JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

94.72.102.194

Recent Activity

Abuse confidence score ?

100% Critical

110 reports

78 reporters · latest 13 hours ago

ISP	Contabo GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS51167
Hostname(s)	vmi3288979.contaboserver.net
Domain Name	contabo.com
Country	🇬🇧 United Kingdom of Great Britain and Northern Ireland
City	Portsmouth, England

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Reports Activity

Example preview

Report Categories (Last 60 Days)

Example preview

Top Reporter Countries (Last 60 Days)

Example preview

Account required for the enhanced features Log in Sign up

IP Abuse Reports for 94.72.102.194

This IP address has been reported a total of 110 times from 78 distinct sources. 94.72.102.194 was first reported on January 16th 2026, and the most recent report was 13 hours ago. In the last 60 days, the top reporter locations were: Germany with 22 reports; United States of America with 18 reports; France with 14 reports. The most common categories in these recent reports were: Web App Attack 77 times; Bad Web Bot 26 times; Brute-Force 25 times; Port Scan 19 times; Hacking 18 times; Other 9 times.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇳🇱 BlueWire Hosting	2026-10-01 01:56:04 (13 hours ago)	High-confidence malicious configuration/VCS probe	Web App Attack
🇫🇷 masterguru	2026-10-01 00:29:39 (14 hours ago)	Restricted File Access Attempt. Matched phrase ".env" at REQUEST_FILENAME. (930130-196)	Hacking Web App Attack
🇹🇷 oalver	2026-09-30 23:52:59 (15 hours ago)	Detected by SiberKapan threat intelligence platform (siberkapan.org). Attack types: nginx_404_flood, ... show more Detected by SiberKapan threat intelligence platform (siberkapan.org). Attack types: nginx_404_flood, nginx_path_signature. Sources: nginx. Details: path_signature: request to /.git/config (HTTP 403); 404_flood: 10 requests to /.env.local (HTTP 404) within 60s. First seen: 2026-09-30. Risk score: 45/100. show less	Web App Attack
Anonymous	2026-09-30 23:29:05 (15 hours ago)	(caddyscan) Scanner path probe from 94.72.102.194 (GB/United Kingdom/vmi3288979.contaboserver.net): ... show more (caddyscan) Scanner path probe from 94.72.102.194 (GB/United Kingdom/vmi3288979.contaboserver.net): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 94.72.102.194 - - [30/Sep/2026:23:28:59 +0000] "GET /.env.txt HTTP/1.1" [REDACTED] 200 2627 94.72.102.194 - - [30/Sep/2026:23:28:59 +0000] "GET /.git/config HTTP/1.1" [REDACTED] 200 2627 94.72.102.194 - - [30/Sep/2026:23:28:59 +0000] "GET /.git/HEAD HTTP/1.1" [REDACTED] 200 2627 94.72.102.194 - - [30/Sep/2026:23:28:59 +0000] "GET /.git/index HTTP/1.1" [REDACTED] 200 2627 94.72.102.194 - - [30/Sep/2026:23:28:59 +0000] "GET /.env HTTP/1.1" show less	Port Scan
🇩🇪 FeG Deutschland	2026-09-30 22:36:54 (16 hours ago)	Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 127	Exploited Host Web App Attack
🇺🇸 RamSet	2026-09-30 22:28:57 (16 hours ago)	[ycr] HTTP-Probe on port 443 (via domain). 16 distinct paths probed in 1s. Sustained 16 req/min, 15 ... show more [ycr] HTTP-Probe on port 443 (via domain). 16 distinct paths probed in 1s. Sustained 16 req/min, 15 nonexistent paths (404). Paths: /pathscan-e1c7429baf02-nope.env, /.git/HEAD, /.env.dev, /.git/config, /.env.local, /.env, /.env.backup, /.env.staging, /.git/index, /.env.old, /.env.txt, /.env.bak, /.env.swp, /.env.production, /.env.save show less	Bad Web Bot Web App Attack
🇺🇸 kosada.com	2026-09-30 21:40:11 (17 hours ago)	Repeated exploit attempts, for example: /.env.local /.env (HTTP/1.1 port 443, user agent: "Mozilla/5 ... show more Repeated exploit attempts, for example: /.env.local /.env (HTTP/1.1 port 443, user agent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36") show less	Web App Attack
🇺🇦 URAN Publishing Service	2026-09-30 21:31:44 (17 hours ago)	[01/Oct/2026:00:31:43 +0300] -- 94.72.102.194 Ban reason: Scanner [SENSITIVE_FILES] \| Request: GET / ... show more [01/Oct/2026:00:31:43 +0300] -- 94.72.102.194 Ban reason: Scanner [SENSITIVE_FILES] \| Request: GET /pathscan-4dc7899a5902-nope.env HTTP/1.1 show less	Bad Web Bot Web App Attack
🇬🇧 consul.to	2026-09-30 21:24:10 (17 hours ago)	Web attack/malicious scanning detected	Web App Attack
🇩🇪 mondor.ro	2026-09-30 13:10:29 (1 day ago)	Cluster member 148.251.176.225 (DE/Germany/antares.webyouridea.ro) said, DENY 94.72.102.194, Reason: ... show more Cluster member 148.251.176.225 (DE/Germany/antares.webyouridea.ro) said, DENY 94.72.102.194, Reason:[(mod_security) mod_security (id:210492) triggered by 94.72.102.194 (GB/United Kingdom/vmi3288979.contaboserver.net): 3 in the last 3600 secs]; Ports: *; Direction: inout; Trigger: LF_CLUSTER; Logs: show less	Port Scan
🇫🇷 vtchost.com	2026-09-30 12:22:35 (1 day ago)	to many 403 http errors ...	Brute-Force
🇳🇱 debestelapp	2026-09-30 09:20:07 (1 day ago)		Web App Attack
🇩🇪 Klompenzijncool	2026-09-30 04:22:10 (1 day ago)	Web scanning/probing blocked by Fail2Ban.	Port Scan Bad Web Bot
🇺🇸 wbsouza	2026-09-30 03:32:04 (1 day ago)	CrowdSec: infra/firewall-drop-flood — automated firewall drops on self-hosted IDS sensor	Port Scan
Anonymous	2026-09-30 03:08:57 (1 day ago)	Blocked by siteaihub.com: auto: matched exact:/.git/config	Hacking Bad Web Bot

Showing 1 to 15 of 110 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇴 190.61.40.43

🇦🇺 180.150.41.9

🇧🇷 143.255.197.78

🇳🇱 141.101.76.197

🇺🇸 20.106.60.152

🇺🇸 209.85.160.72

🇧🇷 177.170.83.94

🇨🇳 163.125.197.205

🇸🇪 155.212.109.26

🇭🇰 152.32.212.41

🇮🇳 103.58.152.240

🇳🇬 102.88.137.213

🇺🇸 91.230.168.106

🇺🇸 50.217.40.11

🇸🇰 46.151.198.85

🇷🇴 2.57.122.53

🇦🇺 220.240.154.30

🇬🇧 213.166.84.38

🇳🇱 195.178.110.227

🇲🇽 189.254.200.132