JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 94.103.172.56

94.103.172.56 was found in our database!

This IP was reported 73 times. Confidence of Abuse is 100%: ?

100%

ISP	Nexorahost.com
Usage Type	Data Center/Web Hosting/Transit
ASN	AS44486
Domain Name	nexorahost.com
Country	🇩🇪 Germany
City	Frankfurt am Main, Hesse

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 94.103.172.56

Whois 94.103.172.56

IP Abuse Reports for 94.103.172.56:

This IP address has been reported a total of 73 times from 62 distinct sources. 94.103.172.56 was first reported on June 27th 2026, and the most recent report was 10 minutes ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 NXTwoThou	2026-06-28 12:53:22 (10 minutes ago)	/cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh	Web App Attack
Anonymous	2026-06-28 12:40:22 (23 minutes ago)	Aggressive web scan	Web App Attack
🇩🇪 ghostwarriors	2026-06-28 11:50:16 (1 hour ago)	Webpage scraping	Brute-Force Bad Web Bot Web App Attack
🇮🇹 Progetto1	2026-06-28 11:30:24 (1 hour ago)	Multiple exploit attempts	Hacking Brute-Force Exploited Host Web App Attack
Anonymous	2026-06-28 09:49:47 (3 hours ago)	Apache CVE-2021-41773 exploitation attempt	Web App Attack
Anonymous	2026-06-28 08:57:08 (4 hours ago)	fail2ban_an apache-modsecurity [msg "Inbound Anomaly Score Exceeded (Total Score: 28)"] [uri "/hello ... show more fail2ban_an apache-modsecurity [msg "Inbound Anomaly Score Exceeded (Total Score: 28)"] [uri "/hello.world"] show less	Bad Web Bot Web App Attack
Anonymous	2026-06-28 07:46:03 (5 hours ago)	Bot / scanning and/or hacking attempts: POST /cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/% ... show more Bot / scanning and/or hacking attempts: POST /cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32, POST /hello.world?%ADd+allow_url_include%3d1+%ADd+auto_prepend_, POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e show less	Hacking Web App Attack
🇮🇪 Jim Keir	2026-06-28 06:02:42 (7 hours ago)	2026-06-28 06:02:42 94.103.172.56 File scanning, blocking 94.103.172.56 for 5 minutes	Web App Attack
🇺🇸 TPI-Abuse	2026-06-28 05:42:55 (7 hours ago)	(mod_security) mod_security (id:218420) triggered by 94.103.172.56 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:218420) triggered by 94.103.172.56 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 28 01:42:47.433289 2026] [security2:error] [pid 19958:tid 19971] [client 94.103.172.56:53782] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)php://(std(in\|out\|err)\|(in\|out)put\|fd\|memory\|temp\|filter)" at ARGS_NAMES:\\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/21_PHP_PHPGen.conf"] [line "22"] [id "218420"] [rev "2"] [msg "COMODO WAF: PHP Injection Attack: I/O Stream Found\|\|192.64.150.44:80\|F\|2"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [tag "CWAF"] [tag "PHPGen"] [hostname "192.64.150.44"] [uri "/hello.world"] [unique_id "akC0V6FWyWO58K8IsqN9EgAAAMs"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-06-28 05:26:22 (7 hours ago)	...	Bad Web Bot
Anonymous	2026-06-28 05:23:57 (7 hours ago)	[Sun Jun 28 07:23:56.212464 2026] [proxy_fcgi:error] [pid 55603:tid 55645] [client 94.103.172.56:558 ... show more [Sun Jun 28 07:23:56.212464 2026] [proxy_fcgi:error] [pid 55603:tid 55645] [client 94.103.172.56:55828] AH01071: Got error 'Primary script unknown' [Sun Jun 28 07:23:56.250723 2026] [proxy_fcgi:error] [pid 55603:tid 55651] [client 94.103.172.56:55828] AH01071: Got error 'Primary script unknown' [Sun Jun 28 07:23:56.272218 2026] [proxy_fcgi:error] [pid 55603:tid 55650] [client 94.103.172.56:55828] AH01071: Got error 'Primary script unknown' [Sun Jun 28 07:23:56.300668 2026] [proxy_fcgi:error] [pid 55603:tid 55636] [client 94.103.172.56:55828] AH01071: Got error 'Primary script unknown' [Sun Jun 28 07:23:56.339288 2026] [proxy_fcgi:error] [pid 55603:tid 55631] [client 94.103.172.56:55828] AH01071: Got error 'Primary script unknown' ... show less	Brute-Force Web App Attack
🇦🇺 2000cn.com.au	2026-06-28 05:02:04 (8 hours ago)	This IP was detected by CrowdSec triggering crowdsecurity/http-cve-2021-41773	Web App Attack Hacking
🇩🇪 Holger	2026-06-28 04:32:24 (8 hours ago)	URL probing: GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php	Web App Attack
🇧🇷 diego	2026-06-28 04:20:20 (8 hours ago)	[probe-44-49] 2026-06-28 04:04:42, Client: 94.103.172.56, Protocol: 6, Unauthorized activity to HTTP ... show more [probe-44-49] 2026-06-28 04:04:42, Client: 94.103.172.56, Protocol: 6, Unauthorized activity to HTTP: POST /cgi-bin/../../../../../../../../../../bin/sh show less	Web App Attack
🇳🇱 tpjg	2026-06-28 04:09:43 (8 hours ago)	Automated: 15 requests with error status in 120s window from 94.103.172.56. Evidence: /lib/phpunit/p ... show more Automated: 15 requests with error status in 120s window from 94.103.172.56. Evidence: /lib/phpunit/phpunit/Util/PHP/eval-stdin.php:404,/lib/phpunit/phpunit/src/Util/PHP/eval-stdin.php:404,/phpunit/Util/PHP/eval-stdin.php:404,/phpunit/src/Util/PHP/eval-stdin.php:404,/phpunit/phpunit/Util/PHP/eval-stdin.php:404,/phpunit/phpunit/src/Util/PHP/eval-stdin.php:404,/vendor/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php:404,/vendor/phpunit/phpunit/LICENSE/eval-stdin.php:404,/vendor/phpunit/Util/PHP/eval-stdin.php:404,/vendor/phpunit/src/Util/PHP/eval-stdin.php:404,/vendor/phpunit/phpunit/Util/PHP/eval-stdin.php:404,/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php:404,/hello.world:404,/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh:404,/cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh:404 show less	Web App Attack

Showing 1 to 15 of 73 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 206.189.231.1

🇨🇳 183.61.109.221

🇦🇷 181.209.76.203

🇺🇸 172.245.252.130

🇭🇰 114.111.52.109

🇺🇸 192.210.150.198

🇧🇩 165.101.222.23

🇺🇸 107.175.87.129

🇮🇹 93.34.18.52

🇬🇧 87.236.176.131

🇺🇸 74.125.180.17

🇱🇹 62.60.130.219

🇳🇱 45.148.10.240

🇺🇸 44.220.185.155

🇨🇳 36.103.229.21

🇨🇳 175.165.129.213

🇮🇹 172.69.68.99

🇩🇪 165.227.172.206

🇺🇸 136.144.35.158

🇫🇷 89.84.222.210