JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

80.94.92.53

Neutral Activity

Abuse confidence score ?

0% Low Risk

545 reports

219 reporters · latest 1 month ago

ISP	TECHOFF SRV LIMITED
Usage Type	Data Center/Web Hosting/Transit
ASN	AS47890
Domain Name	dmzhost.co
Country	🇷🇴 Romania
City	Timisoara, Timis County

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Reports Activity

Example preview

Report Categories (Last 60 Days)

Example preview

Top Reporter Countries (Last 60 Days)

Example preview

Account required for the enhanced features Log in Sign up

IP Abuse Reports for 80.94.92.53

This IP address has been reported a total of 545 times from 219 distinct sources. 80.94.92.53 was first reported on August 12th 2022, and the most recent report was 1 month ago. In the last 60 days, the only reporter location was: The only category in these recent reports was: Port Scan 1 time.

Reporter	IoA Timestamp (UTC)	Comment	Categories
Anonymous	2026-07-28 04:36:00 (1 month ago)	Sustained automated full-port sweep of public infrastructure — same source IP persisted for 2+ hours ... show more Sustained automated full-port sweep of public infrastructure — same source IP persisted for 2+ hours using two persistent source ports (56706 and 56722) probing 50+ sequential destination ports including 25002 10080 631 5236 6002 6881 556 8110 9754 139 1180 888 3780 5902 5904 5906 9002 9800 10001 and many others. Systematic scan pattern not random — automated scanner sweeping all ports. Blocked at network perimeter ACL. Adjacent host 80.94.92.17 previously blocked as a host entry. show less	Port Scan
🇩🇪 ghostwarriors	2026-05-22 16:21:38 (4 months ago)	Webpage scraping	Brute-Force Bad Web Bot Web App Attack
🇯🇵 S.O.B.A. Dev.	2026-05-14 16:04:21 (4 months ago)	Web vulnerability scanning	Brute-Force Web Spam Web App Attack
🇺🇸 S.O.B.A. Dev.	2026-05-14 16:04:19 (4 months ago)	Threat Blocked by BeeHive from (ASN:47890) (Network:UNMANAGED LTD) (Host:soba.dev) (Method:GET) (Pro ... show more Threat Blocked by BeeHive from (ASN:47890) (Network:UNMANAGED LTD) (Host:soba.dev) (Method:GET) (Protocol:HTTP/1.1) (Timestamp:2026-05-14T16:04:19Z) show less	Brute-Force Web Spam Web App Attack
🇺🇸 Vano Ganzzz	2026-05-14 14:19:53 (4 months ago)	Triggered Cloudflare WAF (firewallCustom) from RO. Action taken: BLOCK ASN: 47890 (UNMANAGED LTD) Pr ... show more Triggered Cloudflare WAF (firewallCustom) from RO. Action taken: BLOCK ASN: 47890 (UNMANAGED LTD) Protocol: HTTP/1.1 (POST method) Endpoint: /lib/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php Timestamp: 2026-05-14T14:19:53Z Ray ID: 9fba8a587812804e UA: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36 show less	Bad Web Bot
🇬🇧 WebNiraj	2026-05-14 14:11:14 (4 months ago)	(mod_security) mod_security (id:949110) triggered by 80.94.92.53 (NL/The Netherlands/-): 5 in the la ... show more (mod_security) mod_security (id:949110) triggered by 80.94.92.53 (NL/The Netherlands/-): 5 in the last 3600 secs [SIGMA] show less	Brute-Force
Anonymous	2026-05-14 08:03:36 (4 months ago)	(PERMBLOCK) 80.94.92.53 (NL/The Netherlands/-) has had more than 4 temp blocks in the last 86400 sec ... show more (PERMBLOCK) 80.94.92.53 (NL/The Netherlands/-) has had more than 4 temp blocks in the last 86400 secs; Ports: *; Direction: inout; Trigger: LF_PERMBLOCK_COUNT; Logs: show less	Port Scan
Anonymous	2026-05-14 07:41:11 (4 months ago)	(caddyscan) Scanner path probe from 80.94.92.53 (NL/The Netherlands/-): 5 in the last 3600 secs; Por ... show more (caddyscan) Scanner path probe from 80.94.92.53 (NL/The Netherlands/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 80.94.92.53 - - [14/May/2026:07:41:06 +0000] "GET /.env.aws HTTP/1.1" [REDACTED] 200 2627 80.94.92.53 - - [14/May/2026:07:41:06 +0000] "GET /s3/.env.bak HTTP/1.1" [REDACTED] 200 2627 80.94.92.53 - - [14/May/2026:07:41:06 +0000] "GET /.ssh/config HTTP/1.1" [REDACTED] 200 2627 80.94.92.53 - - [14/May/2026:07:41:06 +0000] "GET /prisma/.env HTTP/1.1" [REDACTED] 200 2627 80.94.92.53 - - [14/May/2026:07:41:06 +0000] "GET /s3/.aws/config HTTP/1.1" show less	Port Scan
