JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

154.161.56.96

Neutral Activity

Abuse Confidence Score

0% Low Risk

42 reports

19 reporters · latest 5 months ago

ISP: Scancom Limited
Usage Type: Mobile ISP
ASN: AS30986
Domain Name: scancom.eu
Country: 🇬🇭 Ghana
City: Accra, Greater Accra

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

No reports in the last 60 days

154.161.56.96 has been reported 42 times. The most recent report is from 5 months ago.

The full history is preserved below and remains searchable. A 0% score reflects the absence of recent activity, but this is not a guarantee that earlier reports were invalid. Abuse confidence score decays, naturally, over time, when the abusive activity stops.

Abuse Reports

Export reports CSV

Total reports

42 from 19 distinct reporters

First reported

May 9th 2026

Most recent report

5 months ago

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇮🇳 evicky2002	2026-05-14 06:00:00 UTC · (5 months ago)	Confirmed malicious by STILWaters CTI platform (score=100, sources=1)	Hacking Brute-Force SSH
🇳🇱 homeshowdomain.nl	2026-05-10 22:00:43 UTC · (5 months ago)	Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-05-09.	Web App Attack SSH Hacking
Anonymous	2026-05-10 20:20:31 UTC · (5 months ago)	Fuzzing/Looking for credentials files.	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-05-10 16:59:22 UTC · (5 months ago)	(mod_security) mod_security (id:210492) triggered by 154.161.56.96 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 10 12:59:16.682349 2026] [security2:error] [pid 28375:tid 28375] [client 154.161.56.96:26708] M ... show more (mod_security) mod_security (id:210492) triggered by 154.161.56.96 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 10 12:59:16.682349 2026] [security2:error] [pid 28375:tid 28375] [client 154.161.56.96:26708] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "juniperhills.net"] [uri "/.env"] [unique_id "agC5ZIx63DPzrMm5f_e60QAAAA8"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 CBJ	2026-05-10 16:31:23 UTC · (5 months ago)	fail2ban: apache-filepath-recon ...	Web App Attack
🇳🇿 Tripwire	2026-05-10 12:24:53 UTC · (5 months ago)	Scanning for exploits - /.env	Web App Attack
🇺🇸 TPI-Abuse	2026-05-10 11:43:47 UTC · (5 months ago)	(mod_security) mod_security (id:210492) triggered by 154.161.56.96 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 10 07:43:42.026207 2026] [security2:error] [pid 11352:tid 11352] [client 154.161.56.96:50424] M ... show more (mod_security) mod_security (id:210492) triggered by 154.161.56.96 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 10 07:43:42.026207 2026] [security2:error] [pid 11352:tid 11352] [client 154.161.56.96:50424] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "jmnr.net"] [uri "/.env"] [unique_id "agBvbipHqIoWTjJGWxHyEAAAABw"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-05-10 11:15:02 UTC · (5 months ago)	Bot / scanning and/or hacking attempts: GET /.env HTTP/1.1	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-05-10 10:42:37 UTC · (5 months ago)	(mod_security) mod_security (id:210492) triggered by 154.161.56.96 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 10 06:42:32.780071 2026] [security2:error] [pid 30676:tid 30676] [client 154.161.56.96:53433] M ... show more (mod_security) mod_security (id:210492) triggered by 154.161.56.96 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 10 06:42:32.780071 2026] [security2:error] [pid 30676:tid 30676] [client 154.161.56.96:53433] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "juca.com.mx"] [uri "/.env"] [unique_id "agBhGNxImg-wn7EoOiZwSQAAAAQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-10 09:15:26 UTC · (5 months ago)	(mod_security) mod_security (id:210492) triggered by 154.161.56.96 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 10 05:15:21.208655 2026] [security2:error] [pid 30106:tid 30106] [client 154.161.56.96:28695] M ... show more (mod_security) mod_security (id:210492) triggered by 154.161.56.96 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 10 05:15:21.208655 2026] [security2:error] [pid 30106:tid 30106] [client 154.161.56.96:28695] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "judgehall.com"] [uri "/.env"] [unique_id "agBMqfah5p1NqdOkkpkO1gAAABc"] show less	Brute-Force Bad Web Bot Web App Attack
🇯🇵 ki3	2026-05-09 22:43:28 UTC · (5 months ago)	Fail2Ban: Web App Attacks and Forum Spam 154.161.56.96 1778366607.5112555(JST)	Web Spam Bad Web Bot Web App Attack
🇳🇱 homeshowdomain.nl	2026-05-09 21:59:05 UTC · (5 months ago)	Auto-ban: >3000 req/min op 2026-05-09	Web App Attack SSH Hacking
🇺🇸 TPI-Abuse	2026-05-09 20:41:28 UTC · (6 months ago)	(mod_security) mod_security (id:210492) triggered by 154.161.56.96 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 09 16:41:25.488335 2026] [security2:error] [pid 22914:tid 22914] [client 154.161.56.96:58740] M ... show more (mod_security) mod_security (id:210492) triggered by 154.161.56.96 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 09 16:41:25.488335 2026] [security2:error] [pid 22914:tid 22914] [client 154.161.56.96:58740] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "jpfamilyllc.com"] [uri "/.env"] [unique_id "af-b9bk2MH6bPkac5sqh9AAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 mnsf	2026-05-09 20:05:21 UTC · (6 months ago)	Scanning/Probing (12)	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-05-09 19:52:54 UTC · (6 months ago)	(mod_security) mod_security (id:210492) triggered by 154.161.56.96 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 09 15:52:47.756387 2026] [security2:error] [pid 10372:tid 10372] [client 154.161.56.96:9144] Mo ... show more (mod_security) mod_security (id:210492) triggered by 154.161.56.96 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 09 15:52:47.756387 2026] [security2:error] [pid 10372:tid 10372] [client 154.161.56.96:9144] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "joycebrown.com"] [uri "/.env"] [unique_id "af-Qj5hQzU6lDMvT7vKmTAAAAB0"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 42 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇳🇱 77.239.124.68

🇨🇳 221.15.4.164

🇸🇬 188.166.218.214

🇺🇸 129.121.115.165

🇺🇸 91.230.168.124

🇳🇱 45.148.10.152

🇳🇱 45.148.10.141

🇨🇳 42.192.1.50

🇧🇪 34.140.194.215

🇹🇼 34.81.70.193

🇳🇱 204.76.203.221

🇷🇺 176.109.110.102

🇭🇰 154.92.2.59

🇹🇼 110.25.110.133

🇳🇱 109.160.32.118

🇨🇳 101.89.141.184

🇺🇸 91.230.168.126

🇺🇸 57.141.20.71

🇮🇩 36.95.221.140

🇬🇧 35.203.211.237