JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 59.36.134.230

59.36.134.230 was found in our database!

This IP was reported 26 times. Confidence of Abuse is 77%: ?

77%

ISP	CHINANET Guangdong province network
Usage Type	Fixed Line ISP
ASN	AS4134
Domain Name	chinatelecom.cn
Country	🇨🇳 China
City	Shenzhen, Guangdong

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 59.36.134.230

Whois 59.36.134.230

IP Abuse Reports for 59.36.134.230:

This IP address has been reported a total of 26 times from 18 distinct sources. 59.36.134.230 was first reported on June 25th 2026, and the most recent report was 1 week ago.

Old Reports: The most recent abuse report for this IP address is from 1 week ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 WellSpring	2026-07-02 00:34:34 (1 week ago)	env leak on 252.today/backend/.env — WellSpr.ing/NetSentinel civic-AI security layer	Web App Attack
Anonymous	2026-07-02 00:25:04 (1 week ago)	Bot / scanning and/or hacking attempts: GET /.env.example HTTP/1.1, GET /.env.sample HTTP/1.1, GET / ... show more Bot / scanning and/or hacking attempts: GET /.env.example HTTP/1.1, GET /.env.sample HTTP/1.1, GET /.env.production HTTP/1.1, GET /.env.save HTTP/1.1 show less	Hacking Web App Attack
Anonymous	2026-07-01 22:00:42 (1 week ago)	(caddyscan) Scanner path probe from 59.36.134.230 (CN/China/-): 5 in the last 3600 secs; Ports: ; D ... show more (caddyscan) Scanner path probe from 59.36.134.230 (CN/China/-): 5 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 59.36.134.230 - - [01/Jul/2026:22:00:36 +0000] "GET /wp-config.php.bak HTTP/1.1" [REDACTED] 200 2627 59.36.134.230 - - [01/Jul/2026:22:00:36 +0000] "GET /wp-config.php.old HTTP/1.1" [REDACTED] 200 2627 59.36.134.230 - - [01/Jul/2026:22:00:37 +0000] "GET /wp-config.php.save HTTP/1.1" [REDACTED] 200 2627 59.36.134.230 - - [01/Jul/2026:22:00:37 +0000] "GET /wp-config.php.txt HTTP/1.1" [REDACTED] 200 2627 59.36.134.230 - - [01/Jul/2026:22:00:37 +0000] "GET /wp-config.php~ HTTP/1.1" show less	Port Scan
🇺🇸 xxkodedxx	2026-07-01 17:25:15 (1 week ago)	[Zorvexus edge-defense] GET .env / WordPress honeypot probe Trigger: 1× honeypot-get in 10m window. ... show more [Zorvexus edge-defense] GET .env / WordPress honeypot probe Trigger: 1× honeypot-get in 10m window. Origin: CN / AS4134 Chinanet Active: 17:24:47→17:25:05 UTC Volume: 1 HTTP req, 19 honeypot probe(s) Bait taken: /.env.template, /.env.dist, /.env.sample, /.env.example, /.env~ Status mix: 200×1 UA: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 (Silvy X Ran)" Auto-banned 30d. zorvexus-banner. show less	Bad Web Bot Web App Attack
🇺🇸 Charlesiv	2026-07-01 14:06:00 (1 week ago)	Triggered Cloudflare WAF (firewallCustom) from CN. Action taken: BLOCK ASN: 4134 (CHINANET BACKBONE) ... show more Triggered Cloudflare WAF (firewallCustom) from CN. Action taken: BLOCK ASN: 4134 (CHINANET BACKBONE) Protocol: HTTP/1.1 (GET method) Endpoint: /.env Timestamp: 2026-07-01T13:48:17Z Ray ID: a145de1378731ef7 UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 (Silvy X Ran) show less	Bad Web Bot
🇺🇸 TPI-Abuse	2026-07-01 13:19:39 (1 week ago)	(mod_security) mod_security (id:210492) triggered by 59.36.134.230 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 59.36.134.230 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 01 09:19:35.223823 2026] [security2:error] [pid 6930:tid 6955] [client 59.36.134.230:53970] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "newyorkfreepress.com"] [uri "/.env.local"] [unique_id "akUT51le6O9InpwUjN3_JQAAANU"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 pm33	2026-07-01 11:44:52 (1 week ago)	Excessive crawling HTTP 404	Web App Attack
