JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

67.220.94.52

Recent Activity

Abuse Confidence Score

100% Critical

38 reports

31 reporters · latest 15 minutes ago

ISP: GLOBALTELEHOST Corp.
Usage Type: Data Center/Web Hosting/Transit
ASN: AS62563
Hostname(s): 52-94-220-67.clients.gthost.com
Domain Name: globaltelehost.com
Country: 🇨🇦 Canada
City: Toronto, Ontario

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Example preview

Account required for the enhanced features Log in Sign up

Abuse Reports

Export reports CSV

Total reports

38 from 31 distinct reporters

First reported

November 10th 2026

Most recent report

15 minutes ago

Last 60 days

Top reporter locations 🇩🇪 Germany 11 🇺🇸 United States of America 10 🇫🇷 France 3

Most common categories Web App Attack 29 Bad Web Bot 19 Hacking 13 Brute-Force 11 Port Scan 2

Recent reports We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 Bedios GmbH	2026-11-12 02:19:17 UTC · (15 minutes ago)	Scanning for exposed credentials and private keys	Hacking
🇩🇪 rh24	2026-11-12 02:04:08 UTC · (30 minutes ago)	(secretscan) Secret-Scanner (env/git/ssh/credentials) from 67.220.94.52 (CA/Canada/52-94-220-67.clients.gthost.com)	Hacking
🇩🇪 ghostwarriors	2026-11-12 00:20:25 UTC · (2 hours ago)	Webpage scraping	Brute-Force Bad Web Bot Web App Attack
🇩🇪 raph	2026-11-11 23:32:42 UTC · (3 hours ago)	[DOT FILES] crawler .env, .git, .config, etc.	Bad Web Bot Web App Attack
🇦🇹 SchiWaGoA	2026-11-11 23:26:42 UTC · (3 hours ago)	fail2ban npm-scanner: Web vulnerability scanning (probing for .env, .git, phpinfo and similar files)	Web App Attack Bad Web Bot
🇺🇸 TPI-Abuse	2026-11-11 23:25:05 UTC · (3 hours ago)	(mod_security) mod_security (id:210492) triggered by 67.220.94.52 (52-94-220-67.clients.gthost.com): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 18:24:57.371543 2026] [security2:error] [pid 3697:tid 3697] [cl ... show more (mod_security) mod_security (id:210492) triggered by 67.220.94.52 (52-94-220-67.clients.gthost.com): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 18:24:57.371543 2026] [security2:error] [pid 3697:tid 3697] [client 67.220.94.52:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ard.global"] [uri "/.svn/wc.db"] [unique_id "avT5SYVTIhbDGs6BH6WsKAAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-11-11 23:00:11 UTC · (3 hours ago)	Blocked by Fail2Ban rule: Vulnerability scanners ...	Bad Web Bot Web App Attack
🇩🇪 london2038.com	2026-11-11 21:08:11 UTC · (5 hours ago)	Probing for exploits 67.220.94.52 - - [11/Nov/2026:22:06:02 +0100] "GET /.svn/wc.db HTTP/1.1" 301 169 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:115.0) Gecko/20100101 Firefox/115.0" 67.220.94.52 - - [11/Nov/2026:22:08:07 +0100] "GET /.svn/wc.d ... show more Probing for exploits 67.220.94.52 - - [11/Nov/2026:22:06:02 +0100] "GET /.svn/wc.db HTTP/1.1" 301 169 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:115.0) Gecko/20100101 Firefox/115.0" 67.220.94.52 - - [11/Nov/2026:22:08:07 +0100] "GET /.svn/wc.db HTTP/1.1" 301 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:115.0) Gecko/20100101 Firefox/115.0" show less	Hacking Web App Attack
🇫🇷 OrchidsRadiant	2026-11-11 20:31:08 UTC · (6 hours ago)	mirror2.urbanterror.info:443 67.220.94.52 - - [11/Nov/2026:18:54:15 +0000] "GET /.svn/wc.db HTTP/1.1" 404 118 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:115.0) Gecko/20100101 Firefox/115.0" mirror2.urbanterror.info:443 67.220.94.52 - - [11/Nov ... show more mirror2.urbanterror.info:443 67.220.94.52 - - [11/Nov/2026:18:54:15 +0000] "GET /.svn/wc.db HTTP/1.1" 404 118 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:115.0) Gecko/20100101 Firefox/115.0" mirror2.urbanterror.info:443 67.220.94.52 - - [11/Nov/2026:18:54:15 +0000] "GET /.svn/entries HTTP/1.1" 404 118 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:115.0) Gecko/20100101 Firefox/115.0" mirror2.urbanterror.info:443 67.220.94.52 - - [11/Nov/2026:20:31:06 +0000] "GET /.git/HEAD HTTP/1.1" 404 118 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:137.0) Gecko/20100101 Firefox/137.0" mirror2.urbanterror.info:443 67.220.94.52 - - [11/Nov/2026:20:31:07 +0000] "GET /app/.git/HEAD HTTP/1.1" 404 118 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:137.0) Gecko/20100101 Firefox/137.0" mirror2.urbanterror.info:443 67.220.94.52 - - [11/Nov/2026:20:31:07 +0000] "GET /www/.git/HEAD HTTP/1.1" 404 118 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:137.0) Gecko/20100101 Firefox/137.0" mirror2. ... show less	Bad Web Bot Web App Attack
