JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

45.94.58.127

Recent Activity

Abuse Confidence Score

100% Critical

34 reports

31 reporters · latest 1 day ago

ISP: Contabo GmbH
Usage Type: Data Center/Web Hosting/Transit
ASN: AS51167
Hostname(s): vmi3714790.contaboserver.net
Domain Name: contabo.com
Country: 🇫🇷 France
City: Lauterbourg, Grand Est

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Example preview

Account required for the enhanced features Log in Sign up

Abuse Reports

Export reports CSV

Total reports

34 from 31 distinct reporters

First reported

October 31st 2026

Most recent report

1 day ago

Last 60 days

Top reporter locations 🇩🇪 Germany 9 🇫🇷 France 7 🇳🇱 Netherlands 4

Most common categories Web App Attack 27 Bad Web Bot 12 Hacking 7 Brute-Force 7 SQL Injection 2

Recent reports We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇮 as211431.net	2026-11-06 13:47:42 UTC · (1 day ago)	Triggered Cloudflare WAF (firewallManaged) from FR. Action taken: BLOCK Protocol: HTTP/1.1 (GET method) Endpoint: /wp-config.php.sav UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 ... show more Triggered Cloudflare WAF (firewallManaged) from FR. Action taken: BLOCK Protocol: HTTP/1.1 (GET method) Endpoint: /wp-config.php.sav UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
🇧🇷 ICS Labs	2026-11-05 13:22:02 UTC · (2 days ago)	ICS Labs threat intelligence (ICS Feeds): Brute-Force. Last observed 2026-11-05 UTC.	Brute-Force
🇩🇪 ghostwarriors	2026-11-05 08:50:06 UTC · (2 days ago)	Attempts against non-existent wp-login	Brute-Force Web App Attack
🇳🇱 tpjg	2026-11-05 08:15:41 UTC · (2 days ago)	Automated: 15 requests with error status in 120s window from 45.94.58.127. Evidence: /api/.env:301,/apps/.env:301,/.env-example:301,/backend/.env:301,/env.list:301,/env.sample:301,/.env.save:301,/.env.bak:301,/.env.example:301,/.env.staging:301,/.env ... show more Automated: 15 requests with error status in 120s window from 45.94.58.127. Evidence: /api/.env:301,/apps/.env:301,/.env-example:301,/backend/.env:301,/env.list:301,/env.sample:301,/.env.save:301,/.env.bak:301,/.env.example:301,/.env.staging:301,/.env.prod:301,/.env.production:301,/app/.env:301,/.env:301,/.env.local:301 show less	Web App Attack
🇫🇷 security.rdmc.fr	2026-11-05 07:37:52 UTC · (2 days ago)	Activity from blacklisted IP	Hacking
Anonymous	2026-11-05 06:12:54 UTC · (2 days ago)	45.94.58.127 34.194.31.253 - [05/Nov/2026:00:12:53 -0600] "GET /.env-example HTTP/1.1" 403 158 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36"\n45.94.58.127 34.194.31.253 - [05/Nov ... show more 45.94.58.127 34.194.31.253 - [05/Nov/2026:00:12:53 -0600] "GET /.env-example HTTP/1.1" 403 158 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36"\n45.94.58.127 34.194.31.253 - [05/Nov/2026:00:12:54 -0600] "GET /.env.local HTTP/1.1" 403 158 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36"\n45.94.58.127 34.194.31.253 - [05/Nov/2026:00:12:54 -0600] "GET /env.list HTTP/1.1" 403 158 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36"\n45.94.58.127 34.194.31.253 - [05/Nov/2026:00:12:54 -0600] "GET /env.sample HTTP/1.1" 403 158 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36"\n45.94.58.127 34.194.31.253 - [05/Nov/2026:00:12:54 -0600] "GET /apps/.env HTTP/1.1" 403 158 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.3 show less	DDoS Attack Web App Attack
