JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 94.136.191.81

94.136.191.81 was found in our database!

This IP was reported 27 times. Confidence of Abuse is 83%: ?

83%

ISP	Contabo GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS141995
Hostname(s)	ind.s2.future18.com
Domain Name	contabo.com
Country	🇮🇳 India
City	Mumbai, Maharashtra

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 94.136.191.81

Whois 94.136.191.81

IP Abuse Reports for 94.136.191.81:

This IP address has been reported a total of 27 times from 17 distinct sources. 94.136.191.81 was first reported on August 25th 2026, and the most recent report was 1 day ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇿🇦 conure.sh	2026-09-15 12:02:52 (1 day ago)	csagent: score 19.9: 404 noise floor x2, wp-config backup grab x2; 1 domain(s) in 11s	Web App Attack
🇳🇱 Alt255	2026-09-15 10:53:20 (1 day ago)	[ti-17al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Exam ... show more [ti-17al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 94.136.191.81 - - [15/Sep/2026:12:53:04 +0200] "GET /wp-config.php.save HTTP/1.1" 404 7886 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" ... show less	Bad Web Bot Web App Attack
Anonymous	2026-09-15 04:06:42 (1 day ago)	(mod_security) mod_security triggered on hostname [redacted] 94.136.191.81 (IN/India/ind.s2.future18 ... show more (mod_security) mod_security triggered on hostname [redacted] 94.136.191.81 (IN/India/ind.s2.future18.com) show less	SQL Injection
🇩🇪 FeG Deutschland	2026-09-15 03:46:49 (1 day ago)	Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 2	Exploited Host Web App Attack
🇬🇧 Apache	2026-09-15 03:12:58 (1 day ago)	(mod_security) mod_security (id:210492) triggered by 94.136.191.81 (IN/India/ind.s2.future18.com): 5 ... show more (mod_security) mod_security (id:210492) triggered by 94.136.191.81 (IN/India/ind.s2.future18.com): 5 in the last 300 secs show less	Brute-Force Web App Attack
🇩🇪 paissangroup	2026-09-15 02:19:58 (2 days ago)	Multiple WAF Violations	Web App Attack
🇧🇪 taivas.nl	2026-09-15 00:02:11 (2 days ago)	Bad_requests	Bad Web Bot
🇺🇸 TPI-Abuse	2026-09-14 23:26:34 (2 days ago)	(mod_security) mod_security (id:210492) triggered by 94.136.191.81 (ind.s2.future18.com): 1 in the l ... show more (mod_security) mod_security (id:210492) triggered by 94.136.191.81 (ind.s2.future18.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 14 19:26:26.162718 2026] [security2:error] [pid 10921:tid 10921] [client 94.136.191.81:41814] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "arsenalfordemocracy.com"] [uri "/wp-config.php.bak"] [unique_id "aqiCoj6MkyXeWvBfik7sdwAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack
🇬🇧 Apache	2026-09-14 18:20:53 (2 days ago)	(mod_security) mod_security (id:930130) triggered by 94.136.191.81 (IN/India/ind.s2.future18.com): 5 ... show more (mod_security) mod_security (id:930130) triggered by 94.136.191.81 (IN/India/ind.s2.future18.com): 5 in the last 300 secs (CF_ENABLE) show less	Brute-Force Web App Attack
Anonymous	2026-09-14 18:07:04 (2 days ago)	Bot / scanning and/or hacking attempts: GET /wp-config.php~ HTTP/1.1	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-09-14 15:56:03 (2 days ago)	(mod_security) mod_security (id:210492) triggered by 94.136.191.81 (ind.s2.future18.com): 1 in the l ... show more (mod_security) mod_security (id:210492) triggered by 94.136.191.81 (ind.s2.future18.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 14 11:55:55.767212 2026] [security2:error] [pid 23777:tid 23777] [client 94.136.191.81:43830] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.tttns.com"] [uri "/about-jason//wp-config.php.save"] [unique_id "aqgZC5X4Ldcb-hx7CaPCPAAAABg"] show less	Brute-Force Bad Web Bot Web App Attack
🇿🇦 conure.sh	2026-09-14 13:37:49 (2 days ago)	csagent: score 19.9: wp-config backup grab x2, 404 noise floor x2; 1 domain(s) in 11s	Web App Attack
🇺🇸 TAY	2026-09-14 11:17:58 (2 days ago)	94.136.191.81 - - [14/Sep/2026:19:15:30 +0800] "GET /wp-config.php.bak HTTP/1.1" 301 6080 "-" "Mozil ... show more 94.136.191.81 - - [14/Sep/2026:19:15:30 +0800] "GET /wp-config.php.bak HTTP/1.1" 301 6080 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" 94.136.191.81 - - [14/Sep/2026:19:16:11 +0800] "GET /wp-config.php~ HTTP/1.1" 301 6077 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" 94.136.191.81 - - [14/Sep/2026:19:16:22 +0800] "GET /wp-config.php~ HTTP/1.1" 404 91822 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" 94.136.191.81 - - [14/Sep/2026:19:17:43 +0800] "GET /wp-config.php.txt HTTP/1.1" 301 6080 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" 94.136.191.81 - - [14/Sep/2026:19:17:51 +0800] "GET /wp-config.php.txt HTTP/1.1" 404 91822 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gec ... show less	Brute-Force
🇲🇾 Rizzy	2026-09-14 10:54:41 (2 days ago)	Multiple WAF Violations	Brute-Force Web App Attack
Anonymous	2026-09-14 10:30:33 (2 days ago)	IP matched detection query 20 more in short time bad rqs.	Brute-Force Web App Attack Hacking

Showing 1 to 15 of 27 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 205.210.31.96

🇬🇧 193.163.125.186

🇩🇪 167.99.252.136

🇺🇸 159.223.196.230

🇻🇳 103.28.38.126

🇫🇷 85.217.140.3

🇳🇱 45.148.10.246

🇦🇺 45.132.224.99

🇧🇷 45.65.231.56

🇵🇾 181.94.224.144

🇺🇸 162.216.150.186

🇬🇹 154.223.128.37

🇿🇦 105.245.98.71

🇦🇴 102.130.193.150

🇳🇱 91.92.42.181

🇺🇸 70.181.101.157

🇺🇸 66.228.53.4

🇨🇳 218.17.217.141

🇺🇸 216.25.89.132

🇲🇽 187.212.43.1