JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

154.6.128.125

Activity Trending Down

Abuse Confidence Score

23% Elevated

40 reports

27 reporters · latest 1 month ago

ISP: LogicWeb Inc.
Usage Type: Data Center/Web Hosting/Transit
ASN: AS64286
Domain Name: logicweb.com
Country: 🇺🇸 United States of America
City: New York City, New York

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Example preview

Account required for the enhanced features Log in Sign up

Abuse Reports

Export reports CSV

Total reports

40 from 27 distinct reporters

First reported

August 18th 2026

Most recent report

1 month ago

Last 60 days

Top reporter locations 🇫🇷 France 3 🇩🇪 Germany 2 🇳🇱 Netherlands 2

Most common categories Web App Attack 9 Bad Web Bot 3 Brute-Force 3 Hacking 1

Old reports The most recent abuse report for this IP address is from 1 month ago. It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇰 HostingGroup	2026-09-17 04:31:54 UTC · (1 month ago)	Automated malicious activity (Honeypot Trap) detected and blocked at the CDN edge by NordicCDN Shield. Offenses: 2. First blocked: 2026-09-17.	Bad Web Bot Web App Attack
🇳🇱 e.fierstra	2026-09-17 04:06:53 UTC · (1 month ago)	ModSecurity hits exceeded	Bad Web Bot Web App Attack
🇳🇱 Alt255	2026-09-17 00:29:35 UTC · (1 month ago)	[ti-06al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 154.6.128.125 - - [17/Sep/2026:02:29:30 +0200] "GET /.env HTTP/1.1" 404 2898 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" . ... show more [ti-06al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 154.6.128.125 - - [17/Sep/2026:02:29:30 +0200] "GET /.env HTTP/1.1" 404 2898 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" ... show less	Bad Web Bot Web App Attack
🇩🇪 Vegascosmetics	2026-09-15 23:55:20 UTC · (1 month ago)	Kingcopy.org AI-IDS (Vegas Cosmetics shop): auto-blocked after sensitive config/credentials exposure probe. Evidence: AttackPattern: /\.env (Match: /.env)	Hacking Brute-Force Web App Attack
🇫🇷 SpaceHost-Server	2026-09-15 22:15:59 UTC · (1 month ago)		Brute-Force Web App Attack
🇺🇸 kosada.com	2026-09-15 07:50:54 UTC · (1 month ago)	Repeated requests for suspicious nonexistent URLs, for example: /.git/config (HTTP/1.1 port 443, user agent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36")	Web App Attack
🇫🇷 tecnoacquisti.com	2026-09-15 07:15:01 UTC · (1 month ago)	PrestaShop Security Module: suspicious probe path detected (/.env)	Web App Attack
🇫🇷 SpaceHost-Server	2026-09-14 22:15:30 UTC · (1 month ago)		Brute-Force Web App Attack
🇩🇪 macrob	2026-09-14 00:33:02 UTC · (1 month ago)	2026/09/14 00:32:58 [error] 1442490#1442490: 9226151 access forbidden by rule, client: 154.6.128.125, server: finami.ph, request: "GET /.env HTTP/2.0", host: "finami.ph" 2026/09/14 00:33:00 [error] 1442485#1442485: 9222040 access forbidden by rule, ... show more 2026/09/14 00:32:58 [error] 1442490#1442490: 9226151 access forbidden by rule, client: 154.6.128.125, server: finami.ph, request: "GET /.env HTTP/2.0", host: "finami.ph" 2026/09/14 00:33:00 [error] 1442485#1442485: 9222040 access forbidden by rule, client: 154.6.128.125, server: finami.ph, request: "GET /.env.local HTTP/2.0", host: "finami.ph" 2026/09/14 00:33:01 [error] 1442490#1442490: *9226151 access forbidden by rule, client: 154.6.128.125, server: finami.ph, request: "GET /.env.production HTTP/2.0", host: "finami.ph" ... show less	Web App Attack
