JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 5.255.122.197

5.255.122.197 was found in our database!

This IP was reported 1,007 times. Confidence of Abuse is 100%: ?

100%

ISP	The Infrastructure Group B.V.
Usage Type	Data Center/Web Hosting/Transit
ASN	AS60404
Domain Name	theinfrastructure.group
Country	🇳🇱 Netherlands
City	Lelystad, Flevoland

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 5.255.122.197

Whois 5.255.122.197

IP Abuse Reports for 5.255.122.197:

This IP address has been reported a total of 1,007 times from 384 distinct sources. 5.255.122.197 was first reported on January 27th 2025, and the most recent report was 8 minutes ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 NewGastroline	2026-05-09 11:56:00 (3 weeks ago)	Malicious request blocked by CrowdSec on gastro-prod1.boreus.de	Bad Web Bot Web App Attack
🇧🇷 SOC PR	2026-05-09 10:55:55 (3 weeks ago)	IPS: Sensitive Configuration File Disclosure.	Hacking
🇫🇷 ELYAZ	2026-05-09 10:35:47 (3 weeks ago)	(y3) Failed access -byebye- from 5.255.122.197 (NL/Netherlands/-): (CF_ENABLE)	Hacking
🇦🇺 2000cn.com.au	2026-05-09 10:05:39 (3 weeks ago)	This IP was detected by CrowdSec triggering crowdsecurity/http-sensitive-files	Web App Attack Hacking
Anonymous	2026-05-09 10:04:22 (3 weeks ago)	Blocked by FortiWeb WAF ML threat detection. ML probability: 99%, Country: NL, Attack patterns: Back ... show more Blocked by FortiWeb WAF ML threat detection. ML probability: 99%, Country: NL, Attack patterns: Backup file probing, Cloud secrets probing show less	Bad Web Bot Web App Attack
Anonymous	2026-05-09 09:54:55 (3 weeks ago)	5.255.122.197 - - [09/May/2026:11:54:53 +0200] "GET /wp-config.php.bak HTTP/1.0" 404 116263 "-" "Moz ... show more 5.255.122.197 - - [09/May/2026:11:54:53 +0200] "GET /wp-config.php.bak HTTP/1.0" 404 116263 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" 5.255.122.197 - - [09/May/2026:11:54:54 +0200] "GET /wp-config.php.bak HTTP/1.1" 404 20104 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" 5.255.122.197 - - [09/May/2026:11:54:53 +0200] "GET /wp-config.php.old HTTP/1.0" 404 116263 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" 5.255.122.197 - - [09/May/2026:11:54:55 +0200] "GET /wp-config.php.old HTTP/1.1" 404 20103 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" 5.255.122.197 - - [09/May/2026:11:54:53 +0200] "GET /wp-config.php.save HTTP/1.0" 404 116271 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi ... show less	Brute-Force Web App Attack
Anonymous	2026-05-09 09:12:24 (3 weeks ago)	(caddyscan) Scanner path probe from 5.255.122.197 (NL/The Netherlands/-): 5 in the last 3600 secs; P ... show more (caddyscan) Scanner path probe from 5.255.122.197 (NL/The Netherlands/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 5.255.122.197 - - [09/May/2026:09:12:19 +0000] "GET /.env HTTP/1.1" [REDACTED] 200 2627 5.255.122.197 - - [09/May/2026:09:12:19 +0000] "GET /.env.local HTTP/1.1" [REDACTED] 200 2627 5.255.122.197 - - [09/May/2026:09:12:19 +0000] "GET /.env.production HTTP/1.1" [REDACTED] 200 2627 5.255.122.197 - - [09/May/2026:09:12:19 +0000] "GET /app/.env HTTP/1.1" [REDACTED] 200 2627 5.255.122.197 - - [09/May/2026:09:12:19 +0000] "GET /backend/.env HTTP/1.1" show less	Port Scan
Anonymous	2026-05-09 07:15:25 (3 weeks ago)	PSCSERV WPSCAN 5.255.122.197	Bad Web Bot Web App Attack
🇫🇷 Savoie	2026-05-09 07:15:00 (3 weeks ago)	5.255.122.197 *.* - [09/May/2026:09:15:33 +0200] "GET /secrets.json HTTP/1.1" 302 211 "-" "Mozil ... show more 5.255.122.197 *.* - [09/May/2026:09:15:33 +0200] "GET /secrets.json HTTP/1.1" 302 211 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:150.0) Gecko/20100101 Firefox/150.0" AND : GET /.env.local HTTP/1.1 GET /.env.production HTTP/1.1 GET /serviceAccountKey.json HTTP/1.1 GET /credentials.json HTTP/1.1 show less	Bad Web Bot Web App Attack
🇺🇸 WizardsToolkit	2026-05-09 06:45:44 (3 weeks ago)	attempted to access /app/.env	Web App Attack
Anonymous	2026-05-09 06:40:49 (3 weeks ago)	(caddyscan) Scanner path probe from 5.255.122.197 (NL/The Netherlands/-): 5 in the last 3600 secs; P ... show more (caddyscan) Scanner path probe from 5.255.122.197 (NL/The Netherlands/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 5.255.122.197 - - [09/May/2026:06:40:45 +0000] "GET /api/.env HTTP/1.1" [REDACTED] 200 2627 5.255.122.197 - - [09/May/2026:06:40:45 +0000] "GET /.env.production HTTP/1.1" [REDACTED] 200 2627 5.255.122.197 - - [09/May/2026:06:40:45 +0000] "GET /app/.env HTTP/1.1" [REDACTED] 200 2627 5.255.122.197 - - [09/May/2026:06:40:45 +0000] "GET /.aws/credentials HTTP/1.1" [REDACTED] 200 2627 5.255.122.197 - - [09/May/2026:06:40:45 +0000] "GET /.env.local HTTP/1.1" show less	Port Scan
🇺🇸 TPI-Abuse	2026-05-09 06:22:47 (3 weeks ago)	(mod_security) mod_security (id:210492) triggered by 5.255.122.197 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 5.255.122.197 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 09 02:22:41.651441 2026] [security2:error] [pid 29822:tid 29822] [client 5.255.122.197:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "gibitdigital.com"] [uri "/.env"] [unique_id "af7SsVD0w2j6IudAWzQCswAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 alecj.com	2026-05-09 05:08:04 (3 weeks ago)	This IP was detected by CrowdSec triggering crowdsecurity/http-sensitive-files	Web App Attack Hacking
🇧🇪 taivas.nl	2026-05-09 04:32:20 (3 weeks ago)	Many_bad_calls	Web App Attack
🇺🇸 octageeks.com	2026-05-09 04:06:59 (3 weeks ago)	Wordpress malicious attack:[octablocked]	Web App Attack

Showing 856 to 870 of 1007 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇳 211.149.131.113

🇬🇧 209.42.20.53

🇳🇱 195.178.110.30

🇵🇭 180.195.75.130

🇺🇸 162.216.149.55

🇫🇷 92.204.188.207

🇺🇸 66.132.195.28

🇮🇳 45.120.126.66

🇻🇳 45.119.212.99

🇮🇪 31.13.127.63

🇳🇱 212.30.37.66

🇳🇱 195.178.110.204

🇸🇪 193.189.100.130

🇭🇰 193.176.211.225

🇺🇸 184.168.21.211

🇩🇪 181.41.194.250

🇦🇷 181.24.25.92

🇺🇸 172.185.40.47

🇻🇳 171.244.39.95

🇻🇳 171.244.37.103