JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 96.44.167.54

96.44.167.54 was found in our database!

This IP was reported 17 times. Confidence of Abuse is 88%: ?

88%

ISP	HostPapa
Usage Type	Data Center/Web Hosting/Transit
ASN	AS36352
Hostname(s)	96-44-167-54-host.colocrossing.com
Domain Name	hostpapa.com
Country	🇨🇦 Canada
City	Toronto, Ontario

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 96.44.167.54

Whois 96.44.167.54

IP Abuse Reports for 96.44.167.54:

This IP address has been reported a total of 17 times from 16 distinct sources. 96.44.167.54 was first reported on June 9th 2026, and the most recent report was 14 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇷 SpaceHost-Server	2026-07-08 22:32:13 (14 hours ago)		Brute-Force Web App Attack
🇳🇱 homeshowdomain.nl	2026-07-08 21:59:48 (14 hours ago)	Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ... show more Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-07-07. show less	Web App Attack SSH Hacking
🇺🇸 Charlesiv	2026-07-08 06:01:37 (1 day ago)	Triggered Cloudflare WAF (firewallCustom) from CA. Action taken: BLOCK ASN: 36352 (HostPapa) Protoco ... show more Triggered Cloudflare WAF (firewallCustom) from CA. Action taken: BLOCK ASN: 36352 (HostPapa) Protocol: HTTP/1.1 (GET method) Endpoint: /wp-content/uploads/pentest_proof_e66a6d.php Timestamp: 2026-07-08T05:15:11Z Ray ID: a17c9c156fd3abe5 UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:133.0) Gecko/20100101 Firefox/133.0 show less	Bad Web Bot
🇩🇪 XICTRON	2026-07-08 05:50:05 (1 day ago)	ModSecurity rule violation detected by Fail2Ban	Web App Attack
🇧🇪 cmbplf	2026-07-08 03:41:40 (1 day ago)	287 requests with url.path .aws/	Brute-Force Bad Web Bot
🇫🇷 LRob	2026-07-08 03:37:58 (1 day ago)	CrowdSec: crowdsecurity/http-sensitive-files \| req: ["/.env","/.env.bak","/.env.backup","/.env.save" ... show more CrowdSec: crowdsecurity/http-sensitive-files \| req: ["/.env","/.env.bak","/.env.backup","/.env.save","/.env.local"] \| UA: ["-"] show less	Hacking
Anonymous	2026-07-08 03:36:47 (1 day ago)	Requested unexistent endpoint (Wordpress login, etc.)	Web App Attack
Anonymous	2026-07-08 03:07:44 (1 day ago)	Blocked by FortiWeb WAF ML threat detection. ML probability: 99%, Country: CA, Attack patterns: Word ... show more Blocked by FortiWeb WAF ML threat detection. ML probability: 99%, Country: CA, Attack patterns: WordPress scanning, Backup file probing, Cloud secrets probing show less	Bad Web Bot Web App Attack
🇩🇪 macrob	2026-07-08 02:44:27 (1 day ago)	2026/07/08 02:44:25 [error] 2077149#2077149: 359123712 access forbidden by rule, client: 96.44.167. ... show more 2026/07/08 02:44:25 [error] 2077149#2077149: 359123712 access forbidden by rule, client: 96.44.167.54, server: bin-spin.com, request: "GET /.env HTTP/1.1", host: "bin-spin.com" 2026/07/08 02:44:25 [error] 2077154#2077154: 359123155 access forbidden by rule, client: 96.44.167.54, server: bin-spin.com, request: "GET /.env.bak HTTP/1.1", host: "bin-spin.com" 2026/07/08 02:44:25 [error] 2077149#2077149: 359123720 access forbidden by rule, client: 96.44.167.54, server: bin-spin.com, request: "GET /.env.backup HTTP/1.1", host: "bin-spin.com" ... show less	Web App Attack
🇺🇸 mnsf	2026-07-08 02:05:11 (1 day ago)	Scanning/Probing (13)	Brute-Force Web App Attack
🇩🇪 Melle	2026-07-08 00:47:38 (1 day ago)	Blocked by CrowdSec \| Scenario: crowdsecurity/http-sensitive-files \| 96.44.167.54 triggered 5 events ... show more Blocked by CrowdSec \| Scenario: crowdsecurity/http-sensitive-files \| 96.44.167.54 triggered 5 events \| Detected: 2026-07-08T00:47:36.612019948Z show less	Web App Attack Hacking
