JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 154.208.58.95

154.208.58.95 was found in our database!

This IP was reported 40 times. Confidence of Abuse is 53%: ?

53%

ISP	IN CABLE INTERNET PRIVATE LIMITED
Usage Type	Fixed Line ISP
ASN	AS150750
Domain Name	incableinternet.com
Country	🇵🇰 Pakistan
City	Lahore, Punjab

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 154.208.58.95

Whois 154.208.58.95

IP Abuse Reports for 154.208.58.95:

This IP address has been reported a total of 40 times from 25 distinct sources. 154.208.58.95 was first reported on November 20th 2025, and the most recent report was 9 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 RAP	2026-09-23 00:17:48 (9 hours ago)	2026-09-23 00:17:48 UTC Unauthorized activity to TCP port 22. SSH	SSH
Anonymous	2026-09-23 00:14:34 (9 hours ago)	denied traffic to a honeypot network. destination port 23.	Port Scan Hacking
🇫🇷 vtchost.com	2026-09-22 22:28:30 (10 hours ago)	portscan on honeypot system ...	Port Scan
🇺🇸 TPI-Abuse	2026-09-17 16:14:30 (5 days ago)	(mod_security) mod_security (id:210350) triggered by 154.208.58.95 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210350) triggered by 154.208.58.95 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Sep 17 12:14:24.199716 2026] [security2:error] [pid 7093:tid 7093] [client 154.208.58.95:35882] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|mmaccaux.com\|F\|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "mmaccaux.com"] [uri "/"] [unique_id "aqwR4BVUx4l5rRSYI-mWDAAAABA"], referer: https://bulkbacklinkreport.store/dir/ethical-seo-backlinks-138333 show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 gui-ying233	2026-09-07 22:04:14 (2 weeks ago)	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Sa ... show more Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36 show less	Bad Web Bot
Anonymous	2026-08-29 04:26:02 (3 weeks ago)	WEB attack	Brute-Force
🇺🇸 gui-ying233	2026-08-27 15:08:57 (3 weeks ago)	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Sa ... show more Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 show less	Bad Web Bot
🇺🇸 kosada.com	2026-08-27 03:02:38 (3 weeks ago)	Web bot: denial-of-service flood	DDoS Attack Bad Web Bot
🇫🇷 Zkillu	2026-08-19 22:26:26 (1 month ago)	UDP flood (DDoS) vs AS215599: 1745 pkts / 2.5 MB to UDP 80/8443 across 436 dst IP(s), 2026-08-19 21: ... show more UDP flood (DDoS) vs AS215599: 1745 pkts / 2.5 MB to UDP 80/8443 across 436 dst IP(s), 2026-08-19 21:46 to 2026-08-20 00:36 CEST. No legitimate service on these UDP ports (7-day baseline 0 GB/day). Carpet-bombing of a /24, likely botnet-compromised host. Evidence: sFlow + hardware ACL counters. show less	DDoS Attack Exploited Host
🇫🇷 dmallet	2026-08-19 22:26:26 (1 month ago)	UDP flood (DDoS) vs AS215599: 1745 pkts / 2.5 MB to UDP 80/8443 across 436 dst IP(s), 2026-08-19 21: ... show more UDP flood (DDoS) vs AS215599: 1745 pkts / 2.5 MB to UDP 80/8443 across 436 dst IP(s), 2026-08-19 21:46 to 2026-08-20 00:36 CEST. No legitimate service on these UDP ports (7-day baseline 0 GB/day). Carpet-bombing of a /24, likely botnet-compromised host. Evidence: sFlow + hardware ACL counters. show less	DDoS Attack Exploited Host
🇮🇩 sockominfo	2026-08-17 13:00:59 (1 month ago)	Zimbra: Login failures from malicious IP: 154.208.58.95. Threat Score: 6.3/10 (MEDIUM). Confidence: ... show more Zimbra: Login failures from malicious IP: 154.208.58.95. Threat Score: 6.3/10 (MEDIUM). Confidence: 40%. CVSS v3.1: 4.6/10 (Medium). CVSS Vector: CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L. Bayesian Probability: 76%. MITRE ATT&CK: T1083 (File and Directory Discovery). Tactic: TA0001. Freshness: Fresh. Source Reputation: UNKNOWN. Methodology: CVSS 3.1 + Bayesian + Temporal + Environmental + MITRE ATT&CK + OWASP. Standards: ISO/IEC 27065:2022, NIST SP 800-30, IEEE S&P 2020. Reported by TangerangKota-CSIRT. Status: MALICIOUS show less	Hacking Web App Attack
🇮🇩 sockominfo	2026-08-17 12:00:09 (1 month ago)	Zimbra: Login failures from malicious IP: 154.208.58.95. Threat Score: 6/10 (MEDIUM). Reported by Ta ... show more Zimbra: Login failures from malicious IP: 154.208.58.95. Threat Score: 6/10 (MEDIUM). Reported by TangerangKota-CSIRT show less	Hacking Web App Attack
Anonymous	2026-08-14 01:41:07 (1 month ago)	denied Telnet access attempt. destination port 23.	Port Scan Brute-Force
🇺🇸 sumnone	2026-08-14 01:22:26 (1 month ago)	Port probing on unauthorized port 23	Port Scan Hacking Exploited Host
🇺🇸 MPL	2026-07-30 22:56:00 (1 month ago)	tcp/23	Port Scan

Showing 1 to 15 of 40 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 2001:470:1:fb5:3a41:ef61:4654:c6ea

🇻🇳 171.244.39.95

🇲🇽 148.245.1.106

🇭🇰 85.137.242.4

🇩🇪 69.5.169.184

🇨🇳 47.109.134.2

🇸🇬 47.82.201.223

🇳🇱 45.148.10.157

🇳🇬 41.219.149.74

🇺🇸 2001:470:1:fb5::291

🇧🇷 189.45.26.196

🇧🇷 177.22.173.226

🇨🇮 160.155.16.199

🇨🇳 117.34.85.168

🇺🇸 71.6.239.68

🇸🇬 47.82.201.6

🇳🇱 45.148.10.151

🇺🇸 35.245.62.24

🇮🇩 34.50.66.48

🇺🇸 2001:470:2cc:1::80