JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

5.180.252.43

Neutral Activity

Abuse Confidence Score

0% Low Risk

41 reports

27 reporters · latest 3 months ago

ISP: FameSystems GmbH & Co. KG
Usage Type: Data Center/Web Hosting/Transit
ASN: AS44486
Hostname(s): famesystems.de
Domain Name: famesystems.de
Country: 🇩🇪 Germany
City: Frankfurt am Main, Hesse

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

No reports in the last 60 days

5.180.252.43 has been reported 41 times. The most recent report is from 3 months ago.

The full history is preserved below and remains searchable. A 0% score reflects the absence of recent activity, but this is not a guarantee that earlier reports were invalid. Abuse confidence score decays, naturally, over time, when the abusive activity stops.

Abuse Reports

Export reports CSV

Total reports

41 from 27 distinct reporters

First reported

August 19th 2024

Most recent report

3 months ago

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇮🇳 evicky2002	2026-07-30 03:36:26 UTC · (3 months ago)	Confirmed malicious by STILWaters CTI platform (score=100, sources=1)	Hacking Brute-Force SSH
🇳🇱 homeshowdomain.nl	2026-05-21 22:00:36 UTC · (5 months ago)	Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-05-20.	Web App Attack SSH Hacking
🇺🇸 TPI-Abuse	2026-05-21 01:47:08 UTC · (5 months ago)	(mod_security) mod_security (id:210492) triggered by 5.180.252.43 (famesystems.de): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 20 21:47:04.329545 2026] [security2:error] [pid 13414:tid 13414] [client 5.180.252. ... show more (mod_security) mod_security (id:210492) triggered by 5.180.252.43 (famesystems.de): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 20 21:47:04.329545 2026] [security2:error] [pid 13414:tid 13414] [client 5.180.252.43:47650] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "roguetechtalks.com"] [uri "/.env"] [unique_id "ag5kGPiu18llv5rN9KN5PAAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-21 01:13:13 UTC · (5 months ago)	(mod_security) mod_security (id:210492) triggered by 5.180.252.43 (famesystems.de): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 20 21:13:09.517997 2026] [security2:error] [pid 4882:tid 4899] [client 5.180.252.43 ... show more (mod_security) mod_security (id:210492) triggered by 5.180.252.43 (famesystems.de): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 20 21:13:09.517997 2026] [security2:error] [pid 4882:tid 4899] [client 5.180.252.43:52206] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "djkirby.com"] [uri "/.env"] [unique_id "ag5cJRgSuqn3JOYHIRfs4gAAAA4"] show less	Brute-Force Bad Web Bot Web App Attack
🇬🇧 andypiper	2026-05-21 01:01:34 UTC · (5 months ago)	CrowdSec ban for AbuseIPDB Top List	Brute-Force Web App Attack
🇬🇧 CrystalMaker	2026-05-21 00:44:21 UTC · (5 months ago)	Vulnerability scan - GET /.env	Hacking
🇺🇸 TPI-Abuse	2026-05-21 00:42:15 UTC · (5 months ago)	(mod_security) mod_security (id:210492) triggered by 5.180.252.43 (famesystems.de): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 20 20:42:09.779010 2026] [security2:error] [pid 7999:tid 7999] [client 5.180.252.43 ... show more (mod_security) mod_security (id:210492) triggered by 5.180.252.43 (famesystems.de): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 20 20:42:09.779010 2026] [security2:error] [pid 7999:tid 7999] [client 5.180.252.43:36452] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "distribuidoradecongeladoscdmx.com"] [uri "/.env"] [unique_id "ag5U4aH1lfEnPux_bBlpzwAAABM"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-05-21 00:41:02 UTC · (5 months ago)	Bot / scanning and/or hacking attempts: GET /.env HTTP/1.1	Hacking Web App Attack
🇸🇬 securejdprop	2026-05-21 00:34:36 UTC · (5 months ago)	This IP was detected by CrowdSec triggering crowdsecurity/suricata-major-severity(🐾 - 🚨 Network 🕵 scan 🎩 Nuclei 👨‍💻). Ip 5.180.252.43 performed 'crowdsecurity/suricata-major-severity' (1 events over 0s) at 2026-05-21 00:34:34.546372235 +0000 UTC	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-05-21 00:25:28 UTC · (5 months ago)	(mod_security) mod_security (id:210492) triggered by 5.180.252.43 (famesystems.de): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 20 20:25:20.467916 2026] [security2:error] [pid 19029:tid 19029] [client 5.180.252. ... show more (mod_security) mod_security (id:210492) triggered by 5.180.252.43 (famesystems.de): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 20 20:25:20.467916 2026] [security2:error] [pid 19029:tid 19029] [client 5.180.252.43:46506] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "jedaenterprises.com"] [uri "/.env"] [unique_id "ag5Q8IuNU7oiyrpC7Hn0gQAAAAw"] show less	Brute-Force Bad Web Bot Web App Attack
🇧🇷 Halux	2026-05-21 00:23:16 UTC · (5 months ago)	5.180.252.43 Probing protected path or service	Web App Attack
🇺🇸 RH5	2026-05-21 00:14:25 UTC · (5 months ago)	Restricted URL probing (/.env) (UTC 2026-05-21 00:14)	Web App Attack
🇨🇭 4server	2026-05-21 00:07:56 UTC · (5 months ago)	[ThuMay2102:07:49.1100752026][security2:error][pid1094934:tid1094940][client5.180.252.43:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Matchedphrase\".env\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"364\"][id\"960720 ... show more [ThuMay2102:07:49.1100752026][security2:error][pid1094934:tid1094940][client5.180.252.43:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Matchedphrase\".env\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"364\"][id\"960720\"][msg\"Forbiddenfileaccess\"][hostname\"gipfelbild.com\"][uri\"/.env\"][unique_id\"ag5M1XNqOg9UwqCl21XXCAAAAAQ\"] show less	Hacking Web App Attack
🇩🇪 Oakley	2026-05-21 00:03:55 UTC · (5 months ago)	(confirmed_bot_sig) Confirmed bot	Hacking
🇺🇸 TPI-Abuse	2026-05-20 23:52:05 UTC · (5 months ago)	(mod_security) mod_security (id:210492) triggered by 5.180.252.43 (famesystems.de): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 20 19:51:58.464309 2026] [security2:error] [pid 22831:tid 22831] [client 5.180.252. ... show more (mod_security) mod_security (id:210492) triggered by 5.180.252.43 (famesystems.de): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 20 19:51:58.464309 2026] [security2:error] [pid 22831:tid 22831] [client 5.180.252.43:40700] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "godscreationobservatory.com"] [uri "/.env"] [unique_id "ag5JHltimf3tNz8A9GXwDAAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 41 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇸🇬 139.99.80.137

🇧🇬 79.124.60.250

🇨🇳 58.58.122.14

🇯🇴 213.139.45.223

🇸🇬 194.5.82.6

🇨🇴 186.84.90.28

🇺🇦 176.103.2.21

🇻🇳 123.31.31.125

🇺🇸 70.184.91.104

🇺🇸 65.49.20.105

🇧🇪 34.78.49.147

🇲🇽 187.204.102.242

🇳🇱 185.242.226.19

🇵🇱 162.158.172.16

🇺🇸 159.65.180.106

🇿🇦 102.219.170.177

🇫🇷 91.231.89.106

🇺🇸 207.97.140.158

🇳🇱 204.76.203.43

🇹🇷 176.235.102.25