JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

191.96.94.243

Neutral Activity

Abuse Confidence Score

0% Low Risk

43 reports

23 reporters · latest 8 months ago

ISP: freakhosting.com
Usage Type: Data Center/Web Hosting/Transit
ASN: AS215703
Domain Name: freakhosting.com
Country: 🇩🇪 Germany
City: Frankfurt am Main, Hesse

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

No reports in the last 60 days

191.96.94.243 has been reported 43 times. The most recent report is from 8 months ago.

The full history is preserved below and remains searchable. A 0% score reflects the absence of recent activity, but this is not a guarantee that earlier reports were invalid. Abuse confidence score decays, naturally, over time, when the abusive activity stops.

Abuse Reports

Export reports CSV

Total reports

43 from 23 distinct reporters

First reported

February 19th 2026

Most recent report

8 months ago

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇳🇱 ConsulHosting	2026-02-27 09:28:16 UTC · (8 months ago)	Excessive failed CAPTCHA attempts (CAPTCHA DoS)	Web App Attack
🇬🇧 Smish	2026-02-27 04:12:25 UTC · (8 months ago)	HONEYPOT HIT --> Fail2ban time=1772165544 log=2026-02-27T04:12:24+00:00 ip=191.96.94.243 host=as210667.net method=GET uri="/.env.save" status=404 ua="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Sa ... show more HONEYPOT HIT --> Fail2ban time=1772165544 log=2026-02-27T04:12:24+00:00 ip=191.96.94.243 host=as210667.net method=GET uri="/.env.save" status=404 ua="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36" ref="-" rid=86e735b4118d8e69a158447bcd7bf6c0 show less	Web App Attack
🇳🇱 Savvii	2026-02-27 03:25:36 UTC · (8 months ago)	20 attempts against mh-misbehave-ban on ec102950	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-02-27 02:56:12 UTC · (8 months ago)	Bot / seems abusive / Apache connections: 32	DDoS Attack Web Spam Bad Web Bot Web App Attack
🇧🇪 cmbplf	2026-02-27 02:26:58 UTC · (8 months ago)	141 requests with url.path *.env	Brute-Force Bad Web Bot
🇺🇸 TPI-Abuse	2026-02-27 01:47:59 UTC · (8 months ago)	(mod_security) mod_security (id:210492) triggered by 191.96.94.243 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Feb 26 20:47:54.915751 2026] [security2:error] [pid 31622:tid 31622] [client 191.96.94.243:36528] M ... show more (mod_security) mod_security (id:210492) triggered by 191.96.94.243 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Feb 26 20:47:54.915751 2026] [security2:error] [pid 31622:tid 31622] [client 191.96.94.243:36528] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "arlan-associates.com"] [uri "/.env.bak"] [unique_id "aaD3yoJCTvkEtQxXP3KwvQAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-02-27 01:28:28 UTC · (8 months ago)	(mod_security) mod_security (id:210492) triggered by 191.96.94.243 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Feb 26 20:28:24.123377 2026] [security2:error] [pid 22968:tid 22976] [client 191.96.94.243:42268] M ... show more (mod_security) mod_security (id:210492) triggered by 191.96.94.243 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Feb 26 20:28:24.123377 2026] [security2:error] [pid 22968:tid 22976] [client 191.96.94.243:42268] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "arizonasolutionsgroup.com"] [uri "/.env.save"] [unique_id "aaDzOL4YKGfxCCuKvhnqOQAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 Savvii	2026-02-27 01:00:17 UTC · (8 months ago)	20 attempts against mh_ha-misbehave-ban on pyrus	Brute-Force Bad Web Bot Web App Attack
🇦🇺 aranguren.org	2026-02-26 23:39:52 UTC · (8 months ago)	191.96.94.243 - - [27/Feb/2026:10:39:51 +1100] "GET /.env HTTP/1.1" 404 985 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36" 191.96.94.243 - - [27/Feb/2026:10:39:51 +1100] "GET /.en ... show more 191.96.94.243 - - [27/Feb/2026:10:39:51 +1100] "GET /.env HTTP/1.1" 404 985 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36" 191.96.94.243 - - [27/Feb/2026:10:39:51 +1100] "GET /.env.bak HTTP/1.1" 404 985 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36" 191.96.94.243 - - [27/Feb/2026:10:39:51 +1100] "GET /.env.old HTTP/1.1" 404 985 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36" 191.96.94.243 - - [27/Feb/2026:10:39:51 +1100] "GET /.env.save HTTP/1.1" 404 985 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36" 191.96.94.243 - - [27/Feb/2026:10:39:51 +1100] "GET /.env.example HTTP/1.1" 404 985 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36" 191.96.94 ... show less	Bad Web Bot
🇺🇸 ANTI SCANNER	2026-02-26 19:09:17 UTC · (8 months ago)	Scanner : /.env.old	Web Spam
Anonymous	2026-02-26 17:05:43 UTC · (8 months ago)	Blocked: Reason='Vulnerability probing — PHP scan detected (17/60 min)'; Requests=17	Port Scan
🇮🇹 alph44	2026-02-26 17:05:20 UTC · (8 months ago)	(mod_security) mod_security (id:949110) triggered by 191.96.94.243 (DE/Germany/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_MODSEC; Logs:	Web App Attack
🇫🇮 as211431.net	2026-02-26 16:49:45 UTC · (8 months ago)	Triggered Cloudflare WAF (firewallCustom) from DE. Action taken: MANAGED_CHALLENGE Protocol: HTTP/1.1 (GET method) Endpoint: /upgrade.php UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537 ... show more Triggered Cloudflare WAF (firewallCustom) from DE. Action taken: MANAGED_CHALLENGE Protocol: HTTP/1.1 (GET method) Endpoint: /upgrade.php UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36 This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
🇨🇦 Dunham Support	2026-02-26 13:27:38 UTC · (8 months ago)	(mod_security) mod_security triggered on hostname [redacted] 191.96.94.243 (DE/Germany/-)	SQL Injection
🇮🇹 LTM	2026-02-26 07:20:01 UTC · (8 months ago)	WebServer - Attempts to exploit	Hacking Brute-Force Web App Attack

Showing 1 to 15 of 43 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇺🇦 193.194.108.164

🇰🇷 106.244.120.37

🇺🇸 66.132.172.179

🇳🇱 45.148.10.40

🇺🇸 2604:a940:301:225:0:1a::

🇺🇸 2602:80d:1007::33

🇳🇱 195.178.110.132

🇵🇱 172.64.198.64

🇵🇱 172.64.198.28

🇺🇸 162.216.149.180

🇵🇱 162.158.103.204

🇨🇳 119.164.146.0

🇺🇦 91.242.55.171

🇺🇸 66.240.223.208

🇿🇦 41.242.160.139

🇳🇱 193.47.62.81

🇬🇪 185.228.133.66

🇨🇳 183.215.74.2

🇺🇸 172.111.39.21

🇵🇱 172.64.198.196