Anonymous	2026-11-11 20:09:16 UTC · (6 hours ago)	LH-Watcher: HONEYPOT	Hacking SSH
🇺🇸 RonnieGas	2026-11-11 18:28:03 UTC · (8 hours ago)	Automated scanning and API/path probing against a web application (login, API and path enumeration, proxy pool). Blocked by firewall.	Web App Attack Bad Web Bot Brute-Force Hacking
🇦🇺 aranguren.org	2026-11-11 14:00:03 UTC · (12 hours ago)	67.220.94.52 - - [12/Nov/2026:00:58:14 +1100] "GET /.svn/wc.db HTTP/1.1" 404 995 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:115.0) Gecko/20100101 Firefox/115.0" 67.220.94.52 - - [12/Nov/2026:00:58:15 +1100] "GET /.svn/entries HTTP/1.1" 404 995 ... show more 67.220.94.52 - - [12/Nov/2026:00:58:14 +1100] "GET /.svn/wc.db HTTP/1.1" 404 995 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:115.0) Gecko/20100101 Firefox/115.0" 67.220.94.52 - - [12/Nov/2026:00:58:15 +1100] "GET /.svn/entries HTTP/1.1" 404 995 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:115.0) Gecko/20100101 Firefox/115.0" 67.220.94.52 - - [12/Nov/2026:01:00:02 +1100] "GET /.svn/wc.db HTTP/1.1" 404 995 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:115.0) Gecko/20100101 Firefox/115.0" ... show less	Bad Web Bot
🇺🇸 TPI-Abuse	2026-11-11 13:57:31 UTC · (12 hours ago)	(mod_security) mod_security (id:210492) triggered by 67.220.94.52 (52-94-220-67.clients.gthost.com): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 08:57:22.446502 2026] [security2:error] [pid 24288:tid 24288] [ ... show more (mod_security) mod_security (id:210492) triggered by 67.220.94.52 (52-94-220-67.clients.gthost.com): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 08:57:22.446502 2026] [security2:error] [pid 24288:tid 24288] [client 67.220.94.52:42342] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cyphersites.com.marveldirectory.com"] [uri "/.svn/wc.db"] [unique_id "avR0QmTj_Z9Xyl_48lQtgwAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-11-11 11:27:13 UTC · (15 hours ago)	(mod_security) mod_security (id:210492) triggered by 67.220.94.52 (52-94-220-67.clients.gthost.com): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 06:27:01.641062 2026] [security2:error] [pid 1293:tid 1293] [cl ... show more (mod_security) mod_security (id:210492) triggered by 67.220.94.52 (52-94-220-67.clients.gthost.com): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 06:27:01.641062 2026] [security2:error] [pid 1293:tid 1293] [client 67.220.94.52:59034] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.boblog111.com"] [uri "/.svn/wc.db"] [unique_id "avRRBV8N42dISrb2fsdilQAAAAo"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 SX Communications	2026-11-11 09:48:11 UTC · (16 hours ago)	Web vulnerability scanning / probing from 67.220.94.52: automated requests for CMS admin paths, login endpoints, xmlrpc, and common scanner fingerprints over HTTPS. 8 hits; paths: /.git.tar.gz, /.git.zip, /.git/HEAD, /app/.git/HEAD, /html/.git/HEAD.	Port Scan Hacking Web App Attack

Showing 1 to 15 of 38 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇨🇳 223.90.232.158

🇳🇱 45.148.10.157

🇧🇷 205.210.31.212

🇬🇧 195.96.139.12

🇳🇱 178.62.205.65

🇧🇷 177.44.71.73

🇺🇸 162.216.150.31

🇸🇬 101.100.194.252

🇬🇧 80.1.100.23

🇷🇸 77.105.37.219

🇺🇸 76.119.202.31

🇺🇸 66.132.195.61

🇺🇸 66.132.186.206

🇩🇪 64.89.160.111

🇺🇸 45.156.129.67

🇺🇸 44.223.26.19

🇧🇪 35.210.72.197

🇧🇪 35.210.41.209

🇩🇪 8.211.45.42

🇺🇸 2604:a880:400:d1:0:5:5792:d001