JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 57.156.65.48

57.156.65.48 was found in our database!

This IP was reported 19 times. Confidence of Abuse is 97%: ?

97%

ISP	Microsoft Limited
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇨🇱 Chile
City	Santiago, Santiago Metropolitan

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 57.156.65.48

Whois 57.156.65.48

IP Abuse Reports for 57.156.65.48:

This IP address has been reported a total of 19 times from 18 distinct sources. 57.156.65.48 was first reported on August 30th 2026, and the most recent report was 1 day ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 EvilTurkey	2026-08-31 14:19:02 (1 day ago)	Web app attack against financial institution website.	Web App Attack Hacking
🇫🇷 Octopuce	2026-08-31 06:24:12 (1 day ago)	Aggressive web search of vulnerable pages: /.env.local /wp-config.php /config.php /config/database.p ... show more Aggressive web search of vulnerable pages: /.env.local /wp-config.php /config.php /config/database.php /info.php /phpinfo.php /docker-compose.y ... show less	Web App Attack
🇩🇪 LRob	2026-08-31 05:38:17 (2 days ago)	Probing for secret files (.git, .env, credentials, database dumps, wp-config) \| method: GET \| path: ... show more Probing for secret files (.git, .env, credentials, database dumps, wp-config) \| method: GET \| path: /.env \| 2026-08-31 05:38 UTC show less	Hacking Web App Attack
🇩🇪 todix	2026-08-31 05:12:58 (2 days ago)	Web App Attack Exploid from 57.156.65.48	Web App Attack
🇺🇸 TPI-Abuse	2026-08-31 03:17:00 (2 days ago)	(mod_security) mod_security (id:210492) triggered by 57.156.65.48 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 57.156.65.48 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Aug 30 23:16:52.875245 2026] [security2:error] [pid 25999:tid 25999] [client 57.156.65.48:61692] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "wildlifetaxidermy.com"] [uri "/.env"] [unique_id "apTyJOgs-c6VS52KpGpJ7AAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-08-31 03:09:27 (2 days ago)	57.156.65.48 - - [31/Aug/2026:00:09:25 -0300] "GET /.env HTTP/1.1" 403 1810 "-" "Mozilla/5.0 (Window ... show more 57.156.65.48 - - [31/Aug/2026:00:09:25 -0300] "GET /.env HTTP/1.1" 403 1810 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/121.0" 57.156.65.48 - - [31/Aug/2026:00:09:26 -0300] "GET /.env.local HTTP/1.1" 403 1810 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" ... show less	Port Scan
🇫🇷 Tilellit.PRO	2026-08-31 00:28:40 (2 days ago)	Malicious web traffic detected by CrowdSec	Hacking
🇿🇦 simon boshoff	2026-08-31 00:28:24 (2 days ago)	RdpGuard detected brute-force attempt on HTTP	Brute-Force
🇪🇸 librebit	2026-08-31 00:28:16 (2 days ago)	Bad guys doing bad things, bad crawling	Bad Web Bot
🇺🇸 mnsf	2026-08-31 00:06:23 (2 days ago)	Scanning/Probing (11)	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-08-30 21:30:47 (2 days ago)	(mod_security) mod_security (id:210492) triggered by 57.156.65.48 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 57.156.65.48 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Aug 30 17:30:39.896120 2026] [security2:error] [pid 9375:tid 9375] [client 57.156.65.48:52254] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "individualhealth.com"] [uri "/.env"] [unique_id "apSg_-2-kF8AHaMkJhGB-wAAABE"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 MyGlobalFlowers	2026-08-30 20:58:20 (2 days ago)	Multiple WAF Violations	Web App Attack
🇺🇦 URAN Publishing Service	2026-08-30 19:04:38 (2 days ago)	[30/Aug/2026:22:04:38 +0300] -- 57.156.65.48 Ban reason: Scanner [SENSITIVE_FILES] \| Request: GET /. ... show more [30/Aug/2026:22:04:38 +0300] -- 57.156.65.48 Ban reason: Scanner [SENSITIVE_FILES] \| Request: GET /.env HTTP/1.1 show less	Bad Web Bot Web App Attack
🇳🇱 Savvii	2026-08-30 18:49:01 (2 days ago)	20 attempts against mh_ha-misbehave-ban on ceres	Brute-Force Bad Web Bot Web App Attack
🇸🇬 securejdprop	2026-08-30 18:48:32 (2 days ago)	This IP was detected by CrowdSec triggering crowdsecurity/suricata-major-severity(ET INFO Request to ... show more This IP was detected by CrowdSec triggering crowdsecurity/suricata-major-severity(ET INFO Request to Hidden Environment File - Inbound). show less	Hacking Web App Attack

Showing 1 to 15 of 19 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇻🇳 113.177.27.200

🇺🇸 104.232.79.58

🇸🇬 47.82.51.107

🇬🇧 35.203.210.198

🇹🇷 195.33.199.59

🇺🇸 159.223.122.37

🇺🇸 136.114.53.229

🇲🇾 47.254.247.11

🇮🇩 34.101.158.53

🇹🇼 219.85.63.45

🇬🇧 195.140.214.20

🇧🇬 193.24.211.204

🇩🇪 167.94.146.35

🇺🇸 147.185.132.153

🇭🇰 139.198.113.29

🇹🇭 125.27.61.164

🇷🇺 91.215.85.104

🇫🇷 91.196.152.191

🇳🇱 89.21.67.175

🇷🇴 80.94.92.55