IP and domain reputation lookup

BadBot Gateway scores IP addresses and domains by the abuse that BadBot's own honeypot sensors catch, such as scanners, brute-force bots and exploit probes, with recent activity counting most. Search an indicator for its score, report history and categories, or download the high-risk feeds; how the sensor network works is explained at badbot.net.

Reputation 20.106.161.129 ip

Score
100
/100
raw: 226.63
Reports
28
Last Reported
2026-11-07 19:10 UTC
Categories
Scanning (14) Config Exposure Probe (11) Admin Panel Probe (2) API Probe (1)

Network details

ASN
8075
Organization
Microsoft Corporation
Country
US

Threat Intelligence enriched 2026-11-07 19:08 UTC

DNSBL Status
Clean

Sensor Activity last 20 events

Time (UTC) Trap Signal Method Path Flags
2026-11-07 19:09 UTC debug-panel direct GET /_debugbar burst
2026-11-07 19:09 UTC catch-all-config direct GET /.git-credentials burst
2026-11-07 19:09 UTC catch-all-framework direct GET /.composer/auth.json burst
2026-11-07 19:09 UTC catch-all-suspicious direct GET /application-staging.yml burst
2026-11-07 19:09 UTC catch-all-script direct GET /config/filesystems.php burst
2026-11-07 19:09 UTC catch-all-suspicious direct GET /nuxt.config.ts burst
2026-11-07 19:09 UTC catch-all-config direct GET /www/.env burst
2026-11-07 19:08 UTC catch-all-config direct GET /html/.env burst
2026-11-07 19:08 UTC catch-all-suspicious direct GET /gcp-credentials.json burst
2026-11-07 19:08 UTC git-head direct GET /.git/HEAD burst
2026-11-07 19:08 UTC debug-panel direct GET /elmah.axd burst
2026-11-07 19:08 UTC sql-dump direct GET /db.sql burst
2026-11-07 19:08 UTC catch-all-suspicious direct GET /var/log/nginx/error.log burst
2026-11-07 19:08 UTC actuator direct GET /actuator/configprops burst
2026-11-07 19:08 UTC cicd-config direct GET /.circleci/config.yml burst
2026-11-07 19:08 UTC catch-all-suspicious direct GET /.travis.yml burst
2026-11-07 19:08 UTC cicd-config direct GET /.gitlab-ci.yml burst
2026-11-07 19:08 UTC catch-all-suspicious direct GET /config.yaml burst
2026-11-07 19:08 UTC catch-all-backup direct GET /config.bak burst
2026-11-07 19:08 UTC catch-all-suspicious direct GET /appsettings.Production.json

Recent Indicators

Indicator Type Score Reports Country Last Reported First Seen
51.158.195.56 ip
39
 1 NL 2026-11-07 19:55 UTC 2026-11-07 19:55 UTC
51.158.203.155 ip
91
 4 NL 2026-11-07 19:55 UTC 2026-11-07 19:55 UTC
101.53.228.226 ip
50
 1 PK 2026-11-07 19:55 UTC 2026-11-07 19:55 UTC
148.224.102.13 ip
39
 1 MX 2026-11-07 19:54 UTC 2026-11-07 19:54 UTC
91.219.80.224 ip
50
 1 UA 2026-11-07 19:53 UTC 2026-11-07 19:53 UTC
200.181.134.70 ip
50
 1 BR 2026-11-07 19:53 UTC 2026-11-07 19:53 UTC
103.168.234.22 ip
50
 1 IN 2026-11-07 19:52 UTC 2026-11-07 19:52 UTC
106.215.165.6 ip
39
 1 IN 2026-11-07 19:52 UTC 2026-11-07 19:52 UTC
144.124.199.214 ip
39
 1 UZ 2026-11-07 19:49 UTC 2026-11-07 19:49 UTC
196.64.2.237 ip
50
 1 MA 2026-11-07 19:47 UTC 2026-11-07 19:47 UTC
130.43.62.118 ip
50
 1 GR 2026-11-07 19:45 UTC 2026-11-07 19:45 UTC
39.15.10.166 ip
39
 1 TW 2026-11-07 19:40 UTC 2026-11-07 19:40 UTC
103.100.234.167 ip
50
 1 BD 2026-11-07 19:40 UTC 2026-11-07 19:40 UTC
103.137.80.80 ip
50
 1 BD 2026-11-07 19:35 UTC 2026-11-07 19:35 UTC
186.189.92.240 ip
39
 1 CL 2026-11-07 19:34 UTC 2026-11-07 19:34 UTC
117.5.152.195 ip
50
 1 VN 2026-11-07 19:28 UTC 2026-11-07 19:28 UTC
187.243.204.145 ip
39
 1 MX 2026-11-07 19:27 UTC 2026-11-07 19:27 UTC
45.4.105.221 ip
39
 1 BR 2026-11-07 19:26 UTC 2026-11-07 19:26 UTC
102.98.72.18 ip
39
 1 MA 2026-11-07 19:26 UTC 2026-11-07 19:26 UTC
175.141.179.217 ip
50
 1 MY 2026-11-07 19:25 UTC 2026-11-07 19:25 UTC
188.239.238.193 ip
50
 1 UA 2026-11-07 19:25 UTC 2026-11-07 19:25 UTC
31.43.49.115 ip
50
 1 UA 2026-11-07 19:24 UTC 2026-11-07 19:24 UTC
103.146.149.51 ip
39
 1 NP 2026-11-07 19:23 UTC 2026-11-07 19:23 UTC
209.178.158.12 ip
39
 1 MX 2026-11-07 19:22 UTC 2026-11-07 19:22 UTC
95.10.177.6 ip
39
 1 TR 2026-11-07 19:20 UTC 2026-11-07 19:20 UTC

Showing 1-25 of 88206 indicators