JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

64.181.199.73

Activity Trending Down

Abuse Confidence Score

74% Elevated

24 reports

24 reporters · latest 2 weeks ago

ISP: Oracle Corporation
Usage Type: Data Center/Web Hosting/Transit
ASN: AS31898
Domain Name: oracle.com
Country: 🇺🇸 United States of America
City: Chicago, Illinois

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Example preview

Account required for the enhanced features Log in Sign up

Abuse Reports

Export reports CSV

Total reports

24 from 24 distinct reporters

First reported

October 19th 2026

Most recent report

2 weeks ago

Last 60 days

Top reporter locations 🇩🇪 Germany 6 🇳🇱 Netherlands 4 🇧🇷 Brazil 2

Most common categories Web App Attack 12 Port Scan 8 Hacking 6 Bad Web Bot 4 Brute-Force 3

Old reports The most recent abuse report for this IP address is from 2 weeks ago. It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇮🇱 spd.co.il	2026-10-22 22:02:36 UTC · (2 weeks ago)	Web application attack detected	Hacking Web App Attack
🇮🇹 ciccio diddo	2026-10-21 18:08:03 UTC · (2 weeks ago)	CMS/WP Exploit multiple 40X port:Tcp/80,443	Brute-Force Web App Attack
🇳🇱 middelkoopcc	2026-10-21 17:13:13 UTC · (2 weeks ago)	2026-10-21 19:11:44 GET /.git/packed-refs [404] && 2026-10-21 19:11:44 GET /.git/config [404] && 2026-10-21 19:11:45 GET /.git/refs/remotes/origin/HEAD [404] && 132 more within 20 minutes	Web App Attack
Anonymous	2026-10-21 16:37:26 UTC · (2 weeks ago)	This IP was detected by CrowdSec triggering crowdsecurity/http-probing	Web App Attack Hacking
🇫🇮 Mausteuuno	2026-10-21 16:05:00 UTC · (2 weeks ago)	Scans for vulnerable git files 64.181.199.73 - - [21/Oct/2026:19:03:43 +0300] "GET /.git/info/refs HTTP/1.1" 500 4 "-" "WebSiphon/next-0.1" 64.181.199.73 - - [21/Oct/2026:19:03:43 +0300] "GET /app/.git/refs/heads/main HTTP/1.1" 500 4 "-" "WebSiphon ... show more Scans for vulnerable git files 64.181.199.73 - - [21/Oct/2026:19:03:43 +0300] "GET /.git/info/refs HTTP/1.1" 500 4 "-" "WebSiphon/next-0.1" 64.181.199.73 - - [21/Oct/2026:19:03:43 +0300] "GET /app/.git/refs/heads/main HTTP/1.1" 500 4 "-" "WebSiphon/next-0.1" 64.181.199.73 - - [21/Oct/2026:19:03:43 +0300] "GET /.git/config HTTP/1.1" 500 4 "-" "WebSiphon/next-0.1" show less	Web App Attack
🇵🇱 sefinek.net	2026-10-21 15:58:37 UTC · (2 weeks ago)	Honeypot hit: HTTP/1.1 request on 8081 GET / User-Agent: WebSiphon/next-0.1 Accept: / Accept-Encoding: gzip,deflate,br; 8081 [558] TCP Reported by: https://github.com/sefinek/T-Pot-To-AbuseIPDB	Hacking Bad Web Bot
🇧🇷 ICS Labs	2026-10-21 14:40:07 UTC · (2 weeks ago)	ICS Labs threat intelligence (ICS Feeds): Hacking, Brute-Force. Last observed 2026-10-21 UTC.	Hacking Brute-Force
🇬🇧 essinghigh	2026-10-21 10:19:24 UTC · (2 weeks ago)	IPS Detection: 64.181.199.73 -> DPT: 3000	Port Scan
🇧🇪 cmbplf	2026-10-20 22:27:38 UTC · (2 weeks ago)	814 requests with url.path config.json 555 requests with url.path config.yaml 370 requests with url.path secrets.yaml 259 requests with url.path credentials.json 259 requests with url.path secrets.json 222 requests with url.path config.to ... show more 814 requests with url.path config.json 555 requests with url.path config.yaml 370 requests with url.path secrets.yaml 259 requests with url.path credentials.json 259 requests with url.path secrets.json 222 requests with url.path config.toml 185 requests with url.path compose.yml 185 requests with url.path config.py 111 requests with url.path *config.yml show less	Brute-Force Bad Web Bot
🇩🇪 YF	2026-10-20 22:20:21 UTC · (2 weeks ago)	404 errors Vulnerability scan	Web App Attack
Anonymous	2026-10-20 21:43:02 UTC · (2 weeks ago)	Reported by RattusGuard: Auto-blocked by ThreatIntel (score: 0.97)	Hacking
🇩🇪 Marcin Stepien	2026-10-20 21:32:42 UTC · (2 weeks ago)	Hit honeypot endpoint /.env. Automated scanner/bot detected.	Bad Web Bot Web App Attack
🇨🇱 ifiguero	2026-10-20 19:53:50 UTC · (2 weeks ago)	Web Attack (\x00\x00\x00\x00\x00). 7d ban	Web App Attack
🇩🇪 maxpower	2026-10-20 19:52:05 UTC · (2 weeks ago)	(exploit_critical) REGOLA 2 - Critical File Exploit Attempt 64.181.199.73 (US/United States/-): 1 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 64.181.199.73 - - [20/Oct/2026:21:52:01 +0200] "GET /secrets.env HTT ... show more (exploit_critical) REGOLA 2 - Critical File Exploit Attempt 64.181.199.73 (US/United States/-): 1 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 64.181.199.73 - - [20/Oct/2026:21:52:01 +0200] "GET /secrets.env HTTP/1.1" 200 4815 "-" "WebSiphon/next-0.1" "-" host=145.239.233.176 show less	Port Scan
🇳🇱 MyGlobalFlowers	2026-10-20 19:39:55 UTC · (2 weeks ago)	Multiple WAF Violations	Web App Attack

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇩🇪 2400:cb00:637:1000:8f2f:840c:f672:978a

🇩🇪 69.5.169.33

🇧🇷 45.238.2.181

🇺🇸 2a02:4780:10:41e8::1

🇨🇱 201.223.115.140

🇺🇸 173.0.81.140

🇫🇮 155.212.109.231

🇹🇭 152.32.245.196

🇺🇸 129.121.141.232

🇭🇰 123.58.215.196

🇮🇱 85.65.214.118

🇳🇱 77.67.26.174

🇳🇱 45.148.10.157

🇰🇷 220.116.117.213

🇳🇱 205.147.16.206

🇺🇸 192.178.4.161

🇳🇱 45.156.87.72

🇧🇷 38.156.31.63

🇺🇸 198.74.56.46

🇨🇭 179.43.153.18