JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

45.61.96.38

Neutral Activity

Abuse confidence score ?

0% Low Risk

31 reports

9 reporters · latest 3 months ago

ISP	HostRoyale LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS46516
Hostname(s)	ip-45-61-96-38.fibre.fibrestream.ca
Domain Name	hostroyale.com
Country	🇺🇸 United States of America
City	Leesburg, Virginia

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

No reports in the last 60 days

45.61.96.38 has been reported 31 times. The most recent report is from 3 months ago.

The full history is preserved below and remains searchable. A 0% score reflects the absence of recent activity, but this is not a guarantee that earlier reports were invalid. Abuse confidence score decays, naturally, over time, when the abusive activity stops.

IP Abuse Reports for 45.61.96.38

Export CSV

This IP address has been reported a total of 31 times from 9 distinct sources. 45.61.96.38 was first reported on October 31st 2023, and the most recent report was 3 months ago.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇷 bigorre.org	2026-06-18 06:35:39 (3 months ago)	Excessive crawling : exceed crawl-delay defined in robots.txt	Bad Web Bot
🇺🇸 ipblock.com	2026-06-17 23:38:00 (3 months ago)	IPBlock protected site ID [3192-af][s=06]. Major crawler impostor. Mozilla/5.0 (compatible; Google ... show more IPBlock protected site ID [3192-af][s=06]. Major crawler impostor. Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html) show less	Bad Web Bot
🇮🇹 Pengu	2026-04-13 04:00:04 (6 months ago)	Web application attack blocked by WAF — MSSP SOC	Web App Attack
🇺🇸 TPI-Abuse	2026-01-27 03:01:59 (8 months ago)	(mod_security) mod_security (id:221260) triggered by 45.61.96.38 (ip-45-61-96-38.fibre.fibrestream.c ... show more (mod_security) mod_security (id:221260) triggered by 45.61.96.38 (ip-45-61-96-38.fibre.fibrestream.ca): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jan 26 22:01:41.518806 2026] [security2:error] [pid 16656:tid 16668] [client 45.61.96.38:42337] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^(?:\\\\'\\\\w+?=)?\\\\(\\\\)\\\\s{" at MATCHED_VAR. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "77"] [id "221260"] [rev "3"] [msg "COMODO WAF: Shellshock Command Injection Vulnerabilities in GNU Bash through 4.3 bash43-026 (CVE-2014-7187, CVE-2014-7186, CVE-2014-7169, CVE-2014-6278, CVE-2014-6277, CVE-2014-6271)\|\|webdisk.kettlehill.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.kettlehill.com"] [uri "/cgi-bin/status"] [unique_id "aXgqlT4D1upuVdMC6K4OnQAAAEk"], referer: () { ignored; }; echo Content-Type: text/html; echo ; /bin/cat /etc/passwd show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-01-17 06:09:06 (8 months ago)	(mod_security) mod_security (id:210492) triggered by 45.61.96.38 (ip-45-61-96-38.fibre.fibrestream.c ... show more (mod_security) mod_security (id:210492) triggered by 45.61.96.38 (ip-45-61-96-38.fibre.fibrestream.ca): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jan 17 01:08:58.193006 2026] [security2:error] [pid 1039:tid 1039] [client 45.61.96.38:45521] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.nbcnewsradio.com"] [uri "/.env.prod"] [unique_id "aWsnetZarYUy8h9yU-l4bgAAAAw"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-12 04:33:53 (11 months ago)	(mod_security) mod_security (id:211070) triggered by 45.61.96.38 (ip-45-61-96-38.fibre.fibrestream.c ... show more (mod_security) mod_security (id:211070) triggered by 45.61.96.38 (ip-45-61-96-38.fibre.fibrestream.ca): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 11 23:33:48.766688 2025] [security2:error] [pid 2741:tid 2741] [client 45.61.96.38:55437] ModSecurity: Access denied with code 403 (phase 1). Pattern match "," at REQUEST_HEADERS:Transfer-Encoding. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "38"] [id "211070"] [rev "1"] [msg "COMODO WAF: HTTP Request Smuggling Attack.\|\|mail.nbcnewsradio.