Anonymous	2026-05-14 05:30:50 (4 months ago)	(caddyscan) Scanner path probe from 80.94.92.53 (NL/The Netherlands/-): 5 in the last 3600 secs; Por ... show more (caddyscan) Scanner path probe from 80.94.92.53 (NL/The Netherlands/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 80.94.92.53 - - [14/May/2026:05:30:46 +0000] "GET /.env.vault HTTP/1.1" [REDACTED] 200 2627 80.94.92.53 - - [14/May/2026:05:30:46 +0000] "GET /client/.env HTTP/1.1" [REDACTED] 200 2627 80.94.92.53 - - [14/May/2026:05:30:46 +0000] "GET /.env.prod HTTP/1.1" [REDACTED] 200 2627 80.94.92.53 - - [14/May/2026:05:30:46 +0000] "GET /.env HTTP/1.1" [REDACTED] 200 2627 80.94.92.53 - - [14/May/2026:05:30:46 +0000] "GET /.env.save HTTP/1.1" show less	Port Scan
Anonymous	2026-05-14 04:15:01 (4 months ago)	(caddyscan) Scanner path probe from 80.94.92.53 (NL/The Netherlands/-): 5 in the last 3600 secs; Por ... show more (caddyscan) Scanner path probe from 80.94.92.53 (NL/The Netherlands/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 80.94.92.53 - - [14/May/2026:04:15:00 +0000] "GET /.git/HEAD HTTP/1.1" [REDACTED] 200 2627 80.94.92.53 - - [14/May/2026:04:15:00 +0000] "GET /.env.example HTTP/1.1" [REDACTED] 200 2627 80.94.92.53 - - [14/May/2026:04:15:00 +0000] "GET /.git/logs/HEAD HTTP/1.1" [REDACTED] 200 2627 80.94.92.53 - - [14/May/2026:04:15:00 +0000] "GET /storage/.env HTTP/1.1" [REDACTED] 200 2627 80.94.92.53 - - [14/May/2026:04:15:00 +0000] "GET /public/.env HTTP/1.1" show less	Port Scan
🇺🇸 LSPCCU	2026-05-14 03:28:52 (4 months ago)	TSEC Honeypot Network report. Threat score: 100/100. Categories: DDoS Attack, Port Scan, Hacking, Br ... show more TSEC Honeypot Network report. Threat score: 100/100. Categories: DDoS Attack, Port Scan, Hacking, Brute-Force, Web App Attack, SSH. Honeypot: cowrie, ssh-telnet. Context: Attacker IP from unknown location. show less	DDoS Attack Port Scan Hacking Brute-Force Web App Attack SSH
🇳🇱 Site.eu	2026-05-14 03:06:57 (4 months ago)	Excessive multi-domain requests	Brute-Force
Anonymous	2026-05-14 03:06:23 (4 months ago)	(caddyscan) Scanner path probe from 80.94.92.53 (NL/The Netherlands/-): 5 in the last 3600 secs; Por ... show more (caddyscan) Scanner path probe from 80.94.92.53 (NL/The Netherlands/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 80.94.92.53 - - [14/May/2026:03:06:19 +0000] "GET /.env.vault HTTP/1.1" [REDACTED] 200 2627 80.94.92.53 - - [14/May/2026:03:06:19 +0000] "GET /.env.development HTTP/1.1" [REDACTED] 200 2627 80.94.92.53 - - [14/May/2026:03:06:19 +0000] "GET /sites/.env HTTP/1.1" [REDACTED] 200 2627 80.94.92.53 - - [14/May/2026:03:06:20 +0000] "GET /assets/.env HTTP/1.1" [REDACTED] 200 2627 80.94.92.53 - - [14/May/2026:03:06:20 +0000] "GET /lab/.env HTTP/1.1" show less	Port Scan
Anonymous	2026-05-14 02:16:43 (4 months ago)	(caddyscan) Scanner path probe from 80.94.92.53 (NL/The Netherlands/-): 5 in the last 3600 secs; Por ... show more (caddyscan) Scanner path probe from 80.94.92.53 (NL/The Netherlands/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 80.94.92.53 - - [14/May/2026:02:14:19 +0000] "GET /actuator/env HTTP/1.1" [REDACTED] 200 2627 80.94.92.53 - - [14/May/2026:02:15:32 +0000] "GET /actuator/env HTTP/1.1" [REDACTED] 200 2627 80.94.92.53 - - [14/May/2026:02:16:28 +0000] "GET /.env.old HTTP/1.1" [REDACTED] 200 2627 80.94.92.53 - - [14/May/2026:02:16:28 +0000] "GET /vendor/.env HTTP/1.1" [REDACTED] 200 2627 80.94.92.53 - - [14/May/2026:02:16:28 +0000] "GET /lib/.env HTTP/1.1" show less	Port Scan
🇫🇮 as211431.net	2026-05-13 20:03:19 (4 months ago)	Triggered Cloudflare WAF (firewallCustom) from RO. Action taken: BLOCK Protocol: HTTP/2 (GET method) ... show more Triggered Cloudflare WAF (firewallCustom) from RO. Action taken: BLOCK Protocol: HTTP/2 (GET method) Endpoint: / UA: Mozilla/5.0 zgrab/0.x This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot

Showing 1 to 15 of 545 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇸🇬 172.86.81.110

🇺🇸 66.132.195.94

🇺🇸 66.132.186.202

🇺🇸 20.83.58.72

🇵🇰 2407:d000:1c:ada:1703:ab96:3857:72ca

🇮🇩 202.51.214.98

🇩🇪 185.30.32.25

🇺🇸 162.216.149.148

🇫🇷 143.244.57.86

🇰🇷 112.219.151.50

🇳🇱 104.23.170.95

🇺🇸 100.33.145.85

🇮🇳 52.172.177.191

🇬🇧 185.247.137.174

🇧🇷 177.30.68.202

🇧🇩 103.190.132.216

🇧🇩 103.167.15.11

🇺🇸 100.28.153.226

🇸🇬 47.128.27.198

🇬🇧 45.133.173.66