🇨🇭 4server	2026-07-01 11:17:57 (1 week ago)	[WedJul0113:17:51.5663532026][security2:error][pid3869848:tid3869871][client59.36.134.230:0]ModSecur ... show more [WedJul0113:17:51.5663532026][security2:error][pid3869848:tid3869871][client59.36.134.230:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Matchedphrase\".env\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"365\"][id\"960720\"][msg\"Forbiddenfileaccess\"][hostname\"www.retepastoralebelli.ch.81-17-25-250.cpanel.site\"][uri\"/.env.dev\"][unique_id\"akT3X1Ru3hrHvqokchZV0gAAANU\"] show less	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-07-01 09:34:19 (1 week ago)	(mod_security) mod_security (id:210492) triggered by 59.36.134.230 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 59.36.134.230 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 01 05:34:14.313694 2026] [security2:error] [pid 31367:tid 31367] [client 59.36.134.230:40602] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cyber-matrix.org"] [uri "/.env"] [unique_id "akTfFmrD40XtfHqya4wQmwAAAA8"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-07-01 08:28:41 (1 week ago)	(caddyscan) Scanner path probe from 59.36.134.230 (CN/China/-): 5 in the last 3600 secs; Ports: ; D ... show more (caddyscan) Scanner path probe from 59.36.134.230 (CN/China/-): 5 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 59.36.134.230 - - [01/Jul/2026:08:28:36 +0000] "GET /.env HTTP/1.1" [REDACTED] 200 2627 59.36.134.230 - - [01/Jul/2026:08:28:37 +0000] "GET /.env.local HTTP/1.1" [REDACTED] 200 2627 59.36.134.230 - - [01/Jul/2026:08:28:37 +0000] "GET /.env.production HTTP/1.1" [REDACTED] 200 2627 59.36.134.230 - - [01/Jul/2026:08:28:38 +0000] "GET /.env.development HTTP/1.1" [REDACTED] 200 2627 59.36.134.230 - - [01/Jul/2026:08:28:38 +0000] "GET /.env.dev HTTP/1.1" show less	Port Scan
🇺🇸 TPI-Abuse	2026-07-01 03:24:16 (1 week ago)	(mod_security) mod_security (id:210492) triggered by 59.36.134.230 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 59.36.134.230 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 30 23:24:09.949995 2026] [security2:error] [pid 12498:tid 12498] [client 59.36.134.230:44554] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "dbfitwell.com"] [uri "/api/.env"] [unique_id "akSIWZWpUIw2iirSGRHZkQAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 big-cloud.nl	2026-07-01 00:17:29 (1 week ago)	Try to access /.env	Web App Attack
🇷🇺 DZBOT	2026-06-30 20:39:25 (1 week ago)	DZBOT: Website Scanning / Scraping	Bad Web Bot Exploited Host Web App Attack
🇳🇱 Site.eu	2026-06-30 17:44:52 (1 week ago)	Excessive 404/403 errors	Brute-Force
Anonymous	2026-06-30 17:24:51 (1 week ago)	Blocked by ModSec and CSF	Port Scan

Showing 1 to 15 of 26 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇧🇩 2400:cb00:362:1000:f4fc:e9fb:2c44:78e7

🇺🇸 143.244.168.161

🇳🇱 91.148.244.131

🇮🇳 20.204.42.226

🇳🇱 195.178.110.227

🇺🇸 128.203.204.165

🇮🇳 103.176.139.37

🇩🇪 69.5.169.215

🇺🇸 47.85.8.171

🇮🇱 5.29.18.3

🇫🇷 4.211.84.189

🇮🇷 2.189.128.6

🇳🇱 195.178.110.232

🇸🇬 194.61.40.128

🇳🇱 185.224.128.16

🇰🇷 182.213.11.161

🇵🇱 176.53.159.197

🇱🇹 141.98.11.171

🇧🇷 131.0.123.151

🇹🇭 125.25.232.216