JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 23.154.136.246

23.154.136.246 was found in our database!

This IP was reported 21 times. Confidence of Abuse is 100%: ?

100%

ISP	GTHost
Usage Type	Data Center/Web Hosting/Transit
ASN	AS63023
Hostname(s)	246-136-154-23.clients.gthost.com
Domain Name	gthost.com
Country	🇺🇸 United States of America
City	Washington, District of Columbia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 23.154.136.246

Whois 23.154.136.246

IP Abuse Reports for 23.154.136.246:

This IP address has been reported a total of 21 times from 18 distinct sources. 23.154.136.246 was first reported on July 30th 2026, and the most recent report was 21 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇨🇦 polycoda	2026-07-30 18:17:28 (21 hours ago)	📄 Probes for tons of inexistent files and/or PHP scripts	Hacking Web App Attack
Anonymous	2026-07-30 15:52:25 (23 hours ago)	Reported from Nginx log analysis 6. Log: 23.154.136.246 - - [30/Jul/2026:xx:xx:xx 0200] "GET /admin ... show more Reported from Nginx log analysis 6. Log: 23.154.136.246 - - [30/Jul/2026:xx:xx:xx 0200] "GET /admin/data/system/cluster.dat HTTP/1.1" xxx xxx "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:128.0) Gecko/20100101 Firefox/128.0" "-" "US United States Washington" "AS63023" "GTHost" show less	Port Scan Brute-Force SSH
🇺🇸 rdpguard.com	2026-07-30 13:25:12 (1 day ago)	RdpGuard detected brute-force attempt on HTTP	Brute-Force
🇬🇧 Mendip_Defender	2026-07-30 13:21:18 (1 day ago)	[30/Jul/2026:14:21:20.929771 +0100] amtP0GOh_G5AHVty0YIblgAAABQ 23.154.136.246 52540 188.246.206.60 ... show more [30/Jul/2026:14:21:20.929771 +0100] amtP0GOh_G5AHVty0YIblgAAABQ 23.154.136.246 52540 188.246.206.60 7081 [30/Jul/2026:14:21:21.180433 +0100] amtP0WOh_G5AHVty0YIblwAAAAI 23.154.136.246 52542 188.246.206.60 7081 ... show less	Brute-Force
🇩🇪 Admins@FBN	2026-07-30 13:20:48 (1 day ago)	FW-PortScan: Traffic Blocked srcport=29266 dstport=443	Port Scan
🇦🇺 aranguren.org	2026-07-30 13:20:07 (1 day ago)	23.154.136.246 - - [30/Jul/2026:22:19:15 +1000] "GET /admin/data/system/cluster.dat HTTP/1.1" 404 11 ... show more 23.154.136.246 - - [30/Jul/2026:22:19:15 +1000] "GET /admin/data/system/cluster.dat HTTP/1.1" 404 1180 "https://ns3.aranguren.org/admin/data/system/cluster.dat" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:128.0) Gecko/20100101 Firefox/128.0" 23.154.136.246 - - [30/Jul/2026:22:19:17 +1000] "GET /htdocs/admin/data/system/cluster.dat HTTP/1.1" 404 1194 "https://ns3.aranguren.org/htdocs/admin/data/system/cluster.dat" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:128.0) Gecko/20100101 Firefox/128.0" 23.154.136.246 - - [30/Jul/2026:22:48:49 +1000] "GET /admin/data/system/cluster.dat HTTP/1.1" 404 985 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:128.0) Gecko/20100101 Firefox/128.0" 23.154.136.246 - - [30/Jul/2026:22:48:49 +1000] "GET /htdocs/admin/data/system/cluster.dat HTTP/1.1" 404 985 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:128.0) Gecko/20100101 Firefox/128.0" 23.154.136.246 - - [30/Jul/2026:23:19:57 +1000] "GET /htdocs/admin/data/system/cluster.dat HTTP/1.1" 404 1202 "ht ... show less	Bad Web Bot
🇮🇹 VHosting	2026-07-30 13:20:06 (1 day ago)	Detected WordPress attack from 4 different servers	Brute-Force Web App Attack
