/api/.env:301,/app/.env:301,/.env.development:301,/.env.dev:301,/.env.backup:301,/.env.staging:301,/.env.local:301,/.env.prod:301,/.env.production:301,/.env:301 (+8 more) show less	Web App Attack
🇫🇷 dwmp	2026-07-21 05:37:31 (19 hours ago)	[21/Jul/2026:07:37:30.211162 +0200] al8FmuYHmzG33OnExLhCMgAAANU 31.56.209.52 57770 38.242.227.117 70 ... show more [21/Jul/2026:07:37:30.211162 +0200] al8FmuYHmzG33OnExLhCMgAAANU 31.56.209.52 57770 38.242.227.117 7080 [21/Jul/2026:07:37:30.212808 +0200] al8FmuYHmzG33OnExLhCMwAAAM4 31.56.209.52 57772 38.242.227.117 7080 [21/Jul/2026:07:37:30.215303 +0200] al8Fmkn4V8yhD2WnSg8aQgAAAAQ 31.56.209.52 57768 38.242.227.117 7080 ... show less	Brute-Force SSH
🇩🇪 s@ch@	2026-07-21 05:30:01 (20 hours ago)	Jail: plesk-modsecurity \| Web application attack (Plesk ModSecurity)	Web App Attack
Anonymous	2026-07-21 05:23:36 (20 hours ago)	[Tue Jul 21 07:23:35.221831 2026] [access_compat:error] [pid 507436:tid 126416565814976] [client 31. ... show more [Tue Jul 21 07:23:35.221831 2026] [access_compat:error] [pid 507436:tid 126416565814976] [client 31.56.209.52:50780] AH01797: client denied by server configuration: /var/www/html/.env.prod [Tue Jul 21 07:23:35.221868 2026] [access_compat:error] [pid 519245:tid 126415903119040] [client 31.56.209.52:50782] AH01797: client denied by server configuration: /var/www/html/.env [Tue Jul 21 07:23:35.230082 2026] [access_compat:error] [pid 507436:tid 126416582600384] [client 31.56.209.52:50792] AH01797: client denied by server configuration: /var/www/html/.env.production [Tue Jul 21 07:23:35.248752 2026] [access_compat:error] [pid 519245:tid 126416590993088] [client 31.56.209.52:50782] AH01797: client denied by server configuration: /var/www/html/vendor [Tue Jul 21 07:23:35.249067 2026] [access_compat:error] [pid 507436:tid 126417096398528] [client 31.56.209.52:50780] AH01797: client denied by server configuration: /var/www/html/aws [Tue Jul 21 07:23:35.264063 2026] [access_compat:error] [pid 50 ... show less	Brute-Force Web App Attack
🇩🇪 XICTRON	2026-07-21 05:05:10 (20 hours ago)	ModSecurity rule violation detected by Fail2Ban	Web App Attack
🇳🇱 kie	2026-07-21 04:51:19 (20 hours ago)	21-07-2026:04:50:42UTC [Nginx Web Server] Suspicious web request: path:/.env path:/.env,/vendor/ pat ... show more 21-07-2026:04:50:42UTC [Nginx Web Server] Suspicious web request: path:/.env path:/.env,/vendor/ path:/wp-config path:/.aws/ (17 request(s)). show less	Bad Web Bot Web App Attack
Anonymous	2026-07-21 04:48:57 (20 hours ago)	Caught with rate limiting - Excessive Requests or DDOS Attack	DDoS Attack Bad Web Bot
🇩🇪 LRob	2026-07-21 04:22:43 (21 hours ago)	CrowdSec: crowdsecurity/http-sensitive-files \| UA: Mozilla/5.0 (compatible; SecurityAudit/1.0)	Hacking
🇬🇧 markawes	2026-07-21 03:43:44 (21 hours ago)	[markis] Auto banned by Fail2Ban. Reason: Malicious web scan / attempted access to sensitive paths. ... show more [markis] Auto banned by Fail2Ban. Reason: Malicious web scan / attempted access to sensitive paths. Evidence: 31.56.209.52 - - [21/Jul/2026:04:43:42 +0100] "GET /.env HTTP/1.1" 404 436 "-" "Mozilla/5.0 (compatible; SecurityAudit/1.0)" 31.56.209.52 - - [21/Jul/2026:04:43:42 +0100] "GET /.env.prod HTTP/1.1" 404 436 "-" "Mozilla/5.0 (compatible; SecurityAudit/1.0)" 31.56.209.52 - - [21/Jul/2026:04:43:43 +0100] "GET /.env.production HTTP/1.1" 404 436 "-" "Mozilla/5.0 (compatible; SecurityAudit/1.0)" show less	Port Scan Hacking Web App Attack
🇫🇮 kumiko	2026-07-21 02:49:42 (22 hours ago)	[2026-07-21 05:49:42] Probing for dotfiles "GET /.env.production HTTP/1.1" 403	Bad Web Bot Web App Attack
🇩🇪 dbmwebdesign	2026-07-21 02:20:41 (23 hours ago)	WAF repeated trigger detected by Fail2Ban in plesk-modsecurity jail	Web App Attack
🇺🇸 RogueAutomata	2026-07-21 00:26:14 (1 day ago)	Detected malicious request: GET /.env.prod Detections triggered: Environment/config probe Access vi ... show more Detected malicious request: GET /.env.prod Detections triggered: Environment/config probe Access via IP addr (v4) show less	Web App Attack

Showing 1 to 15 of 128 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇵🇰 182.180.154.234

🇩🇪 167.94.146.38

🇬🇧 157.245.34.56

🇧🇷 45.7.110.219

🇧🇷 45.7.1.20

🇺🇸 216.25.89.120

🇺🇸 204.217.128.157

🇸🇪 192.71.50.224

🇧🇪 178.119.96.31

🇺🇸 174.54.15.149

🇨🇳 171.104.83.150

🇩🇪 167.94.146.54

🇨🇦 159.203.21.24

🇮🇹 151.40.104.101

🇹🇼 130.211.243.197

🇹🇭 125.25.123.194

🇨🇳 120.48.0.142

🇹🇳 102.31.146.18

🇹🇷 94.154.43.10

🇧🇬 79.124.49.102