AbuseIPDB » 5.104.80.150

5.104.80.150 was found in our database!

This IP was reported 68 times. Confidence of Abuse is 36%: ?

36%

ISP	Contabo GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS141995
Hostname(s)	vmi2405570.contaboserver.net
Domain Name	contabo.com
Country	Japan
City	Tokyo, Tokyo

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated biweekly.

Report 5.104.80.150

Whois 5.104.80.150

IP Abuse Reports for 5.104.80.150:

This IP address has been reported a total of 68 times from 36 distinct sources. 5.104.80.150 was first reported on January 20th 2025, and the most recent report was 1 month ago.

Old Reports: The most recent abuse report for this IP address is from 1 month ago. It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp in UTC	Comment	Categories
Roper123	2025-01-22 06:52:37 (1 month ago)	Web app exploits	Web App Attack
MWA SOC	2025-01-21 09:01:00 (2 months ago)		Hacking
BSG Webmaster	2025-01-21 08:35:20 (2 months ago)	Port scanning (Port 443)	Port Scan Hacking
ingrowrook	2025-01-21 07:56:00 (2 months ago)	UNAUTHORIZED CONNECTION ATTEMPTS /// DST [443] /// +100 ATTEMPTS	Port Scan Brute-Force
TPI-Abuse	2025-01-21 07:49:06 (2 months ago)	(mod_security) mod_security (id:218420) triggered by 5.104.80.150 (vmi2405570.contaboserver.net): 1 ... show more(mod_security) mod_security (id:218420) triggered by 5.104.80.150 (vmi2405570.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jan 21 02:49:01.636303 2025] [security2:error] [pid 828:tid 828] [client 5.104.80.150:49740] [client 5.104.80.150] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)php://(std(in\|out\|err)\|(in\|out)put\|fd\|memory\|temp\|filter)" at ARGS_NAMES:%ADd allow_url_include=1 %ADd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/21_PHP_PHPGen.conf"] [line "22"] [id "218420"] [rev "2"] [msg "COMODO WAF: PHP Injection Attack: I/O Stream Found\|\|192.64.150.183\|F\|2"] [data "Matched Data: php://input found within ARGS_NAMES:%ADd allow_url_include=1 %ADd auto_prepend_file=php://input: %ADd allow_url_include=1 %ADd auto_prepend_file=php://input"] [severity "CRITICAL"] [tag "CWAF"] [tag "PHPGen"] [hostname "192.64.150.183"] [uri "/"] [unique_id "Z49RbSk1aw6AK1-ig8OQYwAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2025-01-21 07:30:12 (2 months ago)	2025-01-21 07:30:12 warning: host vmi2405570.contaboserver.net.[5.104.80.150]: unauthorized access a ... show more2025-01-21 07:30:12 warning: host vmi2405570.contaboserver.net.[5.104.80.150]: unauthorized access attempted: tcp/443 show less	Port Scan Brute-Force
RCS	2025-01-21 05:16:12 (2 months ago)	fail2ban apache-modsecurity ...	Bad Web Bot Web App Attack
ATV	2025-01-21 03:10:49 (2 months ago)	Unsolicited connection attempts to port 443	Hacking
anon333	2025-01-21 02:35:41 (2 months ago)	Hacker syslog review 1737426941	Hacking
Study Bitcoin 🤗	2025-01-21 00:42:34 (2 months ago)	2 port probes: 2x tcp/443 (https) [srv133,srv131]	Port Scan Brute-Force Bad Web Bot Web App Attack
Honzas	2025-01-21 00:19:57 (2 months ago)	Unsolicited connection attemp, port 443/TCP	Brute-Force
oonux.net	2025-01-21 00:03:39 (2 months ago)	RouterOS: Scanning detected TCP 5.104.80.150:58835 > x.x.x.x:443	Port Scan
diego	2025-01-21 00:01:42 (2 months ago)	Events: TCP SYN Discovery or Flooding, Seen 34 times in the last 10800 seconds	DDoS Attack
MPL	2025-01-20 23:58:46 (2 months ago)	tcp/443	Port Scan
Countryman	2025-01-20 23:58:15 (2 months ago)	repeated unauthorized connection attempts, host sweep, port scan	Port Scan