JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

94.156.64.73

Neutral Activity

Abuse Confidence Score

0% Low Risk

991 reports

225 reporters · latest 2 years ago

ISP: SPARKS COMMUNICATIONS LTD
Usage Type: Fixed Line ISP
ASN: AS208893
Domain Name: sparks.travel
Country: 🇬🇧 United Kingdom of Great Britain and Northern Ireland
City: London, England

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

No reports in the last 60 days

94.156.64.73 has been reported 991 times. The most recent report is from 2 years ago.

The full history is preserved below and remains searchable. A 0% score reflects the absence of recent activity, but this is not a guarantee that earlier reports were invalid. Abuse confidence score decays, naturally, over time, when the abusive activity stops.

Abuse Reports

Export reports CSV

Total reports

991 from 225 distinct reporters

First reported

December 7th 2023

Most recent report

2 years ago

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 kkeyser	2024-10-01 22:22:41 (2 years ago)	GET /.env HTTP/1.1	Web App Attack
🇺🇸 lnklnx	2024-09-30 22:30:22 (2 years ago)	www.lnklnx.com:443 94.156.64.73 - - [30/Sep/2024:17:30:22 -0500] "GET /.env HTTP/1.1" 403 4032 "-" "Mozilla/5.0 (X11; Linux x86_64)" ...	Web App Attack
🇵🇱 swiszczu	2024-09-30 21:56:38 (2 years ago)	Fail2Ban automatic report: Multiple forbidden requests in short amount of time: 94.156.64.73 - - [30/Sep/2024:23:56:37 +0200] "GET /project/.env HTTP/1.1" 403 153 "-" "Mozilla/5.0 (X11; Linux x86_64)" "-" 94.156.64.73 - - [30/Sep/2024:23:56:37 +0200] ... show more Fail2Ban automatic report: Multiple forbidden requests in short amount of time: 94.156.64.73 - - [30/Sep/2024:23:56:37 +0200] "GET /project/.env HTTP/1.1" 403 153 "-" "Mozilla/5.0 (X11; Linux x86_64)" "-" 94.156.64.73 - - [30/Sep/2024:23:56:37 +0200] "GET /bot/.env HTTP/1.1" 403 153 "-" "Mozilla/5.0 (X11; Linux x86_64)" "-" 94.156.64.73 - - [30/Sep/2024:23:56:37 +0200] "GET /.env HTTP/1.1" 403 153 "-" "Mozilla/5.0 (X11; Linux x86_64)" "-" 94.156.64.73 - - [30/Sep/2024:23:56:37 +0200] "GET /tradingbot/.env HTTP/1.1" 403 153 "-" "Mozilla/5.0 (X11; Linux x86_64)" "-" 94.156.64.73 - - [30/Sep/2024:23:56:37 +0200] "GET /backup/.env HTTP/1.1" 403 153 "-" "Mozilla/5.0 (X11; Linux x86_64)" "-" 94.156.64.73 - - [30/Sep/2024:23:56:37 +0200] "GET /mywallet/.env HTTP/1.1" 403 153 "-" "Mozilla/5.0 (X11; Linux x86_64)" "-" 94.156.64.73 - - [30/Sep/20 show less	Hacking Web App Attack
🇫🇷 lindi	2024-09-30 14:54:02 (2 years ago)	trying to access .env file ...	Hacking Web App Attack
🇺🇸 Starburst SysOp Team	2024-09-30 09:44:00 (2 years ago)	[Mon Sep 30 09:44:02.147397 2024] [:error] [pid 1580816:tid 1580957] [client 94.156.64.73:42316] [client 94.156.64.73] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwa ... show more [Mon Sep 30 09:44:02.147397 2024] [:error] [pid 1580816:tid 1580957] [client 94.156.64.73:42316] [client 94.156.64.73] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "66.94.106.222"] [uri "/project/.env"] [unique_id "Zvpy4nGgDOMSBDBXTZlPOQAAAJg"] show less	Hacking Brute-Force Web App Attack
🇮🇩 Burayot	2024-09-30 00:49:06 (2 years ago)	LF_MODSEC: (mod_security) mod_security (id:949110) triggered by 94.156.64.73 (BG/Bulgaria/-): 2 in the last 3600 secs	Web App Attack
