Report for IP: 104.251.180.58

Suricata detected this IP scanning database ports (MySQL, PostgreSQL, Redis, MongoDB). This is reconnaissance to find exposed database services for direct exploitation or credential brute-force. Database ports should never be reachable from the internet.

This IP requested a .env file (or a variant like .env.local, .env.production) — files that commonly contain database credentials, API keys, and other secrets for a web application. No legitimate visitor ever requests this path; it is exclusively probed by attackers hunting for leaked configuration.

This IP requested the /.git/config file, attempting to access an accidentally exposed Git repository's configuration — often containing remote repository URLs, and sometimes credentials embedded in them. No legitimate client ever requests this path.

This IP was blocked attempting to log into a WordPress site's wp-login.php — either from a disallowed country or after exceeding the allowed number of failed login attempts. Automated credential-stuffing and brute-force tools account for the overwhelming majority of this traffic; legitimate users rarely trigger a hard IP block on login alone.

This IP requested a root-level project or infrastructure file — docker-compose.yml, a Terraform state file, package.json, or a generic config/secrets.json — hunting for source code, deployment secrets, or infrastructure details accidentally left reachable over HTTP. No legitimate web visitor needs these.

This IP is on the Spamhaus DROP list — a dataset of netblocks hijacked or leased by professional spam and cybercrime operations with no legitimate users. Traffic from DROP-listed ranges is considered hostile by design. Blocking is unconditional.

Suricata intrusion detection flagged this IP for malicious network behaviour — including port scanning, exploit attempts, botnet activity, or known attack signatures. The specific signature is shown in the report list below.