JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 84.201.6.54

84.201.6.54 was found in our database!

This IP was reported 56 times. Confidence of Abuse is 48%: ?

48%

ISP	UltaHost Inc
Usage Type	Data Center/Web Hosting/Transit
ASN	AS214036
Hostname(s)	netserv3.cleantalk.org
Domain Name	ultahost.com
Country	🇩🇪 Germany
City	Frankfurt am Main, Hesse

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 84.201.6.54

Whois 84.201.6.54

IP Abuse Reports for 84.201.6.54:

This IP address has been reported a total of 56 times from 38 distinct sources. 84.201.6.54 was first reported on February 18th 2026, and the most recent report was 1 week ago.

Old Reports: The most recent abuse report for this IP address is from 1 week ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 FeG Deutschland	2026-07-15 15:46:15 (1 week ago)	Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 1247	Exploited Host Web App Attack
🇬🇧 blik2108	2026-07-11 08:42:53 (2 weeks ago)	solentyachtcharter.com:443 84.201.6.54 - - [11/Jul/2026:09:42:50 +0100] "GET /templates/shaper_helix ... show more solentyachtcharter.com:443 84.201.6.54 - - [11/Jul/2026:09:42:50 +0100] "GET /templates/shaper_helix3/layout/_h3x_dirtest_st69.json HTTP/1.1" 404 1975 "https://solentyachtcharter.com/administrator/index.php" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" solentyachtcharter.com:443 84.201.6.54 - - [11/Jul/2026:09:42:51 +0100] "GET /_h3x_vc70den2.php.json?v=1 HTTP/1.1" 404 1975 "https://solentyachtcharter.com/administrator/index.php" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" solentyachtcharter.com:443 84.201.6.54 - - [11/Jul/2026:09:42:51 +0100] "GET /_h3x_vc70den2.php.json HTTP/1.1" 404 1975 "https://solentyachtcharter.com/administrator/index.php" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" solentyachtcharter.com:443 84.201.6.54 - - [11/Jul/2026:09:42:51 +0100] "G ... show less	Web App Attack
🇮🇱 spd.co.il	2026-06-28 13:02:55 (4 weeks ago)	Web application attack detected	Hacking Web App Attack
🇨🇭 YF	2026-06-28 01:05:15 (4 weeks ago)	Attaque distribuée subnet	DDoS Attack Web App Attack
🇧🇪 brechtr	2026-06-26 17:53:41 (1 month ago)	[Press84-BanHammer] 404 flood — 30 hits in 60s — Sourced from: brechtryckaert.com — Request: GET /wp ... show more [Press84-BanHammer] 404 flood — 30 hits in 60s — Sourced from: brechtryckaert.com — Request: GET /wp-content/plugins/magic-login-mail/readme.txt show less	Bad Web Bot Web App Attack
🇩🇪 roxyapi	2026-06-26 16:15:25 (1 month ago)	Honeypot: automated vulnerability scan / web app attack. Last probe: GET /wp-content/plugins/downloa ... show more Honeypot: automated vulnerability scan / web app attack. Last probe: GET /wp-content/plugins/download-manager/readme.txt show less	Web App Attack Bad Web Bot
🇫🇷 conseilgouz	2026-06-25 23:34:23 (1 month ago)	sae-Joomla Admin : try to force the door...	Hacking
🇩🇪 conseilgouz	2026-06-25 23:18:22 (1 month ago)	coe-Joomla Admin : try to force the door...	Hacking
🇺🇸 TPI-Abuse	2026-06-23 17:49:27 (1 month ago)	(mod_security) mod_security (id:212750) triggered by 84.201.6.54 (netserv3.cleantalk.org): 1 in the ... show more (mod_security) mod_security (id:212750) triggered by 84.201.6.54 (netserv3.cleantalk.org): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 23 13:49:20.797269 2026] [security2:error] [pid 24707:tid 24707] [client 84.201.6.54:27790] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\bon(?:abort\|blur\|change\|click\|dblclick\|dragdrop\|error\|focus\|keydown\|keypress\|keyup\|load\|mouse(?:down\|move\|out\|over\|up)\|move\|readystatechange\|reset\|resize\|select\|submit\|unload)\\\\b[^a-zA-Z0-9_]{0,}?=" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/07_XSS_XSS.conf"] [line "69"] [id "212750"] [rev "3"] [msg "COMODO WAF: XSS Attack Detected\|\|k2servicesinc.net\|F\|2"] [data "Matched Data: onfocus= found within REQUEST_URI: /?mappress=embed&name=xssmarker onfocus=alert(1) tabindex=1"] [severity "CRITICAL"] [tag "CWAF"] [tag "XSS"] [hostname "k2servicesinc.net"] [uri "/"] [unique_id "ajrHIIOUGYnJw5vzvK1DIwAAAAo"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-23 17:17:41 (1 month ago)	(mod_security) mod_security (id:212750) triggered by 84.201.6.54 (netserv3.cleantalk.org): 1 in the ... show more (mod_security) mod_security (id:212750) triggered by 84.201.6.54 (netserv3.cleantalk.org): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 23 13:17:34.229248 2026] [security2:error] [pid 30629:tid 30629] [client 84.201.6.54:39992] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\bon(?:abort\|blur\|change\|click\|dblclick\|dragdrop\|error\|focus\|keydown\|keypress\|keyup\|load\|mouse(?:down\|move\|out\|over\|up)\|move\|readystatechange\|reset\|resize\|select\|submit\|unload)\\\\b[^a-zA-Z0-9_]{0,}?=" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/07_XSS_XSS.conf"] [line "72"] [id "212750"] [rev "3"] [msg "COMODO WAF: XSS Attack Detected\|\|cathybermanmft.com\|F\|2"] [data "Matched Data: onfocus= found within REQUEST_URI: /?mappress=embed&name=xssmarker onfocus=alert(1) tabindex=1"] [severity "CRITICAL"] [tag "CWAF"] [tag "XSS"] [hostname "cathybermanmft.com"] [uri "/"] [unique_id "ajq_rtPKqA-sLpktPqOimwAAAAc"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 FeG Deutschland	2026-06-23 17:00:42 (1 month ago)	Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 124	Exploited Host Web App Attack
🇳🇱 enpepet	2026-06-20 21:33:57 (1 month ago)	GENERAL: parametres: [url:uploadCustomIcon=] UA:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi ... show more GENERAL: parametres: [url:uploadCustomIcon=] UA:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 URL:/ca/index.php?option=com_sppagebuilder&task=asset.uploadCustomIcon show less	Port Scan Hacking Brute-Force Bad Web Bot
🇨🇭 4server	2026-06-20 10:59:51 (1 month ago)	[SatJun2012:59:48.3371662026][security2:error][pid3794228:tid3794443][client84.201.6.54:0]ModSecurit ... show more [SatJun2012:59:48.3371662026][security2:error][pid3794228:tid3794443][client84.201.6.54:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"python-requests/\"atREQUEST_HEADERS:User-Agent.[file\"/etc/apache2/conf.d/modsec_rules/20_asl_useragents.conf\"][line\"203\"][id\"332039\"][rev\"4\"][msg\"Atomicorp.comWAFRules:SuspiciousUnusualUserAgent\(python-requests\).Disablethisruleifyouusepython-requests/.\"][severity\"CRITICAL\"][hostname\"www.swisservers.com\"][uri\"/\"][unique_id\"ajZypFSmNwL5M3qTjPvWhAAAAAo\"] show less	Hacking Web App Attack
🇩🇪 Ba-Yu	2026-06-19 20:13:14 (1 month ago)	General hacking/exploits/scanning	Web Spam Hacking Brute-Force Exploited Host Web App Attack
🇩🇪 netclix.gr	2026-06-19 17:46:25 (1 month ago)	(bot_kill_mega) Aggressive Bot Blocked: Python 84.201.6.54 (DE/Germany/netserv3.cleantalk.org): 1 in ... show more (bot_kill_mega) Aggressive Bot Blocked: Python 84.201.6.54 (DE/Germany/netserv3.cleantalk.org): 1 in the last 4600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 84.201.6.54 - - [19/Jun/2026:20:46:10 +0300] "POST /wp-admin/admin-ajax.php HTTP/1.1" 200 82 "-" "Python/3.12 aiohttp/3.13.3" show less	Port Scan

Showing 1 to 15 of 56 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇸🇬 2407:3640:2345:9089::1

🇨🇭 209.99.190.200

🇳🇱 195.178.110.223

🇻🇳 58.187.189.52

🇸🇬 45.82.78.108

🇸🇬 2600:3c15::2000:75ff:feb5:c926

🇧🇷 191.232.199.39

🇺🇦 185.248.130.63

🇷🇺 185.230.241.25

🇺🇸 172.110.223.92

🇩🇪 167.94.145.31

🇯🇵 107.155.15.8

🇺🇸 107.150.105.153

🇮🇳 103.132.243.250

🇵🇰 101.50.83.146

🇷🇴 92.118.39.49

🇸🇪 92.34.129.135

🇳🇱 62.45.193.156

🇬🇷 5.55.47.245

🇺🇸 216.106.178.202