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "mail.nbcnewsradio.com"] [uri "/tmui/login.jsp"] [unique_id "aRQOLE0ow5c3qB1bl-AHCgAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-09-26 03:07:54 (1 year ago)	(mod_security) mod_security (id:210492) triggered by 45.61.96.38 (ip-45-61-96-38.fibre.fibrestream.c ... show more (mod_security) mod_security (id:210492) triggered by 45.61.96.38 (ip-45-61-96-38.fibre.fibrestream.ca): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Sep 25 23:07:51.179916 2025] [security2:error] [pid 13913:tid 13913] [client 45.61.96.38:52399] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autoconfig.deandobkin.com"] [uri "/.svn/wc.db"] [unique_id "aNYDh-jaz0Xglm8p0QAVZwAAAAo"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-07-26 23:34:35 (1 year ago)	(mod_security) mod_security (id:221260) triggered by 45.61.96.38 (ip-45-61-96-38.fibre.fibrestream.c ... show more (mod_security) mod_security (id:221260) triggered by 45.61.96.38 (ip-45-61-96-38.fibre.fibrestream.ca): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 26 19:33:59.080359 2025] [security2:error] [pid 26224:tid 26558] [client 45.61.96.38:42623] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^(?:\\\\'\\\\w+?=)?\\\\(\\\\)\\\\s{" at MATCHED_VAR. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "77"] [id "221260"] [rev "3"] [msg "COMODO WAF: Shellshock Command Injection Vulnerabilities in GNU Bash through 4.3 bash43-026 (CVE-2014-7187, CVE-2014-7186, CVE-2014-7169, CVE-2014-6278, CVE-2014-6277, CVE-2014-6271)\|\|mail.kettlehill.net\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.kettlehill.net"] [uri "/cgi-bin/login.php"] [unique_id "aIVl5_TFOSR3bM1_Ra8WiQAAAMU"], referer: () { ignored; }; echo Content-Type: text/html; echo ; /bin/cat /etc/passwd show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-05-29 22:34:24 (1 year ago)	(mod_security) mod_security (id:210492) triggered by 45.61.96.38 (ip-45-61-96-38.fibre.fibrestream.c ... show more (mod_security) mod_security (id:210492) triggered by 45.61.96.38 (ip-45-61-96-38.fibre.fibrestream.ca): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 29 18:34:18.653624 2025] [security2:error] [pid 3666232:tid 3666232] [client 45.61.96.38:56665] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.farmers123.com"] [uri "/.env.dev.local"] [unique_id "aDjg6mTvaEm1Ua_yfTBAdwAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-04-19 05:22:06 (1 year ago)	(mod_security) mod_security (id:211190) triggered by 45.61.96.38 (ip-45-61-96-38.fibre.fibrestream.c ... show more (mod_security) mod_security (id:211190) triggered by 45.61.96.38 (ip-45-61-96-38.fibre.fibrestream.ca): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Apr 19 01:21:55.452200 2025] [security2:error] [pid 26434:tid 26459] [client 45.61.96.38:35697] [client 45.61.96.38] ModSecurity: Access denied with code 403 (phase 2). Match of "contains cpanel" against "REQUEST_URI" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "55"] [id "211190"] [rev "9"] [msg "COMODO WAF: Remote File Access Attempt\|\|www.blog.spinningdesigns.com\|F\|2"] [data "Matched Data: /etc/ found within REQUEST_URI: /index.php?option=com_projectfork&section=../../../../../../../../etc/passwd"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "blog.spinningdesigns.com"] [uri "/index.php"] [unique_id "aAMy80BDF0hFmouiiEBFxQAAABY"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2025-03-03 11:30:03 (1 year ago)	\| Shellshock attack detected	Hacking SQL Injection Web App Attack
Anonymous	2024-11-24 01:48:50 (1 year ago)	alibaba cloud ddos like web scan	Bad Web Bot
Anonymous	2024-11-17 01:35:11 (1 year ago)	alibaba cloud ddos like web scan	Bad Web Bot
Anonymous	2024-11-10 01:04:47 (1 year ago)	alibaba cloud ddos like web scan	Bad Web Bot
Anonymous	2024-11-02 11:16:03 (1 year ago)	alibaba cloud ddos like web scan	Bad Web Bot

Showing 1 to 15 of 31 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇳🇱 185.242.226.61

🇳🇱 164.92.150.106

🇸🇪 193.189.100.197

🇨🇳 180.108.46.6

🇺🇸 142.93.179.172

🇳🇱 81.19.216.119

🇰🇷 59.8.67.52

🇮🇳 49.207.182.187

🇬🇧 195.206.182.195

🇳🇱 185.226.197.105

🇺🇸 158.46.214.8

🇬🇪 149.3.106.217

🇩🇪 139.19.117.130

🇺🇸 136.0.39.68

🇺🇸 100.29.192.103

🇫🇮 87.121.82.13

🇫🇷 45.154.138.162

🇭🇰 45.116.78.92

🇬🇧 35.203.210.83

🇺🇸 20.14.93.159