JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 43.228.157.197

43.228.157.197 was found in our database!

This IP was reported 1,639 times. Confidence of Abuse is 100%: ?

100%

ISP	Cyber-Security-SG
Usage Type	Data Center/Web Hosting/Transit
ASN	AS205759
Domain Name	pointtoserver.com
Country	🇩🇪 Germany
City	Frankfurt am Main, Hesse

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 43.228.157.197

Whois 43.228.157.197

IP Abuse Reports for 43.228.157.197:

This IP address has been reported a total of 1,639 times from 303 distinct sources. 43.228.157.197 was first reported on March 20th 2026, and the most recent report was 2 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇵🇱 Budyn	2026-08-24 15:13:21 (2 hours ago)	Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scan ... show more Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: admin.sweetpuddingtrap.online \| URI: /.env \| UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36 \| BODY: [Empty / GET Request] show less	Bad Web Bot Web App Attack
🇩🇪 febrian.de	2026-08-24 14:34:23 (3 hours ago)	Excessive HTTP(S) probing or bad web bot detected by Fail2Ban	Bad Web Bot Web App Attack
🇮🇹 abuseiphack	2026-08-24 13:49:16 (3 hours ago)	Automatic report for brute force attack	Web App Attack
🇵🇱 Budyn	2026-08-24 10:25:44 (7 hours ago)	Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scan ... show more Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: registry.definitelynotahoneypot.top \| URI: /.env \| UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36 \| BODY: [Empty / GET Request] show less	Bad Web Bot Web App Attack
🇩🇪 jbcrn	2026-08-24 09:55:12 (7 hours ago)	Blocked by iocaine (nam-shub-of-enki) tarpit. Classified as: Disguised bots, ruleset: faked-browser. ... show more Blocked by iocaine (nam-shub-of-enki) tarpit. Classified as: Disguised bots, ruleset: faked-browser. Requested honeypot path: /. User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36 show less	Bad Web Bot Web App Attack
🇫🇷 arsonist	2026-08-24 09:05:09 (8 hours ago)	This IP accessed the path /.env, which is banned. Powered by ListenCaddy	Bad Web Bot Web App Attack
Anonymous	2026-08-24 08:26:20 (9 hours ago)	Excessive 404 errors - web scanning/probing	Bad Web Bot
🇺🇸 Lee Daniel	2026-08-24 06:43:48 (10 hours ago)	43.228.157.197 - - [24/Aug/2026:02:43:47 -0400] "GET /.env HTTP/1.1" 403 6267 "-" "Mozilla/5.0 (Wind ... show more 43.228.157.197 - - [24/Aug/2026:02:43:47 -0400] "GET /.env HTTP/1.1" 403 6267 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" ... show less	DDoS Attack Web Spam Email Spam Port Scan Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-08-24 06:36:50 (10 hours ago)	http scanning for .env files ...	Hacking Web App Attack
🇵🇱 Budyn	2026-08-24 06:24:42 (11 hours ago)	Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scan ... show more Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: pma.goblinpot.site \| URI: /.env \| UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36 \| BODY: [Empty / GET Request] show less	Bad Web Bot Web App Attack
🇵🇱 sefinek.net	2026-08-24 05:49:55 (11 hours ago)	Triggered Cloudflare WAF (firewallCustom) from DE. Action: BLOCK \| Protocol: HTTP/1.1 (GET) \| Endpoi ... show more Triggered Cloudflare WAF (firewallCustom) from DE. Action: BLOCK \| Protocol: HTTP/1.1 (GET) \| Endpoint: /js/env.js \| UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36 • Generated by: github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
🇵🇱 Budyn	2026-08-24 02:06:12 (15 hours ago)	Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scan ... show more Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: test.dont-eat-the-pudding.xyz \| URI: /.env \| UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36 \| BODY: [Empty / GET Request] show less	Bad Web Bot Web App Attack
🇬🇧 consul.to	2026-08-24 01:46:10 (15 hours ago)	Web attack/malicious scanning detected	Web App Attack
🇺🇸 TPI-Abuse	2026-08-24 01:40:16 (15 hours ago)	(mod_security) mod_security (id:210492) triggered by 43.228.157.197 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 43.228.157.197 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Aug 23 21:40:09.145000 2026] [security2:error] [pid 10700:tid 10700] [client 43.228.157.197:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ccamp.dev"] [uri "/.env"] [unique_id "aoug-TcJbfWEfO-bEBfOWQAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 Epimetheus	2026-08-24 00:54:31 (16 hours ago)	Unauthorized access attempts: [GET] /settings.js [GET] /api/config [GET] /.env [GET] /.env.producti ... show more Unauthorized access attempts: [GET] /settings.js [GET] /api/config [GET] /.env [GET] /.env.production [GET] /config.js [GET] /config.json [GET] /js/config.js [GET] /api/env [GET] /js/env.js UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36 show less	Web App Attack

Showing 1 to 15 of 1639 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇳 180.76.184.79

🇺🇸 172.234.222.225

🇺🇸 104.22.20.40

🇬🇧 81.19.219.209

🇹🇷 45.15.41.70

🇨🇳 180.116.255.195

🇰🇷 125.129.127.204

🇸🇬 103.253.27.23

🇰🇪 102.205.238.4

🇺🇸 66.132.195.111

🇬🇧 51.195.215.139

🇨🇳 42.51.40.180

🇺🇸 2602:80d:1007::64

🇺🇸 209.85.222.102

🇺🇸 160.153.189.18

🇫🇷 157.173.125.36

🇷🇺 77.37.174.154

🇪🇸 2a05:d011:d07:5800:e4:6a28:1b86:4bee

🇭🇰 203.91.74.151

🇳🇱 195.178.110.26