🇩🇪 Trueforce Threat Report	2024-09-29 19:22:07 (2 years ago)	Automated report, trolling for resource vulnerabilities	Bad Web Bot Web App Attack
🇧🇪 sid3windr	2024-09-29 13:31:17 (2 years ago)	GET /.env (Tarpitted for , wasted 0B)	Web App Attack
🇧🇬 Filipe Dávila	2024-09-29 10:46:01 (2 years ago)	[Sun Sep 29 06:46:00.086644 2024] [[redacted]:error] [pid 4797:tid 140144255366912] [client 94.156.64.73:55868] AH01630: client denied by server configuration: [redacted]/wallet [Sun Sep 29 06:46:00.086690 2024] [[redacted]:error] [pid 4585:tid 14014 ... show more [Sun Sep 29 06:46:00.086644 2024] [[redacted]:error] [pid 4797:tid 140144255366912] [client 94.156.64.73:55868] AH01630: client denied by server configuration: [redacted]/wallet [Sun Sep 29 06:46:00.086690 2024] [[redacted]:error] [pid 4585:tid 140144061388544] [client 94.156.64.73:55850] AH01630: client denied by server configuration: [redacted]/trade [Sun Sep 29 06:46:00.086783 2024] [[redacted]:error] [pid 4583:tid 140144263759616] [client 94.156.64.73:55854] AH01630: client denied by server configuration: [redacted]/bot [Sun Sep 29 06:46:00.086854 2024] [[redacted]:error] [pid 4585:tid 140144052995840] [client 94.156.64.73:55848] AH01630: client denied by server configuration: [redacted]/bitcoin [Sun Sep 29 06:46:00.086937 2024] [[redacted]:error] [pid 4585:tid 140144103352064] [client 94.156.64.73:55852] AH01630: client denied by server configuration: [redacted]/backup show less	Brute-Force Web App Attack
🇵🇱 Roper123	2024-09-29 07:34:30 (2 years ago)	Web app exploits	Web App Attack
🇮🇹 LTM	2024-09-29 06:20:01 (2 years ago)	WebServer - Attempts to exploit	Hacking Brute-Force Web App Attack
🇺🇸 thefoofighter	2024-09-29 00:29:04 (2 years ago)	[Sun Sep 29 00:29:04.456778 2024] [:error] [pid 2639167] [client 94.156.64.73:54686] [client 94.156.64.73] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/usr/share/modsecurity-crs/rules/REQUEST- ... show more [Sun Sep 29 00:29:04.456778 2024] [:error] [pid 2639167] [client 94.156.64.73:54686] [client 94.156.64.73] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "93"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.2"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "63.250.44.172"] [uri "/ethereum/.env"] [unique_id "ZvifUGZp0m5GaXVyof4BdgAAAAc"] [Sun Sep 29 00:29:04.456780 2024] [:error] [pid 2639036] [client 94.156.64.73:54682] [client 94.156.64.73] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "93"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3 ... show less	Bad Web Bot Web App Attack
🇲🇾 Rizzy	2024-09-28 22:51:40 (2 years ago)	Multiple WAF Violations	Brute-Force Web App Attack
🇺🇸 mhhdr	2024-09-28 08:46:31 (2 years ago)	Web attack: Environment Config File Download Attempt. GET /trade/.env.	Web App Attack
🇧🇪 sid3windr	2024-09-28 03:57:54 (2 years ago)	GET /.env (Tarpitted for , wasted 0B)	Web App Attack

Showing 1 to 15 of 991 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇮🇳 136.185.6.181

🇺🇸 129.121.102.54

🇺🇸 98.4.78.60

🇧🇷 45.205.1.230

🇺🇸 45.61.164.190

🇹🇼 35.185.128.251

🇧🇪 34.77.90.164

🇦🇺 2602:f71d:200::30

🇭🇰 219.77.169.219

🇳🇱 213.152.161.123

🇳🇱 204.76.203.233

🇧🇷 201.139.186.238

🇵🇪 179.7.16.95

🇨🇴 177.93.61.202

🇮🇹 130.110.14.194

🇺🇸 129.121.114.109

🇰🇷 119.203.251.187

🇮🇲 89.107.7.109

🇫🇷 84.247.181.198

🇰🇪 62.24.115.97