JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 46.8.96.254

46.8.96.254 was found in our database!

This IP was reported 82 times. Confidence of Abuse is 100%: ?

100%

ISP	FIRST SERVER LIMITED
Usage Type	Data Center/Web Hosting/Transit
ASN	AS204339
Domain Name	first-server.net
Country	🇫🇮 Finland
City	Helsinki, Uusimaa

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 46.8.96.254

Whois 46.8.96.254

IP Abuse Reports for 46.8.96.254:

This IP address has been reported a total of 82 times from 72 distinct sources. 46.8.96.254 was first reported on July 3rd 2026, and the most recent report was 9 minutes ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇵🇱 mkey	2026-07-04 10:15:01 (9 minutes ago)	Verified scan activity detected by local IDS/firewall correlation. SCAN: HIGHRISK_SINGLEPORT \| PORTS ... show more Verified scan activity detected by local IDS/firewall correlation. SCAN: HIGHRISK_SINGLEPORT \| PORTS=22 \| HITS=2 \| IPSET=ADD \| FIRST=2026-07-04 12:11:59 \| LAST=2026-07-04 12:11:59. Last seen 2026-07-04 12:11:59. show less	Port Scan
🇵🇱 genokrad	2026-07-04 10:01:20 (23 minutes ago)	Unauthorized connection attempt on TCP/22 (SSH)	Port Scan
🇺🇸 Axel	2026-07-04 10:01:08 (23 minutes ago)	Blocked by UFW on LAXHH [2222/tcp] \| SPT: 48292 \| TTL: 46 \| LEN: 40 \| TOS: 0x00 • Reported by: githu ... show more Blocked by UFW on LAXHH [2222/tcp] \| SPT: 48292 \| TTL: 46 \| LEN: 40 \| TOS: 0x00 • Reported by: github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇺🇸 ISPLtd	2026-07-04 09:42:50 (41 minutes ago)	Jul 4 03:42:50 46.8.96.254 TCP SPT=54190 DPT=22 SYN ...	Port Scan SSH
🇺🇸 RAP	2026-07-04 09:13:42 (1 hour ago)	2026-07-04 09:13:42 UTC Unauthorized activity to TCP port 23. Telnet	Port Scan
Anonymous	2026-07-04 08:04:31 (2 hours ago)	IP & Port Scan.	SSH Port Scan Brute-Force
🇺🇸 TPI-Abuse	2026-07-04 07:50:19 (2 hours ago)	(mod_security) mod_security (id:218420) triggered by 46.8.96.254 (-): 1 in the last 300 secs; Ports: ... show more (mod_security) mod_security (id:218420) triggered by 46.8.96.254 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 04 03:50:12.476760 2026] [security2:error] [pid 12568:tid 12568] [client 46.8.96.254:33232] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)php://(std(in\|out\|err)\|(in\|out)put\|fd\|memory\|temp\|filter)" at ARGS_NAMES:\\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/21_PHP_PHPGen.conf"] [line "22"] [id "218420"] [rev "2"] [msg "COMODO WAF: PHP Injection Attack: I/O Stream Found\|\|192.64.150.48:80\|F\|2"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [tag "CWAF"] [tag "PHPGen"] [hostname "192.64.150.48"] [uri "/hello.world"] [unique_id "aki7NHdXEQqStqwsmZDM6wAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-07-04 07:21:05 (3 hours ago)	46.8.96.254 - - [04/Jul/2026:07:21:04 +0000] "POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/ ... show more 46.8.96.254 - - [04/Jul/2026:07:21:04 +0000] "POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh HTTP/1.1" 400 432 "-" "libredtail-http" ... show less	Bad Web Bot Web App Attack
🇫🇷 polarolouis	2026-07-04 07:14:59 (3 hours ago)	This IP was detected by CrowdSec triggering crowdsecurity/http-cve-2021-41773	Web App Attack Hacking
🇨🇦 john doe	2026-07-04 07:14:57 (3 hours ago)	SentinelBot: PHP Exploit (score: 71)	Web App Attack
