JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 46.202.158.167

46.202.158.167 was found in our database!

This IP was reported 107 times. Confidence of Abuse is 54%: ?

54%

ISP	US ISP
Usage Type	Data Center/Web Hosting/Transit
ASN	AS47583
Domain Name	ukrtelecom.ua
Country	🇩🇪 Germany
City	Frankfurt am Main, Hesse

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 46.202.158.167

Whois 46.202.158.167

IP Abuse Reports for 46.202.158.167:

This IP address has been reported a total of 107 times from 61 distinct sources. 46.202.158.167 was first reported on May 31st 2026, and the most recent report was 3 weeks ago.

Old Reports: The most recent abuse report for this IP address is from 3 weeks ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 Matthew Ping	2026-06-02 02:30:42 (1 month ago)	ModSecurity rule 949110 triggered on dedicated. Web application attack blocked by CSF/LFD.	Web App Attack Hacking
🇩🇪 big-cloud.nl	2026-06-02 00:10:19 (1 month ago)	Try to access /arrangementen/admin/.env	Web App Attack
🇺🇸 TPI-Abuse	2026-06-01 20:34:15 (1 month ago)	(mod_security) mod_security (id:210492) triggered by 46.202.158.167 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 46.202.158.167 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 01 16:34:09.008294 2026] [security2:error] [pid 9926:tid 9926] [client 46.202.158.167:41266] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "silalaw.com"] [uri "/.env"] [unique_id "ah3swd1ECWKg-stjIb8FfgAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 kosada.com	2026-06-01 18:55:06 (1 month ago)	Web vulnerability probing: /dev/.env	Web App Attack
🇬🇧 Apache	2026-06-01 18:50:57 (1 month ago)	(mod_security) mod_security (id:210492) triggered by 46.202.158.167 (DE/Germany/-): 5 in the last 30 ... show more (mod_security) mod_security (id:210492) triggered by 46.202.158.167 (DE/Germany/-): 5 in the last 300 secs (CF_ENABLE) show less	Brute-Force Web App Attack
🇲🇾 Rizzy	2026-06-01 16:10:51 (1 month ago)	Multiple WAF Violations	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-06-01 15:35:31 (1 month ago)	(mod_security) mod_security (id:210492) triggered by 46.202.158.167 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 46.202.158.167 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 01 11:35:25.336138 2026] [security2:error] [pid 22711:tid 22711] [client 46.202.158.167:28894] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpking.com"] [uri "/app/.env"] [unique_id "ah2mvTPg4ySXrvFluWGGvQAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 sdos.es	2026-06-01 15:03:44 (1 month ago)	"Restricted File Access Attempt - Matched Data: /.env found within REQUEST_FILENAME: /member/.env"	Web App Attack
🇩🇪 paissangroup	2026-06-01 13:59:17 (1 month ago)	Multiple WAF Violations	Web App Attack
🇮🇩 Burayot	2026-06-01 13:58:55 (1 month ago)	LF_MODSEC: (mod_security) mod_security (id:949110) triggered by 46.202.158.167 (DE/Germany/-): 1 in ... show more LF_MODSEC: (mod_security) mod_security (id:949110) triggered by 46.202.158.167 (DE/Germany/-): 1 in the last 3600 secs show less	Web App Attack
🇩🇪 BlueWire Hosting	2026-06-01 13:30:43 (1 month ago)	Probing websites for vulnerabilities	Web App Attack SQL Injection
🇩🇪 EGP Abuse Dept	2026-06-01 13:04:09 (1 month ago)	Scanning for web/db/file exploits on www.destrik.com	SQL Injection Bad Web Bot Web App Attack
🇬🇧 WebNiraj	2026-06-01 10:52:54 (1 month ago)	(mod_security) mod_security (id:949110) triggered by 46.202.158.167 (DE/Germany/-): 5 in the last 36 ... show more (mod_security) mod_security (id:949110) triggered by 46.202.158.167 (DE/Germany/-): 5 in the last 3600 secs [SIGMA] show less	Brute-Force
Anonymous	2026-06-01 10:37:03 (1 month ago)	Bot / scanning and/or hacking attempts: GET /new/.env HTTP/1.1, GET /backend/.env HTTP/1.1, GET /app ... show more Bot / scanning and/or hacking attempts: GET /new/.env HTTP/1.1, GET /backend/.env HTTP/1.1, GET /app/.env HTTP/1.1, GET /.env HTTP/1.1, GET /admin/.env HTTP/1.1 show less	Hacking Web App Attack
🇫🇷 Rom74	2026-06-01 10:34:34 (1 month ago)	[Mon Jun 01 12:34:33.504594 2026] [security2:error] [pid 220361:tid 130508193253056] [client 46.202. ... show more [Mon Jun 01 12:34:33.504594 2026] [security2:error] [pid 220361:tid 130508193253056] [client 46.202.158.167:58914] [client 46.202.158.167] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.5"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "teslogiciels.com"] [uri "/dev/.env"] [unique_id "ah1gOcpxazwxD_iPRkw6oQAAAE4"] [Mon Jun 01 12:34:33.504622 2026] [security2:error] [pid 220361:tid 130508176467648] [client 46.202.158.167:58952] [client 46.202.158.167] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceede ... show less	Web App Attack

Showing 61 to 75 of 107 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 198.57.172.249

🇩🇪 194.164.59.59

🇷🇴 193.32.162.71

🇭🇰 165.154.40.97

🇺🇸 45.192.41.198

🇺🇸 45.192.40.247

🇺🇿 213.230.127.104

🇺🇸 147.185.132.234

🇧🇷 136.248.121.226

🇫🇷 86.250.189.237

🇫🇷 84.247.181.144

🇷🇴 80.94.92.156

🇰🇷 59.8.2.70

🇺🇸 45.192.33.85

🇺🇸 45.159.126.159

🇻🇳 42.96.20.16

🇳🇱 176.65.148.144

🇨🇳 106.92.36.189

🇺🇸 104.154.170.246

🇷🇴 92.118.39.233