IP and domain reputation lookup
BadBot Gateway scores IP addresses and domains by the abuse that BadBot's own honeypot sensors catch, such as scanners, brute-force bots and exploit probes, with recent activity counting most. Search an indicator for its score, report history and categories, or download the high-risk feeds; how the sensor network works is explained at badbot.net.
Reputation 159.89.227.118 ip
Score
100
/100
raw: 61.83
Reports
9
Last Reported
2026-11-03 21:09 UTC
Categories
Scanning (6)
API Probe (2)
Web Stack Probe (1)
Network details
ASN
14061
Organization
DigitalOcean, LLC
Country
US
Threat Intelligence enriched 2026-11-03 21:09 UTC
DNSBL Status
Clean
Sensor Activity last 9 events
| Time (UTC) | Trap | Signal | Method | Path | Flags |
|---|---|---|---|---|---|
| 2026-11-03 21:09 UTC | catch-all-script | direct | PUT | /shell_6a4f9123ca7a7650.jsp | burst |
| 2026-11-03 21:09 UTC | catch-all-scan | direct | GET | /crumbIssuer/api/json | burst |
| 2026-11-03 21:09 UTC | catch-all-scan | direct | POST | /run | burst |
| 2026-11-03 21:09 UTC | catch-all-scan | direct | POST | /code/blocks/exec/start | burst |
| 2026-11-03 21:09 UTC | api | direct | POST | /api/v1/code/blocks/exec/start | burst |
| 2026-11-03 21:09 UTC | catch-all-scan | direct | POST | /code/blocks/exec/code | burst |
| 2026-11-03 21:08 UTC | api | direct | POST | /api/v1/code/blocks/exec/code | |
| 2026-11-03 21:08 UTC | catch-all-script | direct | GET | /foo.jsp | scanner |
| 2026-11-03 21:08 UTC | wp-json | direct | POST | / |
Recent Indicators
| Indicator | Type | Score | Reports | Country | Last Reported | First Seen |
|---|---|---|---|---|---|---|
| 206.189.161.29 | ip |
70
|
2 | US | 2026-11-03 22:23 UTC | 2026-11-03 22:23 UTC |
| 181.61.246.222 | ip |
39
|
1 | CO | 2026-11-03 22:22 UTC | 2026-11-03 22:22 UTC |
| 95.85.150.148 | ip |
39
|
1 | RS | 2026-11-03 22:22 UTC | 2026-11-03 22:22 UTC |
| 38.159.230.248 | ip |
39
|
1 | DO | 2026-11-03 22:22 UTC | 2026-11-03 22:22 UTC |
| 151.241.122.33 | ip |
100
|
24 | US | 2026-11-03 22:17 UTC | 2026-11-03 22:17 UTC |
| 147.185.133.216 | ip |
39
|
1 | US | 2026-11-03 22:02 UTC | 2026-11-03 22:02 UTC |
| 101.96.220.35 | ip |
100
|
45 | CN | 2026-11-03 21:57 UTC | 2026-11-03 21:50 UTC |
| 208.76.40.215 | ip |
33
|
2 | ID | 2026-11-03 21:47 UTC | 2026-11-03 21:47 UTC |
| 158.173.241.234 | ip |
100
|
376 | SE | 2026-11-03 21:52 UTC | 2026-11-03 21:46 UTC |
| 158.173.21.10 | ip |
100
|
19 | NL | 2026-11-03 21:45 UTC | 2026-11-03 21:44 UTC |
| 185.190.54.150 | ip |
100
|
483 | DE | 2026-11-03 21:39 UTC | 2026-11-03 21:34 UTC |
| 162.158.102.193 | ip |
75
|
2 | PL | 2026-11-03 21:32 UTC | 2026-11-03 21:32 UTC |
| 159.89.227.118 | ip |
100
|
9 | US | 2026-11-03 21:09 UTC | 2026-11-03 21:09 UTC |
| 172.64.200.138 | ip |
75
|
2 | PL | 2026-11-03 21:05 UTC | 2026-11-03 21:05 UTC |
| 162.158.102.233 | ip |
75
|
2 | PL | 2026-11-03 20:58 UTC | 2026-11-03 20:58 UTC |
| 170.64.230.72 | ip |
94
|
4 | AU | 2026-11-03 20:51 UTC | 2026-11-03 20:51 UTC |
| 46.4.102.238 | ip |
100
|
23 | DE | 2026-11-03 20:43 UTC | 2026-11-03 20:42 UTC |
| 150.251.225.186 | ip |
100
|
8 | AT | 2026-11-03 20:31 UTC | 2026-11-03 20:27 UTC |
| 77.67.26.68 | ip |
39
|
1 | US | 2026-11-03 20:03 UTC | 2026-11-03 20:03 UTC |
| 123.57.95.207 | ip |
78
|
3 | CN | 2026-11-03 20:03 UTC | 2026-11-03 20:01 UTC |
| 38.60.136.253 | ip |
26
|
1 | FR | 2026-11-03 19:50 UTC | 2026-11-03 19:50 UTC |
| 185.125.50.192 | ip |
75
|
2 | DE | 2026-11-03 19:40 UTC | 2026-11-03 19:40 UTC |
| 172.71.247.137 | ip |
70
|
2 | US | 2026-11-03 19:39 UTC | 2026-11-03 19:39 UTC |
| 103.231.162.132 | ip |
39
|
1 | BD | 2026-11-03 19:35 UTC | 2026-11-03 19:35 UTC |
| 190.104.36.242 | ip |
70
|
2 | AR | 2026-11-03 19:35 UTC | 2026-11-03 19:35 UTC |
Showing 1-25 of 86398 indicators