JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 5.231.108.53

5.231.108.53 was found in our database!

This IP was reported 61 times. Confidence of Abuse is 100%: ?

100%

ISP	GHOSTnet
Usage Type	Data Center/Web Hosting/Transit
ASN	AS213250
Domain Name	ghostnet.de
Country	🇩🇪 Germany
City	Frankfurt am Main, Hesse

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 5.231.108.53

Whois 5.231.108.53

IP Abuse Reports for 5.231.108.53:

This IP address has been reported a total of 61 times from 45 distinct sources. 5.231.108.53 was first reported on July 28th 2026, and the most recent report was 53 minutes ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇷🇺 Reaper	2026-07-29 21:38:46 (53 minutes ago)	Repeated 404 errors from 5.231.108.53	Web App Attack
🇫🇷 masterguru	2026-07-29 21:16:54 (1 hour ago)	Restricted File Access Attempt. Matched phrase ".git/" at REQUEST_FILENAME. (930130-201)	Hacking Web App Attack
🇪🇸 alferez	2026-07-29 21:09:30 (1 hour ago)	Searching .(env\|sql\|zip\|tar\|rar) files	Hacking Exploited Host Web App Attack
Anonymous	2026-07-29 21:06:42 (1 hour ago)	Blocked by FortiWeb WAF ML threat detection. ML probability: 99%, Country: DE, Attack patterns: Clou ... show more Blocked by FortiWeb WAF ML threat detection. ML probability: 99%, Country: DE, Attack patterns: Cloud secrets probing show less	Bad Web Bot Web App Attack
Anonymous	2026-07-29 20:29:15 (2 hours ago)	5.231.108.53 - - [29/Jul/2026:20:29:14 +0000] "GET /.env HTTP/1.1" 404 11648 "-" "Mozilla/5.0 (Macin ... show more 5.231.108.53 - - [29/Jul/2026:20:29:14 +0000] "GET /.env HTTP/1.1" 404 11648 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 15.7; rv:149.0) Gecko/20100101 Firefox/149.0" ... show less	Brute-Force Web App Attack
🇮🇹 mgarofano80	2026-07-29 19:42:17 (2 hours ago)		Brute-Force Web App Attack
🇫🇮 as211431.net	2026-07-29 19:17:05 (3 hours ago)	Triggered Cloudflare WAF (firewallCustom) from DE. Action taken: BLOCK Protocol: HTTP/1.1 (GET metho ... show more Triggered Cloudflare WAF (firewallCustom) from DE. Action taken: BLOCK Protocol: HTTP/1.1 (GET method) Endpoint: /backend/.env UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36 Edg/146.0.3856.109 This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
🇩🇪 pltcldvlpr	2026-07-29 19:13:49 (3 hours ago)	CMS/framework probe: 5.231.108.53 - - [29/Jul/2026:21:13:49 +0200] "GET /backend/.env HTTP/1.1" 404 ... show more CMS/framework probe: 5.231.108.53 - - [29/Jul/2026:21:13:49 +0200] "GET /backend/.env HTTP/1.1" 404 162 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:149.0) Gecko/20100101 Firefox/149.0" asn=213250 org="Dominic Scholz trading as ITP-Solutions GmbH & Co. KG" country=DE ... show less	Web App Attack
🇫🇷 Feelautom	2026-07-29 19:09:11 (3 hours ago)	[FeelAutom Auto-Ban] AI Analyst: Score 182/200, PathScan sur .env et .git	Port Scan
🇩🇪 DocNetzwerk	2026-07-29 19:02:57 (3 hours ago)	(mod_security) mod_security triggered on hostname [redacted] 5.231.108.53 (DE/Germany/-)	SQL Injection
🇺🇸 TPI-Abuse	2026-07-29 11:59:48 (10 hours ago)	(mod_security) mod_security (id:210492) triggered by 5.231.108.53 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 5.231.108.53 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 29 07:59:43.655004 2026] [security2:error] [pid 3730008:tid 3730008] [client 5.231.108.53:59424] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "saltcityprint.com"] [uri "/.git/HEAD"] [unique_id "amnrLzI1ZphqRxFWi1NmeQAAAA0"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 hidemail.app	2026-07-29 11:54:04 (10 hours ago)	Automated scan for exposed config/secret files and known web exploits (e.g. /.env, RCE probes); auto ... show more Automated scan for exposed config/secret files and known web exploits (e.g. /.env, RCE probes); auto-banned by fail2ban. show less	Web App Attack Hacking
🇨🇿 sajmon0011	2026-07-29 11:39:44 (10 hours ago)	5.231.108.53 - - [29/Jul/2026:13:39:43 +0200] "GET /.env HTTP/1.1" 404 196 "-" "Mozilla/5.0 (Macinto ... show more 5.231.108.53 - - [29/Jul/2026:13:39:43 +0200] "GET /.env HTTP/1.1" 404 196 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 15.7; rv:149.0) Gecko/20100101 Firefox/149.0" ... show less	Web App Attack
🇧🇪 cmbplf	2026-07-29 10:30:24 (12 hours ago)	341 requests with url.path .git/ 217 requests with url.path .aws/ 187 requests with url.path ... show more 341 requests with url.path .git/ 217 requests with url.path .aws/ 187 requests with url.path config.json 181 requests with url.path /.git/config show less	Brute-Force Bad Web Bot
🇫🇷 pm33	2026-07-29 09:58:21 (12 hours ago)	Probing for resource vulnerabilities HTTP(S)	Web App Attack

Showing 1 to 15 of 61 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇭 209.99.188.93

🇧🇷 186.251.50.76

🇮🇳 182.76.43.24

🇻🇳 103.154.62.14

🇩🇪 216.26.245.113

🇰🇷 211.194.143.110

🇨🇦 209.50.188.131

🇨🇦 209.50.187.0

🇺🇸 209.50.169.162

🇸🇬 193.37.32.224

🇧🇴 190.181.4.12

🇺🇸 159.203.83.195

🇩🇪 104.207.55.98

🇩🇪 104.207.54.12

🇷🇴 92.118.39.77

🇩🇪 64.89.163.133

🇩🇪 4.184.185.91

🇺🇸 216.25.89.130

🇸🇬 193.37.32.212

🇳🇿 158.173.167.14