JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 100.42.191.17

100.42.191.17 was found in our database!

This IP was reported 20 times. Confidence of Abuse is 97%: ?

97%

ISP	Contabo GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS51167
Hostname(s)	vmi2327643.contaboserver.net
Domain Name	contabo.com
Country	🇩🇪 Germany
City	Karlsruhe, Baden-Wurttemberg

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 100.42.191.17

Whois 100.42.191.17

IP Abuse Reports for 100.42.191.17:

This IP address has been reported a total of 20 times from 18 distinct sources. 100.42.191.17 was first reported on September 17th 2026, and the most recent report was 9 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇵🇱 Budyn	2026-09-19 23:17:07 (9 hours ago)	Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit ... show more Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit Block. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: 51.83.237.XX \| URI: / \| UA: Mozilla/5.0 \| BODY: [Empty / GET Request] show less	Hacking Web App Attack
Anonymous	2026-09-19 18:58:48 (13 hours ago)	2026-09-19T20:58:47.786620+02:00 vps kernel: [6215125.969738] [PORTSCAN DETECTED] IN=ens3 OUT= MAC=f ... show more 2026-09-19T20:58:47.786620+02:00 vps kernel: [6215125.969738] [PORTSCAN DETECTED] IN=ens3 OUT= MAC=fa:16:3e:66:f6:24:02:37:19:0d:c2:f3:08:00 SRC=100.42.191.17 DST=54.37.14.118 LEN=44 TOS=0x08 PREC=0x20 TTL=240 ID=18866 PROTO=TCP SPT=43878 DPT=8000 WINDOW=1025 RES=0x00 SYN URGP=0 ... show less	Port Scan Brute-Force
Anonymous	2026-09-19 16:30:48 (16 hours ago)	3000/tcp (1 or more attempts)	Port Scan
🇩🇪 ecs.ge	2026-09-19 14:41:10 (17 hours ago)	Automatic Fail2Ban report from jail plesk-modsecurity: multiple matching events detected.	Web App Attack Hacking
🇩🇪 ValtonTahiri	2026-09-19 13:49:11 (18 hours ago)	UFW blocked a suspicious connection attempt to a closed or denied port. This activity is commonly as ... show more UFW blocked a suspicious connection attempt to a closed or denied port. This activity is commonly associated with port scanning, service discovery, or automated internet probing. Technical: source_ip=100.42.191.17; proto=TCP; source_port=45705; target_port=8000; flags=SYN show less	Port Scan
🇬🇧 Andrew	2026-09-19 09:19:20 (23 hours ago)	Blocked by UFW (TCP on port 3000). Source port: 46211 TTL: 245 Packet length: 44 TOS: 0x00 This rep ... show more Blocked by UFW (TCP on port 3000). Source port: 46211 TTL: 245 Packet length: 44 TOS: 0x00 This report (for 100.42.191.17) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
Anonymous	2026-09-19 09:16:21 (23 hours ago)	nginx-444 from fail2ban ...	Web App Attack
Anonymous	2026-09-19 04:46:27 (1 day ago)	Sep 19 00:22:48 localhost kernel: [118136869.645820] iptables_INPUT_denied: IN=eth0 OUT= MAC=f2:3c:9 ... show more Sep 19 00:22:48 localhost kernel: [118136869.645820] iptables_INPUT_denied: IN=eth0 OUT= MAC=f2:3c:91:84:83:95:00:00:0c:9f:f0:1e:08:00 SRC=100.42.191.17 DST=[mungedIP2] LEN=44 TOS=0x00 PREC=0x00 TTL=242 ID=20585 PROTO=TCP SPT=51507 DPT=8443 WINDOW=1025 RES=0x00 SYN URGP=0 Sep 19 00:22:48 localhost kernel: [118136869.645841] iptables_INPUT_denied: IN=eth0 OUT= MAC=f2:3c:91:84:83:95:00:00:0c:9f:f0:1e:08:00 SRC=100.42.191.17 DST=[mungedIP2] LEN=44 TOS=0x00 PREC=0x00 TTL=242 ID=20585 PROTO=TCP SPT=51507 DPT=8443 SEQ=61018348 ACK=0 WINDOW=1025 RES=0x00 SYN URGP=0 OPT (020405B4) Sep 19 00:46:26 localhost kernel: [118138287.486651] iptables_INPUT_denied: IN=eth0 OUT= MAC=f2:3c:91:84:83:95:00:00:0c:9f:f0:1e:08:00 SRC=100.42.191.17 DST=[mungedIP2] LEN=44 TOS=0x00 PREC=0x40 TTL=239 ID=57709 PROTO=TCP SPT=51507 DPT=5678 WINDOW=1025 RES=0x00 SYN URGP=0 Sep 19 00:46:26 localhost kernel: [118138287.486676] iptables_INPUT_denied: IN=eth0 OUT= MAC=f2:3c:91:84:83:95:00:00:0c:9f:f0:1e:08:00 SRC=100.42.191.17 DST=[mungedIP2] show less	Port Scan
Anonymous	2026-09-19 02:02:41 (1 day ago)	IncogNET WAF local CrowdSec decision. Scenario=crowdsecurity/CVE-2017-9841; Action=ban; Events=1; Ho ... show more IncogNET WAF local CrowdSec decision. Scenario=crowdsecurity/CVE-2017-9841; Action=ban; Events=1; Hosts=45.137.198.87:80; Paths=/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php; Country=DE; ASN=51167 Contabo GmbH show less	Hacking Web App Attack
