This IP address has been reported a total of
212
times from
186 distinct
sources.
4.213.48.53 was first reported on
, and the most recent report was
.
Recent Reports:
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Web app attack: scanning for secrets/exploits (.env/.git/PHPUnit CVE). Captured by NullBlue67 honeyp ...
show moreWeb app attack: scanning for secrets/exploits (.env/.git/PHPUnit CVE). Captured by NullBlue67 honeypot.
show less
This IP was detected by CrowdSec triggering crowdsecurity/experimental-no-user-agent. WAF out-of-ban ...
show moreThis IP was detected by CrowdSec triggering crowdsecurity/experimental-no-user-agent. WAF out-of-band match: crowdsecurity/experimental-no-user-agent from 4.213.48.53 (172.18.0.2)
show less
Automated ban via infra-monitor: webshell-high-confidence, wp-obscure-nested-php, wordpress-probe, + ...
show moreAutomated ban via infra-monitor: webshell-high-confidence, wp-obscure-nested-php, wordpress-probe, +4 more
show less
[Tue Jul 07 20:50:29.855265 2026] [php:error] [pid 1955686] [client 4.213.48.53:26026] script '/var/ ...
show more[Tue Jul 07 20:50:29.855265 2026] [php:error] [pid 1955686] [client 4.213.48.53:26026] script '/var/www/html/avignon/this_is_a_new_hello_world.php' not found or unable to stat
[Tue Jul 07 20:50:30.285479 2026] [php:error] [pid 1955686] [client 4.213.48.53:26026] script '/var/www/html/avignon/ucpfr.php' not found or unable to stat
[Tue Jul 07 20:50:30.580434 2026] [php:error] [pid 1955686] [client 4.213.48.53:26026] script '/var/www/html/avignon/class-walker-footer-dev.php' not found or unable to stat
[Tue Jul 07 20:50:30.872984 2026] [php:error] [pid 1955686] [client 4.213.48.53:26026] script '/var/www/html/avignon/gtd7.php' not found or unable to stat
[Tue Jul 07 20:50:31.110541 2026] [php:error] [pid 1955686] [client 4.213.48.53:26026] script '/var/www/html/avignon/wp-ws68.php' not found or unable to stat
...
show less
{"ClientAddr":"172.69.178.7:13227","ClientHost":"4.213.48.53","ClientPort":"13227","ClientUsername": ...
show more{"ClientAddr":"172.69.178.7:13227","ClientHost":"4.213.48.53","ClientPort":"13227","ClientUsername":"-","DownstreamContentSize":24,"DownstreamStatus":404,"Duration":949760,"OriginContentSize":24,"OriginDuration":829805,"OriginStatus":404,"Overhead":119955,"RequestAddr":"sftp.timvdberg.dev","RequestContentSize":0,"RequestCount":205533,"RequestHost":"sftp.timvdberg.dev","RequestMethod":"GET","RequestPath":"/.well-known/checkbox.php","RequestPort":"-","RequestProtocol":"HTTP/2.0","RequestScheme":"https","RetryAttempts":0,"RouterName":"sftpgo@docker","ServiceAddr":"172.16.16.4:8080","ServiceName":"sftpgo@docker","ServiceURL":"http://172.16.16.4:8080","StartLocal":"2026-07-07T18:48:55.044921384Z","StartUTC":"2026-07-07T18:48:55.044921384Z","TLSCipher":"TLS_AES_128_GCM_SHA256","TLSVersion":"1.3","entryPointName":"https","level":"info","msg":"","request_Cf-Connecting-Ip":"4.213.48.53","request_X-Forwarded-For":"4.213.48.53","request_X-Real-Ip":"172.69.178.7","time":"2026-07-07T18:48:55Z"}
{"C
...
show less
Port Scan
Hacking
Bad Web Bot
Web App Attack
Showing 1 to
15
of 212 reports
Think this IP has been falsely reported? You may request to have the associated
reports reviewed and removed.
Request Takedown 🚩