This IP address has been reported a total of
86
times from
34 distinct
sources.
154.198.49.45 was first reported on
, and the most recent report was
.
In the last 60 days, the top reporter locations were:
United States of America
with 23
reports;
Germany
with 13
reports;
Ukraine
with 7
reports.
The most common categories in these recent reports were:
Web App Attack
56
times;
Hacking
39
times;
Bad Web Bot
27
times;
SQL Injection
19
times;
Brute-Force
13
times;
Other
29
times.
Recent Reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Blocked by https://aegis.hr — Web Shell / Command Injection - (MITRE T1059), 2 attempts, Period: 202 ...
show moreBlocked by https://aegis.hr — Web Shell / Command Injection - (MITRE T1059), 2 attempts, Period: 2026-10-05 11:41:27 to 2026-10-05 11:41:31
show less
[SatOct0302:55:14.9958962026][security2:error][pid1562779:tid1562792][client154.198.49.45:0]ModSecur ...
show more[SatOct0302:55:14.9958962026][security2:error][pid1562779:tid1562792][client154.198.49.45:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?:\\\\\\\\\(chr\?\\\\\\\\\(\?[0-9]{1\,3}\?\\\\\\\\\)\|\?=\?f\(\?:open\|write\)\?\\\\\\\\\(\|\\\\\\\\b\(\?:passthru\|serialize\|php_uname\|phpinfo\|shell_exec\|preg_\\\\\\\\w \|mysql_query\|exec\|eval\|create_function\|base64_decode\|decode_base64\|rot13\|base64_url_decode\|gz\(\?:inflate\|decode\|uncompress\)\|strrev\|z...\"atARGS:s.[file\"/etc/apache2/conf.d/modsec_rules/10_asl_rules.conf\"][line\"734\"][id\"340095\"][rev\"54\"][msg\"Atomicorp.comWAFRules:AttackBlocked-PHPfunctioninArgument-thismaybeanattack.\"][data\"base64_decode\(\,ARGS:s\"][severity\"CRITICAL\"][hostname\"fisioterapiafalzone.ch\"][uri\"/\"][unique_id\"asBSclFmPvsHWZx2M94n6AAAAEo\"]\,referer:http://fisioterapiafalzone.ch/\?p=/\
show less
IPBlock protected site ID [669-fx].
Exploit request, vulnerability probe.
Hacking
Bad Web Bot
Web App Attack
Anonymous
Automatically blocked after 1 security event. Observed repeated web application attack probes. Sourc ...
show moreAutomatically blocked after 1 security event. Observed repeated web application attack probes. Source: Cloudflare security controls.
show less
Source IP: 154.198.49.45 (HK/Antbox Networks Limited). Web application attack detected by OWASP CRS ...
show moreSource IP: 154.198.49.45 (HK/Antbox Networks Limited). Web application attack detected by OWASP CRS (PHP injection). Attack observed 2026-10-03T10:01:33+10:00.
show less
Triggered Cloudflare WAF (firewallCustom) from HK.
Action taken: BLOCK
Protocol: HTTP/1.1 (GET metho ...
show moreTriggered Cloudflare WAF (firewallCustom) from HK.
Action taken: BLOCK
Protocol: HTTP/1.1 (GET method)
Endpoint: /
UA: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
HTTP application-layer DoS / botnet traffic from 154.198.49.45: repeated high-cost dynamic page and ...
show moreHTTP application-layer DoS / botnet traffic from 154.198.49.45: repeated high-cost dynamic page and feed requests (profile/tag views, forums, tracker, RSS) at abusive rates via completed TCP/HTTPS. Likely compromised end-user host.
show less
