JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

5.104.81.11

Neutral Activity

Abuse confidence score ?

0% Low Risk

151 reports

59 reporters · latest 3 years ago

ISP	Contabo GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS141995
Hostname(s)	vmi3398970.contaboserver.net
Domain Name	contabo.com
Country	🇯🇵 Japan
City	Tokyo, Tokyo

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

No reports in the last 60 days

5.104.81.11 has been reported 151 times. The most recent report is from 3 years ago.

The full history is preserved below and remains searchable. A 0% score reflects the absence of recent activity, but this is not a guarantee that earlier reports were invalid. Abuse confidence score decays, naturally, over time, when the abusive activity stops.

IP Abuse Reports for 5.104.81.11

Export CSV

This IP address has been reported a total of 151 times from 59 distinct sources. 5.104.81.11 was first reported on May 27th 2023, and the most recent report was 3 years ago.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇮🇩 Incidents Response Neptus Team	2023-08-24 02:26:03 (3 years ago)	Report Abuse IP	Hacking Exploited Host Web App Attack
🇮🇩 Incidents Response Neptus Team	2023-08-16 04:32:32 (3 years ago)	Report Abuse IP	Brute-Force Bad Web Bot Web App Attack
🇮🇩 Cynnexis Incident Response Team	2023-08-10 12:30:16 (3 years ago)	SQL Injection Attack triggered!	SQL Injection
🇮🇩 Burayot	2023-08-08 06:51:56 (3 years ago)	LF_MODSEC: (mod_security) mod_security (id:949110) triggered by 5.104.81.11 (FR/France/vmi1314495.co ... show more LF_MODSEC: (mod_security) mod_security (id:949110) triggered by 5.104.81.11 (FR/France/vmi1314495.contaboserver.net): 2 in the last 3600 secs show less	Web App Attack
🇮🇩 hermawan	2023-08-06 17:07:44 (3 years ago)	[Mon Aug 07 00:07:42.679197 2023] [security2:error] [pid 30554:tid 139709019833920] [client 5.104.81 ... show more [Mon Aug 07 00:07:42.679197 2023] [security2:error] [pid 30554:tid 139709019833920] [client 5.104.81.11:49558] [client 5.104.81.11] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)<script[^>]>[\\\\s\\\\S]?" at REQUEST_FILENAME. [file "/etc/modsecurity/coreruleset-3.3.5/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"] [line "87"] [id "941110"] [msg "XSS Filter - Category 1: Script Tag Vector"] [data "Matched Data: <script> found within REQUEST_FILENAME: /does_not_exist\\x22\\x22><script>alert(document.domain)</script><img src=x request_line = GET /does_not_exist%22%22%3E%3Cscript%3Ealert%28document.domain%29%3C/script%3E%3Cimg%20src=x HTTP/1.1"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.5"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-xss"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "karangploso.jatim.bmkg.go.id"] [uri "/does_not_exist\\"\\"><script>alert(document.domain)</script><img sr ... show less	Hacking Web App Attack
🇮🇩 hermawan	2023-08-06 16:20:32 (3 years ago)	[Sun Aug 06 23:20:30.599893 2023] [security2:error] [pid 20591:tid 140363725518400] [client 5.104.81 ... show more [Sun Aug 06 23:20:30.599893 2023] [security2:error] [pid 20591:tid 140363725518400] [client 5.104.81.11:54112] [client 5.104.81.11] ModSecurity: Access denied with code 403 (phase 2). Pattern match "." at ARGS_NAMES:redirect_to. [file "/etc/modsecurity/coreruleset-3.3.5/rules/REQUEST-921-PROTOCOL-ATTACK.conf"] [line "501"] [id "921170"] [data "Matched Data: r found within ARGS_NAMES:redirect_to: redirect_to request_line = GET /demo/api/logout?redirect_to=/asdf%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E HTTP/1.1"] [ver "OWASP_CRS/3.3.5"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS"] [tag "capec/1000/152/137/15/460"] [hostname "karangploso.jatim.bmkg.go.id"] [uri "/demo/api/logout"] [unique_id "ZM_ITry7mFuomNY_jU3KBwAAAG8"] [karangploso.jatim.bmkg.go.id] [karangploso.jatim.bmkg.go.id] top=[20704] [edYvgoOahPs] [ZM_ITry7mFuomNY_jU3KBwAAAG8] keep_alive=[0] [2023-08-06 23:20:30.599897] [R:ZM_ITry7mFuomNY_jU3 ... show less	Hacking Web App Attack
