IP and domain reputation lookup

BadBot Gateway scores IP addresses and domains by the abuse that BadBot's own honeypot sensors catch, such as scanners, brute-force bots and exploit probes, with recent activity counting most. Search an indicator for its score, report history and categories, or download the high-risk feeds; how the sensor network works is explained at badbot.net.

Reputation 203.159.90.15 ip

Score
100
/100
raw: 654.68
Reports
69
Last Reported
2026-11-09 23:14 UTC
Categories
Config Exposure Probe (49) Scanning (16) API Probe (4)

Network details

ASN
210558
Organization
1337 Services GmbH
Country
NL

Threat Intelligence enriched 2026-11-09 23:13 UTC

Reverse DNS
203.159.90.15.powered.by.rdp.sh
DNSBL Status
Listed
zen.spamhaus.org

Sensor Activity last 20 events

Time (UTC) Trap Signal Method Path Flags
2026-11-09 23:14 UTC git-probe direct GET /.git/logs/HEAD burst
2026-11-09 23:14 UTC git-probe direct GET /.git/logs/HEAD burst
2026-11-09 23:14 UTC catch-all-config direct GET /.git-credentials burst
2026-11-09 23:13 UTC catch-all-config direct GET /.git-credentials burst
2026-11-09 23:13 UTC wp-config-backup direct GET /wp-config.php.bak burst
2026-11-09 23:13 UTC catch-all-script direct GET /phpinfo.php burst
2026-11-09 23:13 UTC svn-probe direct GET /.svn/entries burst
2026-11-09 23:13 UTC catch-all-suspicious direct GET /config.json burst
2026-11-09 23:13 UTC iac-secrets direct GET /terraform.tfstate burst
2026-11-09 23:13 UTC git-head direct GET /.git/HEAD burst
2026-11-09 23:13 UTC actuator direct GET /actuator/env burst
2026-11-09 23:13 UTC aws-creds direct GET /.aws/credentials burst
2026-11-09 23:13 UTC dot-env direct GET /.env burst
2026-11-09 23:13 UTC catch-all-scan direct GET /aws-exports.js burst
2026-11-09 23:13 UTC catch-all-suspicious direct GET /credentials.json burst
2026-11-09 23:13 UTC git-config direct GET /.git/config burst
2026-11-09 23:13 UTC ds-store direct GET /.DS_Store burst
2026-11-09 23:13 UTC catch-all-config direct GET /.env.local burst
2026-11-09 23:13 UTC catch-all-config direct GET /.env.backup burst
2026-11-09 23:13 UTC catch-all-config direct GET /.env.production burst

Recent Indicators

Indicator Type Score Reports Country Last Reported First Seen
189.242.239.218 ip
50
 1 MX 2026-11-10 00:12 UTC 2026-11-10 00:12 UTC
45.143.28.229 ip
50
 1 IQ 2026-11-10 00:12 UTC 2026-11-10 00:12 UTC
181.78.20.19 ip
50
 1 CO 2026-11-10 00:11 UTC 2026-11-10 00:11 UTC
170.84.172.64 ip
50
 1 PY 2026-11-10 00:11 UTC 2026-11-10 00:11 UTC
189.149.5.206 ip
50
 1 MX 2026-11-10 00:10 UTC 2026-11-10 00:10 UTC
177.221.210.153 ip
50
 1 BR 2026-11-10 00:08 UTC 2026-11-10 00:08 UTC
120.231.164.60 ip
50
 1 CN 2026-11-10 00:08 UTC 2026-11-10 00:08 UTC
170.246.209.134 ip
50
 1 BR 2026-11-10 00:08 UTC 2026-11-10 00:08 UTC
181.172.62.182 ip
50
 1 CL 2026-11-10 00:06 UTC 2026-11-10 00:06 UTC
176.105.222.222 ip
50
 1 UA 2026-11-10 00:06 UTC 2026-11-10 00:06 UTC
91.196.254.39 ip
50
 1 RU 2026-11-10 00:05 UTC 2026-11-10 00:05 UTC
143.244.54.11 ip
100
 176 RO 2026-11-10 00:06 UTC 2026-11-10 00:04 UTC
82.86.93.15 ip
50
 1 VE 2026-11-10 00:04 UTC 2026-11-10 00:04 UTC
194.106.196.60 ip
50
 1 RU 2026-11-10 00:03 UTC 2026-11-10 00:03 UTC
91.209.24.230 ip
50
 1 UA 2026-11-10 00:03 UTC 2026-11-10 00:03 UTC
213.230.92.72 ip
50
 1 UZ 2026-11-10 00:02 UTC 2026-11-10 00:02 UTC
91.243.21.91 ip
50
 1 UA 2026-11-10 00:02 UTC 2026-11-10 00:02 UTC
181.172.194.8 ip
50
 1 CL 2026-11-10 00:01 UTC 2026-11-10 00:01 UTC
213.172.147.225 ip
50
 1 ZA 2026-11-10 00:01 UTC 2026-11-10 00:01 UTC
201.224.101.62 ip
50
 1 PA 2026-11-10 00:00 UTC 2026-11-10 00:00 UTC
45.179.54.113 ip
50
 1 AR 2026-11-10 00:00 UTC 2026-11-10 00:00 UTC
5.38.115.7 ip
50
 1 AE 2026-11-10 00:00 UTC 2026-11-10 00:00 UTC
102.64.222.146 ip
50
 1 TG 2026-11-10 00:00 UTC 2026-11-10 00:00 UTC
213.232.77.19 ip
50
 1 ES 2026-11-09 23:59 UTC 2026-11-09 23:59 UTC
176.151.227.158 ip
50
 1 FR 2026-11-09 23:57 UTC 2026-11-09 23:57 UTC

Showing 1-25 of 91109 indicators