🇻🇳 trung.fun	2026-07-30 13:16:35 (1 day ago)	DDoS, Hack, Brute Force, Web Attack ...	DDoS Attack Web Spam Hacking Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-07-30 13:14:34 (1 day ago)	(mod_security) mod_security (id:210730) triggered by 23.154.136.246 (246-136-154-23.clients.gthost.c ... show more (mod_security) mod_security (id:210730) triggered by 23.154.136.246 (246-136-154-23.clients.gthost.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 30 09:14:29.159688 2026] [security2:error] [pid 1249420:tid 1249420] [client 23.154.136.246:61894] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|web50.dnchosting.com\|F\|2"] [data ".dat"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "web50.dnchosting.com"] [uri "/admin/data/system/cluster.dat"] [unique_id "amtONXbORiTsv9PDl6BLuAAAAB0"] show less	Brute-Force Bad Web Bot Web App Attack
🇮🇩 bps-statistics	2026-07-30 13:03:37 (1 day ago)	Web Application Attacks	Web App Attack
🇺🇸 TPI-Abuse	2026-07-30 12:52:26 (1 day ago)	(mod_security) mod_security (id:210730) triggered by 23.154.136.246 (246-136-154-23.clients.gthost.c ... show more (mod_security) mod_security (id:210730) triggered by 23.154.136.246 (246-136-154-23.clients.gthost.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 30 08:52:18.881597 2026] [security2:error] [pid 4076129:tid 4076129] [client 23.154.136.246:21996] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|www.renjunews.renju.net\|F\|2"] [data ".dat"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.renjunews.renju.net"] [uri "/admin/data/system/cluster.dat"] [unique_id "amtJAnlzGo3TTGJQgk46ugAAAAo"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 kkeyser	2026-07-30 12:47:30 (1 day ago)	GET /admin/data/system/cluster.dat HTTP/1.1	Web App Attack
🇺🇸 TPI-Abuse	2026-07-30 12:32:06 (1 day ago)	(mod_security) mod_security (id:210730) triggered by 23.154.136.246 (246-136-154-23.clients.gthost.c ... show more (mod_security) mod_security (id:210730) triggered by 23.154.136.246 (246-136-154-23.clients.gthost.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 30 08:31:57.935260 2026] [security2:error] [pid 1453448:tid 1453448] [client 23.154.136.246:30898] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|web37.dnchosting.com\|F\|2"] [data ".dat"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "web37.dnchosting.com"] [uri "/admin/data/system/cluster.dat"] [unique_id "amtEPa60GqV2oEMB4OtN0wAAAA0"] show less	Brute-Force Bad Web Bot Web App Attack
🇮🇹 Inartis	2026-07-30 12:30:28 (1 day ago)	23.154.136.246 - - [30/Jul/2026:14:30:28 +0200] "GET /admin/data/system/cluster.dat HTTP/1.1" 404 51 ... show more 23.154.136.246 - - [30/Jul/2026:14:30:28 +0200] "GET /admin/data/system/cluster.dat HTTP/1.1" 404 5124 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:128.0) Gecko/20100101 Firefox/128.0" ... show less	Brute-Force Bad Web Bot Web App Attack
🇮🇩 Burayot	2026-07-30 12:26:49 (1 day ago)	LF_MODSEC: (mod_security) mod_security (id:949110) triggered by 23.154.136.246 (US/United States/246 ... show more LF_MODSEC: (mod_security) mod_security (id:949110) triggered by 23.154.136.246 (US/United States/246-136-154-23.clients.gthost.com): 1 in the last 3600 secs show less	Web App Attack

Showing 1 to 15 of 21 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 162.216.150.3

🇸🇦 145.82.111.39

🇧🇬 104.28.60.15

🇮🇩 103.97.101.25

🇳🇱 77.239.124.242

🇺🇸 70.120.203.193

🇫🇷 54.38.180.48

🇬🇧 35.203.211.107

🇰🇷 222.239.251.12

🇩🇪 213.209.159.241

🇦🇿 185.146.113.87

🇮🇹 185.15.171.51

🇧🇴 181.115.171.216

🇺🇸 136.0.105.188

🇳🇬 105.113.16.109

🇺🇸 64.62.156.60

🇮🇹 31.13.138.139

🇷🇴 2.57.121.25

🇳🇱 213.176.26.74

🇧🇩 202.72.236.208