JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

167.86.80.238

Neutral Activity

Abuse Confidence Score

0% Low Risk

214 reports

135 reporters · latest 2 months ago

ISP: Contabo GmbH
Usage Type: Data Center/Web Hosting/Transit
ASN: AS51167
Hostname(s): vmi3566120.contaboserver.net
Domain Name: contabo.com
Country: 🇩🇪 Germany
City: Karlsruhe, Baden-Wurttemberg

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

No reports in the last 60 days

167.86.80.238 has been reported 214 times. The most recent report is from 2 months ago.

The full history is preserved below and remains searchable. A 0% score reflects the absence of recent activity, but this is not a guarantee that earlier reports were invalid. Abuse confidence score decays, naturally, over time, when the abusive activity stops.

Abuse Reports

Export reports CSV

Total reports

214 from 135 distinct reporters

First reported

June 29th 2026

Most recent report

2 months ago

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 febrian.de	2026-06-30 23:08:22 UTC · (4 months ago)	Malicious HTTP(S) probing detected by Fail2Ban	Web App Attack
🇦🇺 nzhost.co.nz	2026-06-30 23:03:39 UTC · (4 months ago)	$f2bV_matches	Hacking Brute-Force
🇺🇸 oralunal	2026-06-30 22:51:24 UTC · (4 months ago)	IP banned by Fail2Ban in jail its-suss access.log mvfnds ...	Bad Web Bot Web App Attack
🇳🇱 Site.eu	2026-06-30 22:41:38 UTC · (4 months ago)	Excessive multi-domain requests	Brute-Force
🇺🇸 chronos	2026-06-30 22:40:48 UTC · (4 months ago)	[AUTORAVALT][[30/06/2026 - 19:40:48 -03:00 UTC] Attack from [RIPE Network Coordination Centre] [167.86.80.238][smtp.vhost.store] Action: BLocKed Hacking... Unauthorized attempts to access the server. Web App Attack -> Attempts to probe for or explo ... show more [AUTORAVALT][[30/06/2026 - 19:40:48 -03:00 UTC] Attack from [RIPE Network Coordination Centre] [167.86.80.238][smtp.vhost.store] Action: BLocKed Hacking... Unauthorized attempts to access the server. Web App Attack -> Attempts to probe for or exploit installed web applications such as a CMS like WordPress/Drupal, e-commerce solutions, forum software, phpMyAdm] ... show less	Hacking Web App Attack
🇩🇪 macrob	2026-06-30 22:34:11 UTC · (4 months ago)	2026/06/30 22:34:09 [error] 720044#720044: 341665540 access forbidden by rule, client: 167.86.80.238, server: ca5h.win, request: "GET /.env.defaults HTTP/1.1", host: "ca5h.win" 2026/06/30 22:34:09 [error] 720044#720044: 341665541 access forbidden b ... show more 2026/06/30 22:34:09 [error] 720044#720044: 341665540 access forbidden by rule, client: 167.86.80.238, server: ca5h.win, request: "GET /.env.defaults HTTP/1.1", host: "ca5h.win" 2026/06/30 22:34:09 [error] 720044#720044: 341665541 access forbidden by rule, client: 167.86.80.238, server: ca5h.win, request: "GET /.env.development.sample HTTP/1.1", host: "ca5h.win" 2026/06/30 22:34:09 [error] 720044#720044: *341665542 access forbidden by rule, client: 167.86.80.238, server: ca5h.win, request: "GET /.env.bak HTTP/1.1", host: "ca5h.win" ... show less	Web App Attack
