IP and domain reputation lookup

BadBot Gateway scores IP addresses and domains by the abuse that BadBot's own honeypot sensors catch, such as scanners, brute-force bots and exploit probes, with recent activity counting most. Search an indicator for its score, report history and categories, or download the high-risk feeds; how the sensor network works is explained at badbot.net.

Reputation 109.123.101.63 ip

Score
78
/100
raw: 15.23
Reports
390
Last Reported
2026-08-31 20:30 UTC
Categories
Config Exposure Probe (299) Scanning (62) API Probe (15) Admin Panel Probe (12) Credential Stuffing (2)

Network details

ASN
13213
Organization
Thg Hosting Limited
Country
GB

Threat Intelligence enriched 2026-11-04 06:13 UTC

Reverse DNS
ns.involution.uk
DNSBL Status
Clean

Sensor Activity last 20 events

Time (UTC) Trap Signal Method Path Flags
2026-08-31 20:29 UTC catch-all-backup direct GET /terraform.tfstate.backup burst
2026-08-31 20:29 UTC iac-secrets direct GET /terraform.tfstate burst
2026-08-31 20:29 UTC catch-all-suspicious direct GET /.kube/config burst
2026-08-31 20:29 UTC catch-all-scan direct GET /application.properties burst
2026-08-31 20:29 UTC catch-all-suspicious direct GET /web.config burst
2026-08-31 20:29 UTC catch-all-suspicious direct GET /appsettings.json burst
2026-08-31 20:29 UTC catch-all-traversal direct GET /proc/self/environ burst
2026-08-31 20:29 UTC catch-all-scan direct GET /.netrc burst
2026-08-31 20:29 UTC catch-all-scan direct GET /.npmrc burst
2026-08-31 20:29 UTC catch-all-scan direct GET /.ssh/id_ed25519 burst
2026-08-31 20:29 UTC catch-all-scan direct GET /.ssh/id_rsa burst
2026-08-31 20:29 UTC backup direct GET /backup/database.sql burst
2026-08-31 20:29 UTC catch-all-backup direct GET /database.sql burst
2026-08-31 20:29 UTC sql-dump direct GET /dump.sql burst
2026-08-31 20:29 UTC catch-all-config direct GET /.htpasswd burst
2026-08-31 20:29 UTC catch-all-suspicious direct GET /app/config/parameters.yml burst
2026-08-31 20:29 UTC catch-all-script direct GET /config/database.php burst
2026-08-31 20:29 UTC catch-all-script direct GET /includes/config.php burst
2026-08-31 20:29 UTC catch-all-script direct GET /config/config.php burst
2026-08-31 20:29 UTC actuator direct GET /actuator/logfile burst

Recent Indicators

Indicator Type Score Reports Country Last Reported First Seen
37.222.54.67 ip
63
2 ES 2026-11-06 14:22 UTC 2026-11-06 14:22 UTC
178.226.198.192 ip
63
2 NL 2026-11-06 14:22 UTC 2026-11-06 14:22 UTC
201.159.55.122 ip
39
1 BR 2026-11-06 14:22 UTC 2026-11-06 14:22 UTC
41.139.133.51 ip
99
8 KE 2026-11-06 14:22 UTC 2026-11-06 14:21 UTC
179.99.13.193 ip
99
8 BR 2026-11-06 14:22 UTC 2026-11-06 14:21 UTC
157.100.112.100 ip
86
3 EC 2026-11-06 14:21 UTC 2026-11-06 14:21 UTC
95.107.101.25 ip
93
5 RU 2026-11-06 14:21 UTC 2026-11-06 14:21 UTC
182.64.193.17 ip
99
7 IN 2026-11-06 14:21 UTC 2026-11-06 14:20 UTC
103.138.145.128 ip
78
3 BD 2026-11-06 14:20 UTC 2026-11-06 14:20 UTC
37.203.17.215 ip
92
4 UA 2026-11-06 14:20 UTC 2026-11-06 14:20 UTC
176.123.224.88 ip
78
3 KG 2026-11-06 14:20 UTC 2026-11-06 14:20 UTC
110.38.14.243 ip
63
2 PK 2026-11-06 14:20 UTC 2026-11-06 14:20 UTC
103.158.118.115 ip
39
1 BD 2026-11-06 14:20 UTC 2026-11-06 14:20 UTC
49.42.224.56 ip
91
4 IN 2026-11-06 14:20 UTC 2026-11-06 14:20 UTC
171.250.161.56 ip
100
9 VN 2026-11-06 14:20 UTC 2026-11-06 14:19 UTC
176.115.148.102 ip
100
8 RU 2026-11-06 14:20 UTC 2026-11-06 14:19 UTC
158.23.18.186 ip
100
69 MX 2026-11-06 14:28 UTC 2026-11-06 14:18 UTC
219.131.134.6 ip
39
1 CN 2026-11-06 14:17 UTC 2026-11-06 14:17 UTC
150.251.225.198 ip
100
170 AT 2026-11-06 14:13 UTC 2026-11-06 14:12 UTC
200.234.163.246 ip
100
62 BR 2026-11-06 14:13 UTC 2026-11-06 14:12 UTC
45.115.26.39 ip
99
8 HK 2026-11-06 14:28 UTC 2026-11-06 14:03 UTC
134.209.85.225 ip
94
4 NL 2026-11-06 13:56 UTC 2026-11-06 13:56 UTC
35.194.106.233 ip
100
78 JP 2026-11-06 13:53 UTC 2026-11-06 13:52 UTC
188.40.218.47 ip
50
1 DE 2026-11-06 13:41 UTC 2026-11-06 13:41 UTC
207.175.194.17 ip
100
81 BE 2026-11-06 13:41 UTC 2026-11-06 13:39 UTC

Showing 1-25 of 87436 indicators