JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

158.115.254.0

Neutral Activity

Abuse Confidence Score

0% Low Risk

87 reports

43 reporters · latest 5 months ago

ISP: Datacamp Limited
Usage Type: Data Center/Web Hosting/Transit
ASN: AS212238
Domain Name: datacamp.co.uk
Country: 🇳🇱 Netherlands
City: Amsterdam, North Holland

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

No reports in the last 60 days

158.115.254.0 has been reported 87 times. The most recent report is from 5 months ago.

The full history is preserved below and remains searchable. A 0% score reflects the absence of recent activity, but this is not a guarantee that earlier reports were invalid. Abuse confidence score decays, naturally, over time, when the abusive activity stops.

Abuse Reports

Export reports CSV

Total reports

87 from 43 distinct reporters

First reported

February 17th 2026

Most recent report

5 months ago

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇳🇱 homeshowdomain.nl	2026-05-15 22:04:28 UTC · (5 months ago)	Auto-ban: 297 malicious requests on 2026-05-14 (e.g., env/backup probes, brute-force, or error bursts).	Web App Attack SSH Hacking
🇺🇸 xserverx.ru	2026-05-12 14:21:44 UTC · (6 months ago)	Honeypot triggered: IP: 158.115.254.0 Request to: https://xserverx.ru/sftp-config.json Method: GET Host: xserverx.ru User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36 Referer: Direct Cou ... show more Honeypot triggered: IP: 158.115.254.0 Request to: https://xserverx.ru/sftp-config.json Method: GET Host: xserverx.ru User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36 Referer: Direct Country: NL ASN: Unknown Triggered rules: (/sftp-config\.json\|/sftp\.json), (/config\.\|config\.\|/configuration\.)js, (%[a-z0-9]+;\|&#x?[a-f0-9]+;) Timestamp: 2026-05-12T14:21:43.978Z show less	Hacking Bad Web Bot Web App Attack
Anonymous	2026-05-10 06:14:21 UTC · (6 months ago)	(caddyscan) Scanner path probe from 158.115.254.0 (NL/The Netherlands/-): 5 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 404 230 158.115.254.0 - - [10/May/2026:06:14:17 +0000] "GET /sftp-config.json H ... show more (caddyscan) Scanner path probe from 158.115.254.0 (NL/The Netherlands/-): 5 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 404 230 158.115.254.0 - - [10/May/2026:06:14:17 +0000] "GET /sftp-config.json HTTP/1.1" [REDACTED] 404 222 158.115.254.0 - - [10/May/2026:06:14:17 +0000] "GET /sftp-config.json HTTP/1.1" [REDACTED] 404 228 158.115.254.0 - - [10/May/2026:06:14:17 +0000] "GET /.vscode/sftp.json HTTP/1.1" [REDACTED] 404 236 158.115.254.0 - - [10/May/2026:06:14:17 +0000] "GET /.vscode/sftp.json HTTP/1.1" [REDACTED] 200 2627 158.115.254.0 - - [10/May/2026:06:14:17 +0000] "GET /.vscode/sftp.json HTTP/1.1" show less	Port Scan
🇩🇪 FeG Deutschland	2026-05-09 21:11:24 UTC · (6 months ago)	Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 124	Exploited Host Web App Attack
🇮🇳 evicky2002	2026-05-04 06:00:00 UTC · (6 months ago)	Confirmed malicious by STILWaters CTI platform (score=87, sources=1)	Hacking Brute-Force SSH
🇩🇪 FeG Deutschland	2026-05-01 14:44:46 UTC · (6 months ago)	Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 124	Exploited Host Web App Attack
🇺🇸 octageeks.com	2026-04-24 04:23:50 UTC · (6 months ago)	Wordpress malicious attack:[octablocked]	Web App Attack
🇩🇪 Mario Silber	2026-04-23 18:21:40 UTC · (6 months ago)	(mod_security) mod_security triggered on hostname [redacted] 158.115.254.0 (NL/Netherlands/-)	SQL Injection