🇸🇪 nekopavel	2026-09-12 17:22:58 UTC · (1 month ago)	154.6.128.125 - - [12/Sep/2026:19:22:52 +0200]"GET /.env HTTP/1.1" 200 4153"-" pavel.gg "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36""0.000" "-""New York" "US" 154.6.128.125 - - [12/Sep/2026:19:22:54 +0200]"GET /.env.local HTTP/1.1" ... show more 154.6.128.125 - - [12/Sep/2026:19:22:52 +0200]"GET /.env HTTP/1.1" 200 4153"-" pavel.gg "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36""0.000" "-""New York" "US" 154.6.128.125 - - [12/Sep/2026:19:22:54 +0200]"GET /.env.local HTTP/1.1" 200 4153"-" pavel.gg "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36""0.000" "-""New York" "US" 154.6.128.125 - - [12/Sep/2026:19:22:56 +0200]"GET /.env.production HTTP/1.1" 200 4153"-" pavel.gg "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36""0.000" "-""New York" "US" ... show less	Hacking Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-09-12 12:48:05 UTC · (1 month ago)	(mod_security) mod_security (id:210492) triggered by 154.6.128.125 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 12 08:47:57.668383 2026] [security2:error] [pid 13731:tid 13731] [client 154.6.128.125:52259] M ... show more (mod_security) mod_security (id:210492) triggered by 154.6.128.125 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 12 08:47:57.668383 2026] [security2:error] [pid 13731:tid 13731] [client 154.6.128.125:52259] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "thegoldentether.com"] [uri "/.env"] [unique_id "aqVJ_QYSgLSTsedZU32RNQAAABQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 dynamix	2026-09-12 08:55:14 UTC · (1 month ago)	Multiple WAF Violations	Web App Attack
🇮🇹 CoreTech srl	2026-09-12 05:58:57 UTC · (1 month ago)	cloudlinux2 fail2ban: 2026-09-12 07:54:57,769 fail2ban.filter [1606]: INFO [plesk-wordpress] Found 45.146.55.99 - 2026-09-12 07:54:57cloudlinux2 fail2ban: 2026-09-12 07:56:37,730 fail2ban.filter [1606]: INFO [plesk-wordpress] Fo ... show more cloudlinux2 fail2ban: 2026-09-12 07:54:57,769 fail2ban.filter [1606]: INFO [plesk-wordpress] Found 45.146.55.99 - 2026-09-12 07:54:57cloudlinux2 fail2ban: 2026-09-12 07:56:37,730 fail2ban.filter [1606]: INFO [plesk-wordpress] Found 23.94.155.29 - 2026-09-12 07:56:37cloudlinux2 fail2ban: 2026-09-12 07:57:19,552 fail2ban.filter [1606]: INFO [plesk-modsecurity] Found 154.6.128.125 - 2026-09-12 07:57:19cloudlinux2 fail2ban: 2026-09-12 07:57:21,402 fail2ban.actions [1606]: NOTICE [plesk-modsecurity] Ban 154.6.128.125cloudlinux2 fail2ban: 2026-09-12 07:57:20,263 fail2ban.filter [1606]: INFO [plesk-modsecurity] Found 154.6.128.125 - 2026-09-12 07:57:20cloudlinux2 fail2ban: 2026-09-12 07:57:20,973 fail2ban.filter [1606]: INFO [plesk-modsecurity] Found 154.6.128.125 - 2026-09-12 07:57:20cloudlinux2 fail2ban: 2026-09-12 07:57:21,410 fail2ban.filter [1606]: INFO [recidive] Found 154.6.128.125 - 2026-09-12 07:57:21cloudlinux2 fail2ban: 2026-09-12 0 show less	Web App Attack
🇩🇰 HostingGroup	2026-09-11 22:46:53 UTC · (1 month ago)	Automated malicious activity (Honeypot Trap) detected and blocked at the CDN edge by NordicCDN Shield. Offenses: 2. First blocked: 2026-09-11.	Bad Web Bot Web App Attack
🇧🇾 lns.bz	2026-09-11 20:15:22 UTC · (1 month ago)	Too many 404 requests [BY]	Web App Attack

Showing 1 to 15 of 40 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇺🇦 176.105.196.109

🇨🇦 144.217.243.186

🇺🇸 144.202.92.17

🇺🇸 144.202.12.12

🇳🇱 86.38.187.80

🇮🇹 81.22.224.65

🇺🇸 17.166.24.160

🇻🇳 14.172.163.243

🇬🇧 144.126.235.66

🇬🇧 144.126.226.128

🇺🇿 144.124.199.200

🇹🇼 128.14.237.154

🇨🇳 124.174.32.95

🇯🇵 118.194.236.134

🇻🇳 117.4.247.33

🇨🇳 112.90.2.211

🇮🇳 104.222.165.125

🇮🇳 103.179.196.208

🇫🇷 51.159.111.44

🇺🇸 50.213.31.6