JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

104.245.243.54

Activity Trending Down

Abuse Confidence Score

19% Caution

11 reports

6 reporters · latest 2 weeks ago

ISP: VitalKey
Usage Type: Data Center/Web Hosting/Transit
ASN: AS213954
Domain Name: vitalkey.io
Country: 🇫🇮 Finland
City: Helsinki, Uusimaa

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Example preview

Account required for the enhanced features Log in Sign up

Abuse Reports

Export reports CSV

Total reports

11 from 6 distinct reporters

First reported

April 27th 2026

Most recent report

2 weeks ago

Last 60 days

Top reporter locations 🇺🇸 United States of America 3 🇫🇷 France 1 🇬🇧 United Kingdom of Great Britain and Northern Ireland 1

Most common categories Brute-Force 2 Port Scan 2 SSH 1 Bad Web Bot 1 Web App Attack 1

Old reports The most recent abuse report for this IP address is from 2 weeks ago. It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-10-23 13:39:17 UTC · (2 weeks ago)	(mod_security) mod_security (id:210350) triggered by 104.245.243.54 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 23 09:39:10.909757 2026] [security2:error] [pid 8478:tid 8478] [client 104.245.243.54:15321] M ... show more (mod_security) mod_security (id:210350) triggered by 104.245.243.54 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 23 09:39:10.909757 2026] [security2:error] [pid 8478:tid 8478] [client 104.245.243.54:15321] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|james.ahlstrom.name\|F\|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "james.ahlstrom.name"] [uri "/exciter/index.html"] [unique_id "attjfmRAXvxnXc6lfLYOOwAAABQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇬🇧 sandra361	2026-10-05 14:12:31 UTC · (1 month ago)	Port scan detected: 10 attempts across 1 port (50000). \| Evidence: REAPER_TARPIT: IN=enp1s0f0 SRC=104.245.243.54 LEN=40 TOS=0x00 PREC=0x00 TTL=113 ID=61435 DF PROTO=TCP SPT=15293 DPT=50000 WINDOW=42340 RES=0x00 ACK FIN URGP=0	Port Scan
🇺🇸 drewf.ink	2026-10-03 07:28:29 UTC · (1 month ago)	[07:28] Port scanning. Port(s) scanned: TCP/50000	Port Scan
🇺🇸 thefuzz4	2026-09-30 03:15:29 UTC · (1 month ago)	SSH tarpit (endlessh): 2 unsolicited connection(s) to port 22, held 1 minute(s). Automated report.	Brute-Force SSH
🇫🇷 masterguru	2026-09-23 12:48:33 UTC · (1 month ago)	(modsec_5015) ModSec 5015: Suspicious User-Agent from 104.245.243.54 (UA/Ukraine/-): 1 in the last 3600 secs (0-195)	Hacking
Anonymous	2026-05-22 01:25:59 UTC · (5 months ago)	Forum/form spam	Web Spam
🇺🇸 TPI-Abuse	2026-05-01 05:48:14 UTC · (6 months ago)	(mod_security) mod_security (id:210730) triggered by 104.245.243.54 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 01 01:48:06.210618 2026] [security2:error] [pid 14023:tid 14023] [client 104.245.243.54:58535] ... show more (mod_security) mod_security (id:210730) triggered by 104.245.243.54 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 01 01:48:06.210618 2026] [security2:error] [pid 14023:tid 14023] [client 104.245.243.54:58535] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|scadainthecloud.motioncontrolpartners.com\|F\|2"] [data ".ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "scadainthecloud.motioncontrolpartners.com"] [uri "/s3cmd.ini"] [unique_id "afQ-loaAeGXt5xtHOw4lPgAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-04-29 09:32:13 UTC · (6 months ago)	(mod_security) mod_security (id:210730) triggered by 104.245.243.54 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Apr 29 05:31:59.513225 2026] [security2:error] [pid 17358:tid 17358] [client 104.245.243.54:28527] ... show more (mod_security) mod_security (id:210730) triggered by 104.245.243.54 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Apr 29 05:31:59.513225 2026] [security2:error] [pid 17358:tid 17358] [client 104.245.243.54:28527] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|www.hkaida.com\|F\|2"] [data ".ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.hkaida.com"] [uri "/s3cmd.ini"] [unique_id "afHQD_UVUlNxoOw9JBBd8gAAAA0"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-04-28 06:54:51 UTC · (6 months ago)	(mod_security) mod_security (id:210730) triggered by 104.245.243.54 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Apr 28 02:54:43.195026 2026] [security2:error] [pid 31650:tid 31650] [client 104.245.243.54:24865] ... show more (mod_security) mod_security (id:210730) triggered by 104.245.243.54 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Apr 28 02:54:43.195026 2026] [security2:error] [pid 31650:tid 31650] [client 104.245.243.54:24865] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|www.kentsmithfamily.com\|F\|2"] [data ".ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.kentsmithfamily.com"] [uri "/s3cmd.ini"] [unique_id "afBZs4D64T57D59G721arQAAAA4"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-04-27 13:49:51 UTC · (6 months ago)	(mod_security) mod_security (id:210730) triggered by 104.245.243.54 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Apr 27 09:49:42.458396 2026] [security2:error] [pid 27907:tid 27907] [client 104.245.243.54:34979] ... show more (mod_security) mod_security (id:210730) triggered by 104.245.243.54 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Apr 27 09:49:42.458396 2026] [security2:error] [pid 27907:tid 27907] [client 104.245.243.54:34979] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|www.gemexpressions.com\|F\|2"] [data ".ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.gemexpressions.com"] [uri "/s3cmd.ini"] [unique_id "ae9pdhwzzB01giKrowQO2gAAAA4"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-04-27 07:49:54 UTC · (6 months ago)	(mod_security) mod_security (id:210730) triggered by 104.245.243.54 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Apr 27 03:49:45.807016 2026] [security2:error] [pid 31144:tid 31144] [client 104.245.243.54:56827] ... show more (mod_security) mod_security (id:210730) triggered by 104.245.243.54 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Apr 27 03:49:45.807016 2026] [security2:error] [pid 31144:tid 31144] [client 104.245.243.54:56827] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|www.corchard.net\|F\|2"] [data ".ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.corchard.net"] [uri "/s3cmd.ini"] [unique_id "ae8VGc3ZWlbUwMrw4f8uYgAAADA"] show less	Brute-Force Bad Web Bot Web App Attack

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇮🇪 80.233.59.13

🇺🇸 35.185.45.14

🇺🇸 216.73.217.138

🇵🇦 190.218.107.109

🇵🇰 149.40.194.49

🇵🇭 138.84.93.37

🇳🇱 109.160.32.134

🇺🇦 91.214.139.147

🇨🇦 68.148.248.30

🇺🇸 68.67.112.95

🇺🇸 51.241.159.70

🇮🇹 45.142.132.9

🇵🇪 38.25.83.136

🇧🇪 35.206.163.40

🇳🇱 34.6.174.215

🇺🇸 15.181.3.246

🇳🇱 213.209.159.242

🇲🇦 197.153.121.161

🇨🇳 182.138.158.77

🇺🇸 173.252.70.35