JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

158.173.36.124

Activity Trending Down

Abuse Confidence Score

38% Elevated

125 reports

54 reporters · latest 1 week ago

ISP: VPN Consumer Barcelona, Spain
Usage Type: Data Center/Web Hosting/Transit
ASN: AS9009
Domain Name: vpnconsumer.com
Country: 🇪🇸 Spain
City: Barcelona, Catalonia

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Example preview

Account required for the enhanced features Log in Sign up

Abuse Reports

Export reports CSV

Total reports

125 from 54 distinct reporters

First reported

October 1st 2025

Most recent report

1 week ago

Last 60 days

Top reporter locations 🇺🇸 United States of America 11 🇬🇧 United Kingdom of Great Britain and Northern Ireland 3 🇩🇪 Germany 2

Most common categories Web App Attack 19 Bad Web Bot 15 Brute-Force 14 Hacking 5 Port Scan 1

Old reports The most recent abuse report for this IP address is from 1 week ago. It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇬🇧 thetomtaylor.co.uk	2026-10-30 08:07:59 UTC · (1 week ago)	Fail2Ban - [WEB]Custom exploit pattern detected on customexploits ... [ice01,ice02,wa01,wa02]	Hacking Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-10-30 07:42:53 UTC · (1 week ago)	WordPress login / xmlrpc probing across multiple sites	Web App Attack
🇺🇸 TPI-Abuse	2026-10-22 15:10:07 UTC · (2 weeks ago)	(mod_security) mod_security (id:210492) triggered by 158.173.36.124 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 22 11:10:02.040757 2026] [security2:error] [pid 8458:tid 8458] [client 158.173.36.124:42427] M ... show more (mod_security) mod_security (id:210492) triggered by 158.173.36.124 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 22 11:10:02.040757 2026] [security2:error] [pid 8458:tid 8458] [client 158.173.36.124:42427] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "flicra140.org"] [uri "/.env"] [unique_id "atonSl1oxLAqIeVVZi0uggAAACA"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-10-22 14:25:29 UTC · (2 weeks ago)	(mod_security) mod_security (id:210492) triggered by 158.173.36.124 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 22 10:25:25.735279 2026] [security2:error] [pid 28294:tid 28294] [client 158.173.36.124:42075] ... show more (mod_security) mod_security (id:210492) triggered by 158.173.36.124 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 22 10:25:25.735279 2026] [security2:error] [pid 28294:tid 28294] [client 158.173.36.124:42075] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "darkmysteries.biz"] [uri "/.env"] [unique_id "atoc1W17bpwsm7jp6UqPeQAAAC0"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-10-22 13:54:42 UTC · (2 weeks ago)	(mod_security) mod_security (id:210492) triggered by 158.173.36.124 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 22 09:54:36.756633 2026] [security2:error] [pid 5443:tid 5443] [client 158.173.36.124:61679] M ... show more (mod_security) mod_security (id:210492) triggered by 158.173.36.124 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 22 09:54:36.756633 2026] [security2:error] [pid 5443:tid 5443] [client 158.173.36.124:61679] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "97201.com"] [uri "/.env"] [unique_id "atoVnBRGCCLElCB1cZr18gAAAAo"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-10-22 12:38:03 UTC · (2 weeks ago)	(mod_security) mod_security (id:210492) triggered by 158.173.36.124 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 22 08:37:58.938169 2026] [security2:error] [pid 1146:tid 1146] [client 158.173.36.124:58523] M ... show more (mod_security) mod_security (id:210492) triggered by 158.173.36.124 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 22 08:37:58.938169 2026] [security2:error] [pid 1146:tid 1146] [client 158.173.36.124:58523] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "wpcoc.org"] [uri "/.env"] [unique_id "atoDpk2wr8znCFhSTAr1IAAAABk"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-10-22 11:55:20 UTC · (2 weeks ago)	(mod_security) mod_security (id:210492) triggered by 158.173.36.124 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 22 07:55:17.617088 2026] [security2:error] [pid 16895:tid 16895] [client 158.173.36.124:55905] ... show more (mod_security) mod_security (id:210492) triggered by 158.173.36.124 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 22 07:55:17.617088 