SCARD

Suspicious activity by IP address 104.23.170.139

Below is a list of the last 500 suspicious interactions with this IP.

Last observed Fri, 25 Sep 2026 04:54:32 (Australia/Brisbane)

Back to main list

Summary of suspicious activity by IP address 104.23.170.139

Description Count
ET WEB_SPECIFIC_APPS WordPress Plugin Gravity SMTP Unauthenticated REST API (CVE-2026-4020) 6
ET WEB_SERVER WEB-PHP phpinfo access 4
SERVER-WEBAPP PHPUnit PHP remote code execution attempt 4
ET SCAN LeakIX Inbound User-Agent 4
ET WEB_SERVER PHP tags in HTTP POST 4
ET SCAN Suspicious User-Agent Containing Security Scan/ner Likely Scan 4
ET INFO Request for Visual Studio Code sftp.json - Possible Information Leak 1

Detailed activity by IP address 104.23.170.139

Timestamp Description Protocol Destination Port
2026-09-25 04:54:32 ET INFO Request for Visual Studio Code sftp.json - Possible Information Leak TCP 80
2026-08-31 22:12:31 ET WEB_SPECIFIC_APPS WordPress Plugin Gravity SMTP Unauthenticated REST API (CVE-2026-4020) TCP 80
2026-08-31 22:12:31 ET WEB_SPECIFIC_APPS WordPress Plugin Gravity SMTP Unauthenticated REST API (CVE-2026-4020) TCP 80
2026-08-01 20:26:16 ET WEB_SPECIFIC_APPS WordPress Plugin Gravity SMTP Unauthenticated REST API (CVE-2026-4020) TCP 80
2026-08-01 20:26:16 ET WEB_SPECIFIC_APPS WordPress Plugin Gravity SMTP Unauthenticated REST API (CVE-2026-4020) TCP 80
2026-07-06 13:29:20 ET WEB_SPECIFIC_APPS WordPress Plugin Gravity SMTP Unauthenticated REST API (CVE-2026-4020) TCP 80
2026-07-06 13:29:20 ET WEB_SPECIFIC_APPS WordPress Plugin Gravity SMTP Unauthenticated REST API (CVE-2026-4020) TCP 80
2026-06-01 17:21:47 ET WEB_SERVER WEB-PHP phpinfo access TCP 80
2026-06-01 17:21:47 ET WEB_SERVER WEB-PHP phpinfo access TCP 80
2026-05-26 12:38:33 SERVER-WEBAPP PHPUnit PHP remote code execution attempt TCP 80
2026-05-26 12:38:33 ET WEB_SERVER PHP tags in HTTP POST TCP 80
2026-05-26 12:38:32 ET WEB_SERVER PHP tags in HTTP POST TCP 80
2026-05-26 12:38:32 SERVER-WEBAPP PHPUnit PHP remote code execution attempt TCP 80
2026-05-26 11:37:34 ET WEB_SERVER PHP tags in HTTP POST TCP 80
2026-05-26 11:37:34 SERVER-WEBAPP PHPUnit PHP remote code execution attempt TCP 80
2026-05-26 11:37:34 SERVER-WEBAPP PHPUnit PHP remote code execution attempt TCP 80
2026-05-26 11:37:34 ET WEB_SERVER PHP tags in HTTP POST TCP 80
2026-04-27 03:06:14 ET SCAN Suspicious User-Agent Containing Security Scan/ner Likely Scan TCP 80
2026-04-27 03:06:14 ET SCAN Suspicious User-Agent Containing Security Scan/ner Likely Scan TCP 80
2026-04-26 11:15:23 ET SCAN Suspicious User-Agent Containing Security Scan/ner Likely Scan TCP 80
2026-04-26 11:15:22 ET SCAN Suspicious User-Agent Containing Security Scan/ner Likely Scan TCP 80
2026-04-26 10:14:56 ET WEB_SERVER WEB-PHP phpinfo access TCP 80
2026-04-26 10:14:56 ET WEB_SERVER WEB-PHP phpinfo access TCP 80
2026-04-07 14:16:48 ET SCAN LeakIX Inbound User-Agent TCP 80
2026-04-07 14:16:48 ET SCAN LeakIX Inbound User-Agent TCP 80
2026-04-07 13:16:04 ET SCAN LeakIX Inbound User-Agent TCP 80
2026-04-07 13:16:04 ET SCAN LeakIX Inbound User-Agent TCP 80

 

Back to top