🇺🇸 TPI-Abuse	2026-04-23 02:17:14 UTC · (6 months ago)	(mod_security) mod_security (id:210492) triggered by 158.115.254.0 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Apr 22 22:17:07.287005 2026] [security2:error] [pid 4338:tid 4338] [client 158.115.254.0:28326] Mod ... show more (mod_security) mod_security (id:210492) triggered by 158.115.254.0 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Apr 22 22:17:07.287005 2026] [security2:error] [pid 4338:tid 4338] [client 158.115.254.0:28326] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "929.us"] [uri "/sftp-config.json"] [unique_id "aemBI9h0pRZT4jKHs0aSbAAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-04-22 09:35:04 UTC · (6 months ago)	(mod_security) mod_security (id:210492) triggered by 158.115.254.0 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Apr 22 05:34:20.360826 2026] [security2:error] [pid 3304:tid 3403] [client 158.115.254.0:34000] Mod ... show more (mod_security) mod_security (id:210492) triggered by 158.115.254.0 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Apr 22 05:34:20.360826 2026] [security2:error] [pid 3304:tid 3403] [client 158.115.254.0:34000] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aafmgcc.com"] [uri "/sftp-config.json"] [unique_id "aeiWHKMszn6EpPmvLWOspAAAAgo"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 masterguru	2026-04-22 08:58:00 UTC · (6 months ago)	Restricted File Access Attempt. Matched phrase "config.json" at REQUEST_FILENAME. (930130-197)	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-04-21 22:27:00 UTC · (6 months ago)	(mod_security) mod_security (id:210492) triggered by 158.115.254.0 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Apr 21 18:26:52.588930 2026] [security2:error] [pid 7461:tid 7461] [client 158.115.254.0:0] ModSecu ... show more (mod_security) mod_security (id:210492) triggered by 158.115.254.0 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Apr 21 18:26:52.588930 2026] [security2:error] [pid 7461:tid 7461] [client 158.115.254.0:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "hvacs-aircon.com"] [uri "/sftp-config.json"] [unique_id "aef5rItJEnVv6FhLzkp1uQAAAAo"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 big-cloud.nl	2026-04-21 04:04:23 UTC · (6 months ago)	Try to access /.vscode/sftp.json	Web App Attack
🇧🇪 madeit	2026-04-17 02:52:54 UTC · (6 months ago)		Web App Attack
🇺🇸 TPI-Abuse	2026-04-15 08:05:44 UTC · (6 months ago)	(mod_security) mod_security (id:210580) triggered by 158.115.254.0 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Apr 15 04:05:39.505513 2026] [security2:error] [pid 2687161:tid 2687161] [client 158.115.254.0:0] M ... show more (mod_security) mod_security (id:210580) triggered by 158.115.254.0 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Apr 15 04:05:39.505513 2026] [security2:error] [pid 2687161:tid 2687161] [client 158.115.254.0:0] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "sftp-config.json" at REQUEST_COOKIES:handl_landing_page. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/08_Global_Other.conf"] [line "57"] [id "210580"] [rev "2"] [msg "COMODO WAF: OS File Access Attempt\|\|nyemdr.com\|F\|2"] [data "Matched Data: sftp-config.json found within REQUEST_COOKIES:handl_landing_page: https:/zmedicalclub.com/sftp-config.json"] [severity "CRITICAL"] [tag "CWAF"] [tag "Other"] [hostname "nyemdr.com"] [uri "/.vscode/sftp.json"] [unique_id "ad9G0x5tCDbiWjqqc7mI3gAAABc"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 87 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇧🇷 205.210.31.225

🇺🇸 195.184.76.226

🇺🇸 195.184.76.172

🇬🇧 193.163.125.28

🇷🇴 193.32.162.15

🇷🇺 188.170.195.104

🇫🇷 185.194.178.9

🇧🇷 177.92.254.238

🇧🇷 172.69.11.136

🇺🇸 146.190.134.221

🇺🇸 91.230.168.234

🇺🇸 91.230.168.96

🇫🇷 91.196.152.22

🇺🇸 66.132.195.125

🇺🇸 65.49.1.172

🇷🇴 2.57.122.150

🇵🇱 2400:cb00:73:1000:e885:6824:d805:55c3

🇺🇸 199.165.159.112

🇺🇸 195.184.76.59

🇫🇷 185.194.178.27