🇮🇩 hermawan	2023-08-06 09:15:26 (3 years ago)	[Sun Aug 06 16:14:02.628144 2023] [security2:error] [pid 25664:tid 140514141660736] [client 5.104.81 ... show more [Sun Aug 06 16:14:02.628144 2023] [security2:error] [pid 25664:tid 140514141660736] [client 5.104.81.11:56678] [client 5.104.81.11] ModSecurity: Access denied with code 403 (phase 2). Found 1 byte(s) in REQUEST_URI outside range: 1-255. [file "/etc/modsecurity/coreruleset-3.3.5/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "636"] [id "920270"] [msg "Invalid character in request (null character)"] [data "Matched Data: % found within REQUEST_URI: /index.php?option=com_userstatus&controller=../../../../../../../../../../etc/passwd\\x00 request_line = GET /index.php?option=com_userstatus&controller=../../../../../../../../../../etc/passwd%00 HTTP/1.1"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.5"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [hostname "karangploso.jatim.bmkg.go.id"] [uri "/index.php"] [unique_id "ZM9kWkdP6TpM9mrl6zTp7QAAAIM"] [karangploso.jatim.bmk ... show less	Hacking Web App Attack
🇮🇩 Jayalah Negeriku	2023-08-06 08:45:32 (3 years ago)	XSS	Hacking SQL Injection Web App Attack
🇮🇩 hermawan	2023-08-06 08:08:35 (3 years ago)	[Sun Aug 06 15:08:33.817541 2023] [security2:error] [pid 6942:tid 139674903352896] [client 5.104.81. ... show more [Sun Aug 06 15:08:33.817541 2023] [security2:error] [pid 6942:tid 139674903352896] [client 5.104.81.11:61516] [client 5.104.81.11] ModSecurity: Access denied with code 403 (phase 2). Pattern match "." at ARGS_NAMES:q. [file "/etc/modsecurity/coreruleset-3.3.5/rules/REQUEST-921-PROTOCOL-ATTACK.conf"] [line "501"] [id "921170"] [data "Matched Data: q found within ARGS_NAMES:q: q request_line = POST /webadm/?q=moni_detail.do&action=gragh HTTP/1.1"] [ver "OWASP_CRS/3.3.5"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS"] [tag "capec/1000/152/137/15/460"] [hostname "karangploso.jatim.bmkg.go.id"] [uri "/webadm/"] [unique_id "ZM9VAf0ncvrLd4m0juyifAAAANQ"] [karangploso.jatim.bmkg.go.id] [karangploso.jatim.bmkg.go.id] top=[7063] [MXjZojzU1J0] [ZM9VAf0ncvrLd4m0juyifAAAANQ] keep_alive=[0] [2023-08-06 15:08:33.817548] [R:ZM9VAf0ncvrLd4m0juyifAAAANQ] UA:'Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36 ... show less	Hacking Web App Attack
Anonymous	2023-08-06 05:58:52 (3 years ago)	XSS Attempt	Hacking
🇮🇩 penjaga BRIN	2023-08-06 04:03:09 (3 years ago)	XSS (Cross Site Scripting) attempt-112	Web App Attack
🇮🇩 hermawan	2023-08-05 17:29:00 (3 years ago)	[Sun Aug 06 00:28:58.838845 2023] [security2:error] [pid 25717:tid 140600275871296] [client 5.104.81 ... show more [Sun Aug 06 00:28:58.838845 2023] [security2:error] [pid 25717:tid 140600275871296] [client 5.104.81.11:57150] [client 5.104.81.11] ModSecurity: Access denied with code 403 (phase 2). Pattern match "." at ARGS_NAMES:action. [file "/etc/modsecurity/coreruleset-3.3.5/rules/REQUEST-921-PROTOCOL-ATTACK.conf"] [line "501"] [id "921170"] [data "Matched Data: a found within ARGS_NAMES:action: action request_line = GET /wp-admin/admin-ajax.php?action=edd_download_search&s=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1"] [ver "OWASP_CRS/3.3.5"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS"] [tag "capec/1000/152/137/15/460"] [hostname "karangploso.jatim.bmkg.go.id"] [uri "/wp-admin/admin-ajax.php"] [unique_id "ZM6G2uGXS23n3ACmFQdgzQAAAIA"] [karangploso.jatim.bmkg.go.id] [karangploso.jatim.bmkg.go.id] top=[25847] [og43WTBLXVY] [ZM6G2uGXS23n3ACmFQdgzQAAAIA] keep_alive=[0] [2023-08-06 00:28:58.838848] [R:ZM6G2uGXS23n3ACmFQd ... show less	Hacking Web App Attack
🇮🇩 Burayot	2023-08-05 16:39:14 (3 years ago)	LF_MODSEC: (mod_security) mod_security (id:949110) triggered by 5.104.81.11 (FR/France/vmi1314495.co ... show more LF_MODSEC: (mod_security) mod_security (id:949110) triggered by 5.104.81.11 (FR/France/vmi1314495.contaboserver.net): 2 in the last 3600 secs show less	Web App Attack
🇮🇩 Burayot	2023-08-05 02:43:17 (3 years ago)	LF_MODSEC: (mod_security) mod_security (id:960012) triggered by 5.104.81.11 (FR/France/vmi1314495.co ... show more LF_MODSEC: (mod_security) mod_security (id:960012) triggered by 5.104.81.11 (FR/France/vmi1314495.contaboserver.net): 2 in the last 3600 secs show less	Web App Attack
🇮🇩 Burayot	2023-08-05 02:07:22 (3 years ago)	LF_MODSEC: (mod_security) mod_security (id:960024) triggered by 5.104.81.11 (JP/Japan/vmi1314495.con ... show more LF_MODSEC: (mod_security) mod_security (id:960024) triggered by 5.104.81.11 (JP/Japan/vmi1314495.contaboserver.net): 2 in the last 3600 secs show less	Web App Attack

Showing 1 to 15 of 151 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇭🇰 152.32.171.213

🇺🇸 51.81.163.51

🇬🇧 35.203.210.231

🇨🇳 223.112.5.140

🇨🇭 195.177.93.129

🇦🇷 168.196.246.212

🇸🇬 112.140.187.102

🇺🇸 91.230.168.125

🇬🇧 86.38.187.195

🇺🇸 51.81.170.6

🇺🇸 51.81.169.200

🇺🇸 51.81.164.159

🇺🇸 51.81.163.59

🇸🇬 45.32.109.28

🇬🇧 35.203.210.230

🇺🇸 20.106.185.213

🇺🇸 20.65.169.113

🇨🇳 221.229.218.50

🇫🇮 147.185.133.88

🇺🇸 129.121.139.106