🇺🇸 xxkodedxx	2026-07-04 06:41:46 (3 hours ago)	[Zorvexus edge-defense] Edge-block (probe URI / bad UA / hostile vhost) Trigger: 1× edge-block in 10 ... show more [Zorvexus edge-defense] Edge-block (probe URI / bad UA / hostile vhost) Trigger: 1× edge-block in 10m window. Origin: FI / AS204339 FIRST SERVER LIMITED Active: 06:41:02→06:41:04 UTC Volume: 3 HTTP req Probed: /cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh, /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh, /hello.world?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input Status mix: 400×2 444×1 Vhost fishing: 67.217.240.72 UA: "libredtail-http" Auto-banned 30d. zorvexus-banner. show less	Bad Web Bot Web App Attack
🇮🇪 AutosOnShow	2026-07-04 05:27:04 (4 hours ago)	blocked for webapp attack \| path requested: / \| seen at 2026-07-04 05:26:33.001 \|	Web App Attack
🇺🇸 TPI-Abuse	2026-07-04 05:25:33 (4 hours ago)	(mod_security) mod_security (id:218420) triggered by 46.8.96.254 (-): 1 in the last 300 secs; Ports: ... show more (mod_security) mod_security (id:218420) triggered by 46.8.96.254 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 04 01:25:27.825851 2026] [security2:error] [pid 27971:tid 27971] [client 46.8.96.254:54882] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)php://(std(in\|out\|err)\|(in\|out)put\|fd\|memory\|temp\|filter)" at ARGS_NAMES:\\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/21_PHP_PHPGen.conf"] [line "22"] [id "218420"] [rev "2"] [msg "COMODO WAF: PHP Injection Attack: I/O Stream Found\|\|192.64.150.29:80\|F\|2"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [tag "CWAF"] [tag "PHPGen"] [hostname "192.64.150.29"] [uri "/hello.world"] [unique_id "akiZRzeTBi7pwmG8ECumjwAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 psauxit	2026-07-04 05:09:06 (5 hours ago)	Fail2Ban - NGINX bad requests 400-401-403-404-444, high level vulnerability scanning, commonly xmlrp ... show more Fail2Ban - NGINX bad requests 400-401-403-404-444, high level vulnerability scanning, commonly xmlrpc_attack, wp-login brute force, excessive crawling/scraping show less	Web App Attack Hacking
🇩🇪 edena	2026-07-04 03:18:48 (7 hours ago)	46.8.96.254 - - [04/Jul/2026:05:18:45 +0200] "POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/ ... show more 46.8.96.254 - - [04/Jul/2026:05:18:45 +0200] "POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh HTTP/1.1" 400 591 "-" "libredtail-http" 46.8.96.254 - - [04/Jul/2026:05:18:46 +0200] "POST /cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh HTTP/1.1" 400 591 "-" "libredtail-http" 46.8.96.254 - - [04/Jul/2026:05:18:47 +0200] "POST /hello.world?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 403 359 "-" "libredtail-http" ... show less	Web App Attack Bad Web Bot

Showing 1 to 15 of 82 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇻🇳 2001:ee1:7c11:150:a2ac:78ff:fee3:8792

🇦🇪 198.38.94.18

🇧🇷 177.16.244.39

🇻🇳 171.231.193.246

🇺🇸 104.237.248.128

🇺🇸 52.146.21.44

🇺🇸 40.77.167.156

🇲🇽 38.22.170.10

🇺🇸 20.46.244.172

🇩🇴 190.167.237.191

🇧🇩 161.248.189.83

🇭🇰 122.10.114.92

🇧🇬 91.148.190.150

🇫🇷 78.197.6.173

🇳🇱 78.142.18.172

🇺🇸 64.62.156.45

🇳🇱 45.148.10.157

🇫🇮 45.82.110.150

🇧🇷 34.95.188.224

🇷🇺 31.173.12.27