Anonymous	2026-09-19 01:06:26 (1 day ago)	IncogNET WAF local CrowdSec decision. Scenario=crowdsecurity/http-probing; Action=ban; Events=11; Ho ... show more IncogNET WAF local CrowdSec decision. Scenario=crowdsecurity/http-probing; Action=ban; Events=11; Hosts=_; Paths=\x16\x03\x01\x02\x00\x01\x00\x01\xFC\x03\x03'\x9DD\xBD\x0B\x00\x1C+\x1D\x80IR\x030\xBE\xD3\x10=\xFD\xC2\x87\x94U\xFE\x14\xEEY\xBB\xCCs\xF45 \xD1\xED\xBAU\x9F3\x15LR\x10\xC8\x07\x88\xF0<\x91\x14\xE1\xFF=\x15J\x5C\x83\xBB\xAA\x14\xC9\xE5C\x09o\x00>\x13\x02\x13\x03\x13\x01\xC0,\xC00\x00\x9F\xCC\xA9\xCC\xA8\xCC\xAA\xC0+\xC0/\x00\x9E\xC0$\xC0(\x00k\xC0#\xC0'\x00g\xC0,\x16\x03\x01\x02\x00\x01\x00\x01\xFC\x03\x03)\x83\xAF%\x9F\xF6Pr\xCC\x8D\x02\x05w\xEA]\xE0R\xB4\xCB\xFD]K\xE9\x834\xA1\xADw\xB0\xABG\xCE \x19/\xCC\x1Eb_\x06g\xAB`\xAD\xD9\x5C\xD6\xBD\x1B\xB4\xB5Q\x12\xB9\xEE\xD8\xB2SN\xFA\xA8\x0B\x07\x06G\x00>\x13\x02\x13\x03\x13\x01\xC0,\xC00\x00\x9F\xCC\xA9\xCC\xA8\xCC\xAA\xC0+\xC0/\x00\x9E\xC0$\xC0(\x00k\xC0#\xC0'\x00g\xC0,\x16\x03\x01\x02\x00\x01\x00\x01\xFC\x03\x033\xA8\x9A\xAA\xC show less	Port Scan Web App Attack
🇵🇱 Budyn	2026-09-19 00:20:11 (1 day ago)	Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scan ... show more Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: 51.83.237.XX \| URI: /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php \| UA: Mozilla/5.0 \| BODY: [Empty / GET Request] show less	Bad Web Bot Web App Attack
🇩🇪 maxpower	2026-09-18 06:51:16 (2 days ago)	(exploit_critical) REGOLA 2 - Critical File Exploit Attempt 100.42.191.17 (DE/Germany/vmi2327643.con ... show more (exploit_critical) REGOLA 2 - Critical File Exploit Attempt 100.42.191.17 (DE/Germany/vmi2327643.contaboserver.net): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 100.42.191.17 - - [18/Sep/2026:08:51:13 +0200] "POST /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 200 12152 "-" "Mozilla/5.0" "-" host=51.89.75.189 show less	Port Scan
🇧🇪 sid3windr	2026-09-18 04:28:27 (2 days ago)	POST /wp-content/plugins/woocommerce/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php (Tarpitted f ... show more POST /wp-content/plugins/woocommerce/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php (Tarpitted for 2m10s, wasted 7.73kB) show less	Web App Attack
🇫🇷 LRNP	2026-09-18 03:29:46 (2 days ago)	_:8443 100.42.191.17 - - [18/Sep/2026:03:29:45 +0000] "GET /api/kernelspecs HTTP/1.1" 400 248 "-" "M ... show more _:8443 100.42.191.17 - - [18/Sep/2026:03:29:45 +0000] "GET /api/kernelspecs HTTP/1.1" 400 248 "-" "Mozilla/5.0" _:8443 100.42.191.17 - - [18/Sep/2026:03:29:45 +0000] "GET /jupyter/api/kernelspecs HTTP/1.1" 400 248 "-" "Mozilla/5.0" _:8443 100.42.191.17 - - [18/Sep/2026:03:29:45 +0000] "GET /notebook/api/kernelspecs HTTP/1.1" 400 248 "-" "Mozilla/5.0" _:8443 100.42.191.17 - - [18/Sep/2026:03:29:45 +0000] "POST /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 404 146 "-" "Mozilla/5.0" _:8443 100.42.191.17 - - [18/Sep/2026:03:29:45 +0000] "POST /vendor/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 404 146 "-" "Mozilla/5.0" _:8443 100.42.191.17 - - [18/Sep/2026:03:29:45 +0000] "POST /vendor/phpunit/Util/PHP/eval-stdin.php HTTP/1.1" 404 146 "-" "Mozilla/5.0" _:8443 100.42.191.17 - - [18/Sep/2026:03:29:45 +0000] "POST /phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 404 146 "-" "Mozilla/5.0" _:8443 100.42.191.17 - - [18/Sep/2026:03:29:46 +0000] "POST /phpunit/src/Util/PHP/ ... show less	Bad Web Bot Web App Attack
🇳🇱 Savvii	2026-09-18 02:52:10 (2 days ago)	20 attempts against mh-misbehave-ban on pf221103	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 20 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇧🇪 198.235.24.226

🇹🇼 198.235.24.51

🇨🇳 180.153.197.243

🇯🇵 160.16.213.131

🇫🇮 147.185.133.144

🇵🇰 122.129.67.135

🇰🇷 120.29.140.188

🇺🇦 91.223.110.226

🇳🇱 77.239.124.172

🇺🇸 47.143.208.202

🇨🇳 14.103.118.61

🇪🇨 200.24.158.43

🇨🇦 198.245.62.60

🇬🇧 195.140.214.25

🇺🇦 188.163.100.73

🇦🇷 181.12.9.239

🇺🇸 172.233.178.94

🇨🇳 118.183.180.108

🇷🇺 81.177.33.120

🇨🇳 60.208.125.156