IP and domain reputation lookup

BadBot Gateway scores IP addresses and domains by the abuse that BadBot's own honeypot sensors catch, such as scanners, brute-force bots and exploit probes, with recent activity counting most. Search an indicator for its score, report history and categories, or download the high-risk feeds; how the sensor network works is explained at badbot.net.

Reputation 20.109.38.160 ip

Score
4
/100
raw: 0.46
Reports
42
Last Reported
2026-06-28 01:48 UTC
Categories
Config Exposure Probe (23) Scanning (16) API Probe (2) Credential Stuffing (1)

Network details

ASN
8075
Organization
Microsoft Corporation
Country
US

Threat Intelligence enriched 2026-11-05 02:08 UTC

DNSBL Status
Clean

Sensor Activity last 20 events

Time (UTC) Trap Signal Method Path Flags
2026-06-28 01:48 UTC catch-all-scan direct POST /___proxy_subdomain_whm/login/ burst creds
2026-06-28 01:48 UTC catch-all-backup direct GET /terraform.tfstate.backup burst
2026-06-28 01:48 UTC iac-secrets direct GET /terraform.tfstate burst
2026-06-28 01:48 UTC catch-all-suspicious direct GET /.kube/config burst
2026-06-28 01:48 UTC catch-all-suspicious direct GET /application.yml burst
2026-06-28 01:48 UTC catch-all-scan direct GET /application.properties burst
2026-06-28 01:47 UTC catch-all-suspicious direct GET /web.config burst
2026-06-28 01:47 UTC catch-all-suspicious direct GET /appsettings.json burst
2026-06-28 01:47 UTC catch-all-traversal direct GET /proc/self/environ burst
2026-06-28 01:47 UTC catch-all-scan direct GET /.netrc burst
2026-06-28 01:47 UTC catch-all-scan direct GET /.npmrc burst
2026-06-28 01:47 UTC catch-all-scan direct GET /.ssh/id_ed25519 burst
2026-06-28 01:47 UTC catch-all-scan direct GET /.ssh/id_rsa burst
2026-06-28 01:47 UTC catch-all-backup direct GET /data/dump.sql burst
2026-06-28 01:47 UTC backup direct GET /backup/database.sql burst
2026-06-28 01:47 UTC sql-dump direct GET /dump.sql burst
2026-06-28 01:47 UTC catch-all-config direct GET /.htpasswd burst
2026-06-28 01:47 UTC catch-all-suspicious direct GET /app/config/parameters.yml burst
2026-06-28 01:47 UTC catch-all-script direct GET /config/database.php burst
2026-06-28 01:47 UTC catch-all-script direct GET /includes/config.php burst

Recent Indicators

Indicator Type Score Reports Country Last Reported First Seen
102.204.199.143 ip
50
 1 KE 2026-11-11 14:46 UTC 2026-11-11 14:46 UTC
187.153.6.159 ip
50
 1 MX 2026-11-11 14:46 UTC 2026-11-11 14:46 UTC
139.162.184.146 ip
100
 14 DE 2026-11-11 14:46 UTC 2026-11-11 14:46 UTC
94.231.133.222 ip
50
 1 RU 2026-11-11 14:46 UTC 2026-11-11 14:46 UTC
181.67.231.229 ip
50
 1 PE 2026-11-11 14:45 UTC 2026-11-11 14:45 UTC
91.205.199.164 ip
50
 1 AM 2026-11-11 14:44 UTC 2026-11-11 14:44 UTC
45.4.252.109 ip
39
 1 AR 2026-11-11 14:44 UTC 2026-11-11 14:44 UTC
160.20.204.128 ip
50
 1 BR 2026-11-11 14:44 UTC 2026-11-11 14:44 UTC
194.85.210.126 ip
39
 1 RU 2026-11-11 14:44 UTC 2026-11-11 14:44 UTC
181.232.239.238 ip
50
 1 AR 2026-11-11 14:44 UTC 2026-11-11 14:44 UTC
170.245.132.252 ip
50
 1 PY 2026-11-11 14:42 UTC 2026-11-11 14:42 UTC
212.106.74.43 ip
39
 1 PS 2026-11-11 14:41 UTC 2026-11-11 14:41 UTC
202.47.43.14 ip
50
 1 PK 2026-11-11 14:40 UTC 2026-11-11 14:40 UTC
176.32.158.218 ip
50
 1 RU 2026-11-11 14:40 UTC 2026-11-11 14:40 UTC
103.72.3.90 ip
50
 1 PK 2026-11-11 14:39 UTC 2026-11-11 14:39 UTC
41.158.63.234 ip
50
 1 GA 2026-11-11 14:39 UTC 2026-11-11 14:39 UTC
37.114.149.106 ip
50
 1 AZ 2026-11-11 14:38 UTC 2026-11-11 14:38 UTC
190.107.20.154 ip
39
 1 CO 2026-11-11 14:36 UTC 2026-11-11 14:36 UTC
102.206.114.150 ip
39
 1 KE 2026-11-11 14:36 UTC 2026-11-11 14:36 UTC
59.91.30.86 ip
50
 1 IN 2026-11-11 14:35 UTC 2026-11-11 14:35 UTC
187.19.27.196 ip
39
 1 BR 2026-11-11 14:35 UTC 2026-11-11 14:35 UTC
31.31.123.204 ip
88
 3 UA 2026-11-11 14:34 UTC 2026-11-11 14:34 UTC
91.242.149.4 ip
50
 1 ES 2026-11-11 14:34 UTC 2026-11-11 14:34 UTC
102.33.32.66 ip
39
 1 ZA 2026-11-11 14:33 UTC 2026-11-11 14:33 UTC
223.190.86.32 ip
39
 1 IN 2026-11-11 14:33 UTC 2026-11-11 14:33 UTC

Showing 1-25 of 93887 indicators