JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 45.94.209.196

45.94.209.196 was found in our database!

This IP was reported 208 times. Confidence of Abuse is 100%: ?

100%

ISP	Contabo GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS51167
Hostname(s)	vmi3338359.contaboserver.net
Domain Name	contabo.com
Country	🇫🇷 France
City	Lauterbourg, Grand Est

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 45.94.209.196

Whois 45.94.209.196

IP Abuse Reports for 45.94.209.196:

This IP address has been reported a total of 208 times from 129 distinct sources. 45.94.209.196 was first reported on June 1st 2026, and the most recent report was 45 minutes ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 xmission.com	2026-06-01 19:11:46 (2 days ago)	Blocked by UFW (TCP on 23) Source port: 39925 TTL: 45 Packet length: 40 TOS: 0x08 This report (for ... show more Blocked by UFW (TCP on 23) Source port: 39925 TTL: 45 Packet length: 40 TOS: 0x08 This report (for 45.94.209.196) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan Hacking Brute-Force
🇺🇸 TPI-Abuse	2026-06-01 19:11:04 (2 days ago)	(mod_security) mod_security (id:218420) triggered by 45.94.209.196 (vmi3338359.contaboserver.net): 1 ... show more (mod_security) mod_security (id:218420) triggered by 45.94.209.196 (vmi3338359.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 01 15:10:56.735387 2026] [security2:error] [pid 10865:tid 10865] [client 45.94.209.196:36968] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)php://(std(in\|out\|err)\|(in\|out)put\|fd\|memory\|temp\|filter)" at ARGS_NAMES:\\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/21_PHP_PHPGen.conf"] [line "22"] [id "218420"] [rev "2"] [msg "COMODO WAF: PHP Injection Attack: I/O Stream Found\|\|192.64.150.62:80\|F\|2"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [tag "CWAF"] [tag "PHPGen"] [hostname "192.64.150.62"] [uri "/hello.world"] [unique_id "ah3ZQPX6sKSvv25-TsCWygAAAA4"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 AetherFox	2026-06-01 19:10:11 (2 days ago)	AetherFox VoidGuard detected: [Mon Jun 01 19:10:10.800665 2026] [authz_core:error] [pid 2670592:tid ... show more AetherFox VoidGuard detected: [Mon Jun 01 19:10:10.800665 2026] [authz_core:error] [pid 2670592:tid 2670616] [client 45.94.209.196:49020] AH01630: client denied by server configuration: proxy:http://[MASKED]/hello.world [Mon Jun 01 19:10:10.800762 2026] [authz_core:error] [pid 2670592:tid 2670616] [client 45.94.209.196:49020] AH01630: client denied by server configuration: /var/www/html/ERRORpages/403.html [Mon Jun 01 19:10:10.838000 2026] [authz_core:error] [pid 2670592:tid 2670602] [client 45.94.209.196:49020] AH01630: client denied by server configuration: proxy:http://[MASKED]/ [Mon Jun 01 19:10:10.838076 2026] [authz_core:error] [pid 2670592:tid 2670602] [client 45.94.209.196:49020] AH01630: client denied by server configuration: /var/www/html/ERRORpages/403.html [Mon Jun 01 19:10:10.912933 2026] [authz_core:error] [pid 2670592:tid 2670612] [client 45.94.209.196:49020] AH01630: client denied by server configuration: proxy:http://[MASKED]/vendor/phpunit ... show less	Bad Web Bot Web App Attack
🇦🇺 PetePK	2026-06-01 18:59:02 (2 days ago)	Probed 1 time(s): TCP/2222	Port Scan
🇮🇪 AutosOnShow	2026-06-01 18:54:05 (2 days ago)	blocked for webapp attack \| path requested: /index.php \| seen at 2026-06-01 18:53:40.350 \|	Web App Attack
🇫🇷 Version Net	2026-06-01 18:44:23 (2 days ago)	IPS Detection: Apache.HTTP.Server.cgi-bin.Path.Traversal	Hacking
🇺🇸 MPL	2026-06-01 18:42:49 (2 days ago)	tcp/2222 (4 or more attempts)	Port Scan
🇫🇷 dynamix	2026-06-01 18:24:19 (2 days ago)	Multiple WAF Violations	Web App Attack