🇨🇦 Dunham Support	2026-07-07 23:51:13 (1 day ago)	(mod_security) mod_security triggered on hostname [redacted] 96.44.167.54 (CA/Canada/96-44-167-54-ho ... show more (mod_security) mod_security triggered on hostname [redacted] 96.44.167.54 (CA/Canada/96-44-167-54-host.colocrossing.com) show less	SQL Injection
🇺🇸 TPI-Abuse	2026-07-07 23:31:58 (1 day ago)	(mod_security) mod_security (id:210492) triggered by 96.44.167.54 (96-44-167-54-host.colocrossing.co ... show more (mod_security) mod_security (id:210492) triggered by 96.44.167.54 (96-44-167-54-host.colocrossing.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 07 19:31:54.426958 2026] [security2:error] [pid 21976:tid 21976] [client 96.44.167.54:64142] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.murphylumber.ca"] [uri "/.env"] [unique_id "ak2MauX17nRwMsTdIXq9lQAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-07-07 22:49:44 (1 day ago)	96.44.167.54 - - [08/Jul/2026:00:49:42 +0200] "POST /index.php HTTP/1.1" 404 164 "-" "Mozilla/5.0 (X ... show more 96.44.167.54 - - [08/Jul/2026:00:49:42 +0200] "POST /index.php HTTP/1.1" 404 164 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:133.0) Gecko/20100101 Firefox/133.0" 96.44.167.54 - - [08/Jul/2026:00:49:43 +0200] "POST /public/ HTTP/1.1" 404 164 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.1 Mobile/15E148 Safari/604.1" 96.44.167.54 - - [08/Jul/2026:00:49:43 +0200] "POST /index.php HTTP/1.1" 404 567 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Edg/129.0.0.0" 96.44.167.54 - - [08/Jul/2026:00:49:43 +0200] "GET /.env HTTP/1.1" 403 164 "-" "-" 96.44.167.54 - - [08/Jul/2026:00:49:43 +0200] "GET /.env.bak HTTP/1.1" 403 164 "-" "-" 96.44.167.54 - - [08/Jul/2026:00:49:43 +0200] "GET /.env.backup HTTP/1.1" 403 164 "-" "-" 96.44.167.54 - - [08/Jul/2026:00:49:43 +0200] "GET /.env.old HTTP/1.1" 403 164 "-" "-" 96.44.167.54 - - [08/Jul/2026:00:49:43 +0200] "GET /. ... show less	Bad Web Bot Web App Attack
🇺🇸 Operator873	2026-07-07 20:53:52 (1 day ago)	2026/07/07 15:53:49 [error] 2367316#0: 1323284 access forbidden by rule, client: 96.44.167.54, serv ... show more 2026/07/07 15:53:49 [error] 2367316#0: 1323284 access forbidden by rule, client: 96.44.167.54, server: [OBFUSCATED], request: "POST / HTTP/1.1", host: "[OBFUSCATED]" 2026/07/07 15:53:49 [error] 2367316#0: 1323284 access forbidden by rule, client: 96.44.167.54, server: [OBFUSCATED], request: "POST / HTTP/1.1", host: "[OBFUSCATED]" 2026/07/07 15:53:49 [error] 2367316#0: 1323284 access forbidden by rule, client: 96.44.167.54, server: [OBFUSCATED], request: "POST /public/ HTTP/1.1", host: "[OBFUSCATED]" 2026/07/07 15:53:49 [error] 2367316#0: 1323284 access forbidden by rule, client: 96.44.167.54, server: [OBFUSCATED], request: "POST /public/ HTTP/1.1", host: "[OBFUSCATED]" 2026/07/07 15:53:49 [error] 2367316#0: 1323284 access forbidden by rule, client: 96.44.167.54, server: [OBFUSCATED], request: "POST /index.php HTTP/1.1", host: "[OBFUSCATED]" ... show less	Brute-Force Web App Attack

Showing 1 to 15 of 17 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 144.225.187.57

🇮🇳 40.81.230.77

🇺🇸 195.184.76.182

🇻🇳 171.243.149.144

🇨🇦 158.69.112.181

🇺🇸 64.62.156.142

🇨🇦 2607:5300:205:200::3ef2

🇸🇪 171.25.158.58

🇲🇺 102.117.25.131

🇹🇬 102.64.144.120

🇺🇸 57.141.18.20

🇺🇸 34.135.38.201

🇨🇳 14.29.204.161

🇵🇰 175.107.211.242

🇺🇸 109.105.210.60

🇳🇱 64.89.162.38

🇳🇱 45.148.10.157

🇯🇵 8.216.17.198

🇮🇳 2401:4900:766b:af5c:bc92:adcf:7ae4:7847

🇭🇰 223.197.178.95