Recent reportsWe have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Web app exploit probe on a honeypot: requested known vulnerability paths (wp-login.php, .env, .git ...).
Requests within an hour: 34 on 1 host(s)
User agent: - | Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/ ...
show moreWeb app exploit probe on a honeypot: requested known vulnerability paths (wp-login.php, .env, .git ...).
Requests within an hour: 34 on 1 host(s)
User agent: - | Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Sa
Requested, e.g.:
- docker.[REDACTED]/_debugbar/open
- docker.[REDACTED]/api/graphql
- docker.[REDACTED]/auth.json
- docker.[REDACTED]/configuration.php.bak
- docker.[REDACTED]/document.php?modulepart=systemtools&file=../conf/conf.php&h
- docker.[REDACTED]/graphql
- ... and 6 more
show less
2026-11-05: auto (probe_watch autoblock): api_enumeration,probe_path_traversal,probe_secret_config, 209 requests on api2.billease.ph. Observed against Billease APIs; source blocked. Datacenter IP (Google LLC), no legitimate customer traffic. Automate ...
show more2026-11-05: auto (probe_watch autoblock): api_enumeration,probe_path_traversal,probe_secret_config, 209 requests on api2.billease.ph. Observed against Billease APIs; source blocked. Datacenter IP (Google LLC), no legitimate customer traffic. Automated report.
show less
Web App Attack
Hacking
Think this IP has been falsely reported? You may request to have the associated
reports reviewed and removed.
Request Takedown