🇩🇪 snhosting	2026-11-05 02:56:03 UTC · (2 days ago)	45.94.58.127 - - [05/Nov/2026:03:55:53 +0100] "GET /appsettings.Production.json HTTP/2.0" 404 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36" 45.94.58.127 - - [05/Nov/2026:03:55: ... show more 45.94.58.127 - - [05/Nov/2026:03:55:53 +0100] "GET /appsettings.Production.json HTTP/2.0" 404 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36" 45.94.58.127 - - [05/Nov/2026:03:55:53 +0100] "GET /application.yml HTTP/2.0" 404 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36" 45.94.58.127 - - [05/Nov/2026:03:55:53 +0100] "GET /appsettings.Staging.json HTTP/2.0" 404 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36" 45.94.58.127 - - [05/Nov/2026:03:55:53 +0100] "GET /worker.js HTTP/2.0" 404 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36" 45.94.58.127 - - [05/Nov/2026:03:55:53 +0100] "GET /build/main.js HTTP/2.0" 404 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/12 ... show less	DNS Compromise DNS Poisoning Phishing Email Spam Brute-Force Web App Attack SSH
🇮🇹 ciccio diddo	2026-11-04 22:03:05 UTC · (2 days ago)	High Burst multiple 40X port:Tcp/80,443	Brute-Force Web App Attack
🇫🇮 paissangroup	2026-11-04 20:17:45 UTC · (2 days ago)	Multiple WAF Violations	Web App Attack
🇳🇱 WeCloudit-Anti-Abuse	2026-11-04 20:14:56 UTC · (2 days ago)	This IP was detected by CrowdSec triggering crowdsecurity/http-probing	Web App Attack Hacking
🇫🇷 Kejult	2026-11-04 11:02:27 UTC · (3 days ago)	Honeypot Finding: repeated HTTP/web-application probing captured by Tanner on TCP/80; 18 request event(s), 18 distinct path(s), 7 request(s) to suspicious path(s). Examples: /.env, /.env-example, /.env.example, /.env.local, /.env.prod.	Hacking Bad Web Bot Web App Attack
🇩🇪 Enno	2026-11-04 07:49:50 UTC · (3 days ago)	P38::Fail2Ban: automated bot scanning / credential probing detected.	Web App Attack Bad Web Bot
🇺🇸 LotPhantom	2026-11-04 07:47:26 UTC · (3 days ago)	45.94.58.127 - - [04/Nov/2026:07:47:12 +0000] "GET /.env HTTP/1.1" 404 548 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36" "0" ...	Web App Attack
🇳🇱 ams_sec_user	2026-11-04 07:05:28 UTC · (3 days ago)	Automated requests against a hosted website: 25 requests between 06:00 and 06:59 UTC; 14 probes for exposed secrets/config files (/.env.production, /.env.local, /.env.staging). Reported automatically.	Hacking Bad Web Bot Web App Attack
🇮🇹 CoreTech srl	2026-11-04 06:23:56 UTC · (3 days ago)	cloudlinux2 fail2ban: 2026-11-04 07:19:02,623 fail2ban.filter [1800]: INFO [plesk-modsecurity] Found 45.94.58.127 - 2026-11-04 07:19:02cloudlinux2 fail2ban: 2026-11-04 07:19:02,603 fail2ban.filter [1800]: INFO [plesk-modsecurity ... show more cloudlinux2 fail2ban: 2026-11-04 07:19:02,623 fail2ban.filter [1800]: INFO [plesk-modsecurity] Found 45.94.58.127 - 2026-11-04 07:19:02cloudlinux2 fail2ban: 2026-11-04 07:19:02,603 fail2ban.filter [1800]: INFO [plesk-modsecurity] Found 45.94.58.127 - 2026-11-04 07:19:02cloudlinux2 fail2ban: 2026-11-04 07:19:02,594 fail2ban.filter [1800]: INFO [plesk-modsecurity] Found 45.94.58.127 - 2026-11-04 07:19:02cloudlinux2 fail2ban: 2026-11-04 07:19:02,644 fail2ban.filter [1800]: INFO [plesk-modsecurity] Found 45.94.58.127 - 2026-11-04 07:19:02cloudlinux2 fail2ban: 2026-11-04 07:19:02,632 fail2ban.filter [1800]: INFO [plesk-modsecurity] Found 45.94.58.127 - 2026-11-04 07:19:02cloudlinux2 fail2ban: 2026-11-04 07:19:02,653 fail2ban.filter [1800]: INFO [plesk-modsecurity] Found 45.94.58.127 - 2026-11-04 07:19:02cloudlinux2 fail2ban: 2026-11-04 07:19:03,150 fail2ban.filter [1800]: INFO [recidive] Found 45.94.58.127 - 2026-11-04 07:19:03cloudlinux2 show less	Web App Attack

Showing 1 to 15 of 34 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇩🇪 213.209.159.175

🇺🇸 155.2.215.82

🇺🇸 152.163.101.244

🇺🇸 91.193.232.34

🇺🇸 45.132.227.83

🇯🇵 43.167.207.58

🇩🇪 43.157.54.144

🇺🇸 43.135.183.2

🇲🇽 38.22.164.235

🇨🇳 202.103.55.158

🇺🇸 172.59.84.249

🇮🇳 165.99.85.47

🇺🇸 152.163.101.152

🇺🇸 148.135.10.48

🇨🇳 123.160.173.244

🇧🇩 103.234.203.143

🇺🇸 103.196.9.44

🇳🇱 81.171.72.135

🇯🇵 47.245.9.17

🇧🇬 46.55.162.29