2026] [security2:error] [pid 16895:tid 16895] [client 158.173.36.124:55905] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "nutandboltguy.com"] [uri "/.env"] [unique_id "atn5pdrV-xIWJGsyYKTWvgAAAA0"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-10-22 10:15:10 UTC · (2 weeks ago)	Probing for exposed secret / credential files	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-10-22 09:34:39 UTC · (2 weeks ago)	(mod_security) mod_security (id:210492) triggered by 158.173.36.124 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 22 05:34:35.825798 2026] [security2:error] [pid 19531:tid 19572] [client 158.173.36.124:47811] ... show more (mod_security) mod_security (id:210492) triggered by 158.173.36.124 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 22 05:34:35.825798 2026] [security2:error] [pid 19531:tid 19572] [client 158.173.36.124:47811] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "runawaydixie.com"] [uri "/.env"] [unique_id "atnYq5EgqnlsvNT_IurEIgAAAM4"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-10-22 04:42:03 UTC · (2 weeks ago)	(mod_security) mod_security (id:210492) triggered by 158.173.36.124 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 22 00:41:55.355885 2026] [security2:error] [pid 14888:tid 14888] [client 158.173.36.124:58505] ... show more (mod_security) mod_security (id:210492) triggered by 158.173.36.124 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 22 00:41:55.355885 2026] [security2:error] [pid 14888:tid 14888] [client 158.173.36.124:58505] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "obramaq.cl"] [uri "/.env"] [unique_id "atmUE3lP4EWvQ0-jtfzekAAAABs"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-10-22 00:12:44 UTC · (2 weeks ago)	(mod_security) mod_security (id:210492) triggered by 158.173.36.124 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 21 20:12:37.791434 2026] [security2:error] [pid 8617:tid 8643] [client 158.173.36.124:51321] M ... show more (mod_security) mod_security (id:210492) triggered by 158.173.36.124 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 21 20:12:37.791434 2026] [security2:error] [pid 8617:tid 8643] [client 158.173.36.124:51321] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "pref-realestate.com"] [uri "/.env"] [unique_id "atlU9YS3mxcfHvbpjU4vngAAAFY"] show less	Brute-Force Bad Web Bot Web App Attack
🇧🇪 cmbplf	2026-10-19 05:38:35 UTC · (3 weeks ago)	215 requests with url.path /.well-known/acme-challenge/.php	Brute-Force Bad Web Bot
Anonymous	2026-10-18 20:56:04 UTC · (3 weeks ago)	apache vulnerability scan	Web App Attack
🇺🇸 TPI-Abuse	2026-10-11 19:21:59 UTC · (4 weeks ago)	(mod_security) mod_security (id:210492) triggered by 158.173.36.124 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 11 15:21:55.778615 2026] [security2:error] [pid 6258:tid 6258] [client 158.173.36.124:30387] M ... show more (mod_security) mod_security (id:210492) triggered by 158.173.36.124 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 11 15:21:55.778615 2026] [security2:error] [pid 6258:tid 6258] [client 158.173.36.124:30387] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "carolynedds.com"] [uri "/.env"] [unique_id "asvh08Nnu5s6b8xUutlH9gAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-10-11 18:18:16 UTC · (4 weeks ago)	(mod_security) mod_security (id:210492) triggered by 158.173.36.124 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 11 14:18:13.191434 2026] [security2:error] [pid 25711:tid 25711] [client 158.173.36.124:53385] ... show more (mod_security) mod_security (id:210492) triggered by 158.173.36.124 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 11 14:18:13.191434 2026] [security2:error] [pid 25711:tid 25711] [client 158.173.36.124:53385] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "sendera.mx"] [uri "/.env"] [unique_id "asvS5YG8FyCNyztKFtdwBwAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 125 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇸🇬 2a13:f42:7a17:12a6:ce3f:269b:6f17:3f91

🇺🇸 98.174.37.185

🇳🇱 204.76.203.214

🇬🇧 154.16.44.235

🇬🇧 154.16.44.32

🇫🇮 147.185.133.26

🇩🇪 77.243.89.140

🇺🇸 20.118.235.40

🇬🇧 5.252.83.16

🇬🇧 2.57.17.240

🇺🇸 208.85.10.241

🇺🇸 199.165.159.129

🇸🇬 188.166.247.152

🇳🇱 109.160.32.173

🇭🇰 119.28.84.193

🇰🇷 115.160.76.23

🇧🇩 103.41.244.48

🇳🇱 86.38.187.179

🇳🇱 85.11.167.7

🇺🇸 70.167.235.62