JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

154.16.105.164

Recent Activity

Abuse Confidence Score

100% Critical

127 reports

76 reporters · latest 3 days ago

ISP: FREEDOMTECH SOLUTIONS LIMITED
Usage Type: Data Center/Web Hosting/Transit
ASN: AS9009
Domain Name: netutil.io
Country: 🇺🇸 United States of America
City: Los Angeles, California

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Example preview

Account required for the enhanced features Log in Sign up

Abuse Reports

Export reports CSV

Total reports

127 from 76 distinct reporters

First reported

May 6th 2022

Most recent report

3 days ago

Last 60 days

Top reporter locations 🇺🇸 United States of America 31 🇩🇪 Germany 10 🇫🇷 France 6

Most common categories Web App Attack 59 Bad Web Bot 29 Brute-Force 19 Hacking 13 Port Scan 7

Recent reports We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇭🇺 kranem	2026-11-03 15:01:11 UTC · (3 days ago)	Triggered Cloudflare WAF from US. Action taken: BLOCK ASN: 9009 (M247 Europe SRL) Protocol: HTTP/1.1 (GET method) Endpoint: / Timestamp: 2026-11-03T13:49:02Z User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77 ... show more Triggered Cloudflare WAF from US. Action taken: BLOCK ASN: 9009 (M247 Europe SRL) Protocol: HTTP/1.1 (GET method) Endpoint: / Timestamp: 2026-11-03T13:49:02Z User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0 show less	Bad Web Bot
🇺🇸 TPI-Abuse	2026-11-03 14:44:47 UTC · (3 days ago)	(mod_security) mod_security (id:210492) triggered by 154.16.105.164 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 09:44:42.857238 2026] [security2:error] [pid 19918:tid 19918] [client 154.16.105.164:51993] ... show more (mod_security) mod_security (id:210492) triggered by 154.16.105.164 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 09:44:42.857238 2026] [security2:error] [pid 19918:tid 19918] [client 154.16.105.164:51993] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "worshipconcert.com"] [uri "/.env"] [unique_id "aunzWriZgfGpnKGK2GoHBwAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 j-tap	2026-11-03 14:17:41 UTC · (3 days ago)	WordPress honeypot: automated scanner (xmlrpc / installer / .env / direct login POST)	Web App Attack
🇩🇪 conseilgouz	2026-11-03 12:44:25 UTC · (3 days ago)	gie-17 : Block hidden directories=>/.env(/)	Hacking
🇬🇧 neo101	2026-11-03 12:28:23 UTC · (3 days ago)	Secret Hunting & Credential Harvesting: Automated scanner (Nuclei (Secret Hunter)) probed decoy secrets path '/.env'. Served AI System Override decoy payload as counter-measure.	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-11-03 12:16:38 UTC · (3 days ago)	(mod_security) mod_security (id:210492) triggered by 154.16.105.164 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 07:16:33.274591 2026] [security2:error] [pid 29198:tid 29198] [client 154.16.105.164:0] Mod ... show more (mod_security) mod_security (id:210492) triggered by 154.16.105.164 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 07:16:33.274591 2026] [security2:error] [pid 29198:tid 29198] [client 154.16.105.164:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "jspsf.com"] [uri "/.env"] [unique_id "aunQoZvYWGUm6yXkQ1T8EgAAAAo"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 its101	2026-11-03 12:15:11 UTC · (3 days ago)	Automated detection by LockdownAccess security system. Attack type(s): env_grab. Reason: Nginx: env_grab attack. Path targeted: unknown. Blocked in Cloudflare.	Web App Attack
🇵🇱 MatStef132	2026-11-03 11:42:28 UTC · (3 days ago)	MatShield L7: blocked on a protected site (secret-path-probe)	DDoS Attack
🇦🇺 Klaverstyn	2026-11-03 10:44:41 UTC · (3 days ago)	Repeated 403 Forbidden responses	Web App Attack
🇺🇸 TPI-Abuse	2026-11-03 09:53:41 UTC · (3 days ago)	(mod_security) mod_security (id:210492) triggered by 154.16.105.164 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 04:53:33.843107 2026] [security2:error] [pid 20717:tid 20717] [client 154.16.105.164:21989] ... show more (mod_security) mod_security (id:210492) triggered by 154.16.105.164 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 04:53:33.843107 2026] [security2:error] [pid 20717:tid 20717] [client 154.16.105.164:21989] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ticmatopografiaeingenieria.com"] [uri "/.env"] [unique_id "aumvHWdCBgI1_tOnXwN_8AAAABM"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 Mangelot Hosting	2026-11-03 09:50:07 UTC · (3 days ago)	(web_sensitive_file) srv101 Sensitive file probe (.env/.git/backup) 154.16.105.164 (US/United States/-): 2 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs:	Web App Attack
🇺🇸 ambor	2026-11-03 09:44:15 UTC · (3 days ago)	Honeypot triggered: /.env on ifebridge.com. User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0. Method: GET	Web App Attack
🇫🇷 cityhunter_rhone	2026-11-03 09:35:05 UTC · (3 days ago)	Mercurius trap auto report \| source=APACHE_DENIED_AGGREGATE \| last_seen=2026-11-03 10:31:54 \| hits_403=1 \| hits_404=0 \| ip=154.16.105.164 \| sample_uri=/intro.php	Port Scan Hacking Web App Attack
🇫🇷 Baking333	2026-11-03 09:25:19 UTC · (3 days ago)	[redacted] 154.16.105.164 - - [03/Nov/2026:10:25:17 +0100] "GET /.env HTTP/2.0" 301 291 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0" [redacted] 154.16.105.164 - - [03/Nov/2026:10:25:17 +0100] "GET /fr/.env/ ... show more [redacted] 154.16.105.164 - - [03/Nov/2026:10:25:17 +0100] "GET /.env HTTP/2.0" 301 291 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0" [redacted] 154.16.105.164 - - [03/Nov/2026:10:25:17 +0100] "GET /fr/.env/ HTTP/2.0" 404 34803 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0" show less	Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-11-03 08:57:23 UTC · (3 days ago)	(mod_security) mod_security (id:210492) triggered by 154.16.105.164 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 03:57:18.716374 2026] [security2:error] [pid 30208:tid 30208] [client 154.16.105.164:0] Mod ... show more (mod_security) mod_security (id:210492) triggered by 154.16.105.164 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 03:57:18.716374 2026] [security2:error] [pid 30208:tid 30208] [client 154.16.105.164:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ndanetworks.com"] [uri "/.env"] [unique_id "aumh7tZdlXQ-jUmmBhf6xQAAAAc"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 127 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇺🇸 205.169.39.43

🇳🇱 77.239.124.74

🇨🇳 58.212.234.82

🇽🇰 46.99.134.176

🇳🇱 45.148.10.233

🇰🇷 43.155.219.48

🇨🇴 38.225.62.2

🇺🇸 20.163.35.255

🇺🇸 20.12.243.187

🇺🇸 216.73.161.82

🇰🇬 212.112.126.245

🇦🇷 200.59.127.144

🇺🇸 199.165.159.169

🇧🇪 198.235.24.220

🇬🇧 195.206.182.199

🇺🇸 167.172.119.27

🇺🇸 156.239.148.105

🇺🇸 152.32.236.102

🇧🇷 152.32.200.22

🇸🇦 149.104.94.47