🇩🇪 itsolon	2026-06-30 21:43:12 UTC · (4 months ago)	[30/Jun/2026:23:43:12 +0200] 178285579263.160012 167.86.80.238 0 217.154.7.177 443 [30/Jun/2026:23:43:12 +0200] 178285579223.004558 167.86.80.238 0 217.154.7.177 443 [30/Jun/2026:23:43:12 +0200] 178285579280.962390 167.86.80.238 0 217.154.7.177 443 [ ... show more [30/Jun/2026:23:43:12 +0200] 178285579263.160012 167.86.80.238 0 217.154.7.177 443 [30/Jun/2026:23:43:12 +0200] 178285579223.004558 167.86.80.238 0 217.154.7.177 443 [30/Jun/2026:23:43:12 +0200] 178285579280.962390 167.86.80.238 0 217.154.7.177 443 [30/Jun/2026:23:43:12 +0200] 178285579296.007379 167.86.80.238 0 217.154.7.177 443 [30/Jun/2026:23:43:12 +0200] 178285579224.691026 167.86.80.238 0 217.154.7.177 443 ... show less	Port Scan Hacking Brute-Force Web App Attack
🇺🇸 Lee Daniel	2026-06-30 21:16:31 UTC · (4 months ago)	167.86.80.238 - - [30/Jun/2026:17:16:30 -0400] "GET /.env HTTP/1.1" 403 6327 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" ...	DDoS Attack Web Spam Email Spam Port Scan Brute-Force Bad Web Bot Web App Attack
🇩🇪 Séfora Srl	2026-06-30 21:02:23 UTC · (4 months ago)	Failed attempt detected by Fail2Ban in recidive jail	Brute-Force
🇺🇸 Victor López	2026-06-30 20:26:39 UTC · (4 months ago)	lavadodepisosbogota.com 167.86.80.238 - - [30/Jun/2026:15:26:38 -0500] "GET /.env.bak HTTP/1.1" 404 46027 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:126.0) Gecko/20100101 Firefox/126.0" lavadodepisosbogota.com 167.86.80.238 - - [30/Jun/2026:15 ... show more lavadodepisosbogota.com 167.86.80.238 - - [30/Jun/2026:15:26:38 -0500] "GET /.env.bak HTTP/1.1" 404 46027 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:126.0) Gecko/20100101 Firefox/126.0" lavadodepisosbogota.com 167.86.80.238 - - [30/Jun/2026:15:26:38 -0500] "GET /.env.bak.1 HTTP/1.1" 404 46017 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36" lavadodepisosbogota.com 167.86.80.238 - - [30/Jun/2026:15:26:38 -0500] "GET /.env.caprover HTTP/1.1" 404 46027 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" ... show less	Hacking Web App Attack
🇪🇸 alferez	2026-06-30 20:26:23 UTC · (4 months ago)	Searching .(env\|sql\|zip\|tar\|rar) files	Hacking Exploited Host Web App Attack
Anonymous	2026-06-30 20:05:33 UTC · (4 months ago)	167.86.80.238 - - [30/Jun/2026:20:05:33 +0000] "GET /.env HTTP/1.1" 302 487 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 Edg/125.0.0.0" ...	Bad Web Bot Web App Attack
🇩🇪 SwinT	2026-06-30 20:00:04 UTC · (4 months ago)	WAF repeated trigger detected by Fail2Ban in plesk-modsecurity jail	Web App Attack
Anonymous	2026-06-30 19:57:11 UTC · (4 months ago)	Ports: *; Direction: 0; Trigger: CT_LIMIT	Brute-Force SSH
🇺🇸 TPI-Abuse	2026-06-30 19:49:09 UTC · (4 months ago)	(mod_security) mod_security (id:210492) triggered by 167.86.80.238 (smtp.vhost.store): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 30 15:49:05.046462 2026] [security2:error] [pid 7454:tid 7454] [client 167.86.80 ... show more (mod_security) mod_security (id:210492) triggered by 167.86.80.238 (smtp.vhost.store): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 30 15:49:05.046462 2026] [security2:error] [pid 7454:tid 7454] [client 167.86.80.238:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "nyemdr.org"] [uri "/.env.coolify"] [unique_id "akQdsYE1nGfTnk7aIncoqQAAAAw"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 121 to 135 of 214 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇺🇸 162.216.149.208

🇨🇭 34.65.103.91

🇿🇦 4.168.232.22

🇰🇪 197.254.98.154

🇦🇷 181.29.144.225

🇭🇳 154.12.110.179

🇰🇷 125.246.95.152

🇸🇬 104.28.222.46

🇳🇱 86.38.187.185

🇷🇺 85.93.45.33

🇳🇱 77.67.26.220

🇦🇪 2.50.33.181

🇭🇰 223.197.146.169

🇧🇪 198.235.24.141

🇬🇧 193.149.187.183

🇺🇸 192.101.65.111

🇺🇸 162.216.150.6

🇵🇱 162.158.102.202

🇵🇱 162.158.102.154

🇫🇮 147.185.133.216