🇺🇸 xmission.com	2026-06-01 18:04:46 (2 days ago)	Blocked by UFW (TCP on 2222) Source port: 35228 TTL: 44 Packet length: 40 TOS: 0x08 This report (fo ... show more Blocked by UFW (TCP on 2222) Source port: 35228 TTL: 44 Packet length: 40 TOS: 0x08 This report (for 45.94.209.196) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇺🇸 bigscoots.com	2026-06-01 18:03:00 (2 days ago)	(sshd) Failed SSH login from 45.94.209.196 (DE/Germany/vmi3338359.contaboserver.net): 5 in the last ... show more (sshd) Failed SSH login from 45.94.209.196 (DE/Germany/vmi3338359.contaboserver.net): 5 in the last 3600 secs; Ports: *; Direction: 1; Trigger: LF_SSHD; Logs: Jun 1 13:01:35 13959 sshd[3466]: Invalid user admin from 45.94.209.196 port 60230 Jun 1 13:01:37 13959 sshd[3466]: Failed password for invalid user admin from 45.94.209.196 port 60230 ssh2 Jun 1 13:02:08 13959 sshd[3867]: Invalid user orangepi from 45.94.209.196 port 35478 Jun 1 13:02:10 13959 sshd[3867]: Failed password for invalid user orangepi from 45.94.209.196 port 35478 ssh2 Jun 1 13:02:41 13959 sshd[4030]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.94.209.196 user=root show less	Brute-Force SSH
🇷🇺 genokrad	2026-06-01 17:51:28 (2 days ago)	Unauthorized connection try on TCP/23 (Telnet)	Port Scan
🇺🇸 TPI-Abuse	2026-06-01 17:48:30 (2 days ago)	(mod_security) mod_security (id:218420) triggered by 45.94.209.196 (vmi3338359.contaboserver.net): 1 ... show more (mod_security) mod_security (id:218420) triggered by 45.94.209.196 (vmi3338359.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 01 13:48:26.485745 2026] [security2:error] [pid 20219:tid 20219] [client 45.94.209.196:37786] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)php://(std(in\|out\|err)\|(in\|out)put\|fd\|memory\|temp\|filter)" at ARGS_NAMES:\\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/21_PHP_PHPGen.conf"] [line "38"] [id "218420"] [rev "2"] [msg "COMODO WAF: PHP Injection Attack: I/O Stream Found\|\|192.64.150.199:80\|F\|2"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [tag "CWAF"] [tag "PHPGen"] [hostname "192.64.150.199"] [uri "/hello.world"] [unique_id "ah3F6gmtzE26cm5ZwF1-qAAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
🇯🇵 VXG-NET	2026-06-01 17:46:03 (2 days ago)	port=80, indicator_type=code-execution	Hacking
🇺🇸 bigscoots.com	2026-06-01 17:43:18 (2 days ago)	(sshd) Failed SSH login from 45.94.209.196 (DE/Germany/vmi3338359.contaboserver.net): 5 in the last ... show more (sshd) Failed SSH login from 45.94.209.196 (DE/Germany/vmi3338359.contaboserver.net): 5 in the last 3600 secs; Ports: *; Direction: 1; Trigger: LF_SSHD; Logs: Jun 1 12:42:06 13586 sshd[32077]: Invalid user admin from 45.94.209.196 port 33022 Jun 1 12:42:08 13586 sshd[32077]: Failed password for invalid user admin from 45.94.209.196 port 33022 ssh2 Jun 1 12:42:39 13586 sshd[32243]: Invalid user orangepi from 45.94.209.196 port 56852 Jun 1 12:42:42 13586 sshd[32243]: Failed password for invalid user orangepi from 45.94.209.196 port 56852 ssh2 Jun 1 12:43:13 13586 sshd[32630]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.94.209.196 user=root show less	Brute-Force SSH
🇬🇧 Don Felip	2026-06-01 17:36:33 (2 days ago)	Web Exploiter - Banned by Fail2Ban	Hacking Web App Attack

Showing 181 to 195 of 208 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇹🇼 198.235.24.123

🇬🇧 35.203.210.109

🇨🇳 223.70.149.210

🇵🇹 185.228.3.90

🇨🇳 180.113.98.231

🇪🇨 177.53.215.134

🇺🇸 172.202.117.170

🇨🇦 172.105.25.65

🇻🇳 160.30.113.59

🇺🇸 128.203.203.4

🇹🇳 102.31.210.114

🇧🇬 79.124.62.230

🇺🇸 216.244.66.232

🇩🇪 213.209.159.226

🇨🇳 180.95.238.22

🇳🇱 176.65.139.131

🇭🇷 176.61.152.177

🇲🇾 175.140.178.26

🇺🇸 173.249.147.126

🇨🇳 125.211.145.185