JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 109.245.129.115

109.245.129.115 was found in our database!

This IP was reported 9 times. Confidence of Abuse is 53%: ?

53%

ISP	Cetin doo Serbia fixed-mobile access to the Internet
Usage Type	Mobile ISP
ASN	AS15958
Hostname(s)	net115-129-245-109.dynamic.mbb.yettel.rs
Domain Name	cetin.rs
Country	🇷🇸 Serbia
City	Novi Beograd, Central Serbia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 109.245.129.115

Whois 109.245.129.115

IP Abuse Reports for 109.245.129.115:

This IP address has been reported a total of 9 times from 8 distinct sources. 109.245.129.115 was first reported on September 8th 2026, and the most recent report was 12 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇷 LRob	2026-09-11 05:00:16 (12 hours ago)	Asking over plain http and never following the redirect served — a crawler that reads nothing it ask ... show more Asking over plain http and never following the redirect served — a crawler that reads nothing it asks for \| method: GET \| path: /sitemap.xml \| 2026-09-11 05:00 UTC show less	Bad Web Bot
🇩🇪 Hazzard	2026-09-10 09:03:36 (1 day ago)	(wordpress) Failed wordpress login from 109.245.129.115 (RS/Serbia/Belgrade/Belgrade/net115-129-245- ... show more (wordpress) Failed wordpress login from 109.245.129.115 (RS/Serbia/Belgrade/Belgrade/net115-129-245-109.dynamic.mbb.yettel.rs/[redacted]): (CF_ENABLE) show less	Brute-Force
🇺🇸 cwytech	2026-09-10 08:19:21 (1 day ago)	Fleet-wide ban from the Ghostfleet 👻. Triggered by scenario: cwy/wordpress-login-lockdown-high.	Bad Web Bot Web App Attack
🇬🇪 ORDUNET	2026-09-09 14:55:40 (2 days ago)	Botnet UDP flood (DDoS) against a host in AS203136 (LLC Ordunet), Georgia, on 2026-09-09 between 18: ... show more Botnet UDP flood (DDoS) against a host in AS203136 (LLC Ordunet), Georgia, on 2026-09-09 between 18:00 and 19:30 local time (+04:00). This source sent UDP to port 47472 of 185.143.177.x at more than 800 packets/sec. Nothing listens on that port - repeated full packet captures of all traffic reaching this machine recorded its services on other UDP ports and never a single packet to 47472 - so this cannot be a client of anything; it is flood by definition, independent of any rate measurement. One of 2743 sources in 1270 networks and 136 countries in the same wave. Detected on a MikroTik RouterOS router in the raw/prerouting chain (dst-limit 800,200,src-address/10s); the timestamp is when this source crossed the threshold. The host is almost certainly compromised and part of a botnet. Evidence: [email protected]. show less	DDoS Attack Exploited Host
🇺🇸 nationaleventpros.com	2026-09-09 14:02:06 (2 days ago)	WordPress login attempt	Brute-Force
🇫🇷 masterguru	2026-09-09 02:39:29 (2 days ago)	(modsec_5040) ModSec 5040: API Basic Auth blocked from 109.245.129.115 (RS/Serbia/net115-129-245-109 ... show more (modsec_5040) ModSec 5040: API Basic Auth blocked from 109.245.129.115 (RS/Serbia/net115-129-245-109.dynamic.mbb.yettel.rs): 1 in the last 3600 secs (0-196) show less	Hacking
🇺🇸 TPI-Abuse	2026-09-09 01:31:14 (2 days ago)	(mod_security) mod_security (id:225170) triggered by 109.245.129.115 (net115-129-245-109.dynamic.mbb ... show more (mod_security) mod_security (id:225170) triggered by 109.245.129.115 (net115-129-245-109.dynamic.mbb.yettel.rs): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 08 21:31:09.681059 2026] [security2:error] [pid 24214:tid 24214] [client 109.245.129.115:46612] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|daebakdesign.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "daebakdesign.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "aqC23UaEm8Eb2F8vovfRNgAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-09-08 16:09:02 (3 days ago)	(mod_security) mod_security (id:225170) triggered by 109.245.129.115 (net115-129-245-109.dynamic.mbb ... show more (mod_security) mod_security (id:225170) triggered by 109.245.129.115 (net115-129-245-109.dynamic.mbb.yettel.rs): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 08 12:08:57.580489 2026] [security2:error] [pid 1339:tid 1378] [client 109.245.129.115:46678] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|www.store.emehache.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.store.emehache.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "aqAzGQrP3EOguvVEFYqsigAAAYo"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 lostswordfish.com	2026-09-08 12:44:03 (3 days ago)	Wordfence waf block on baystatereentrynetwork	Web App Attack

Showing 1 to 9 of 9 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇭 209.99.190.174

🇸🇬 207.166.168.11

🇲🇽 200.52.196.233

🇷🇺 195.206.43.43

🇺🇸 173.239.213.62

🇨🇦 167.114.96.241

🇺🇸 165.22.145.89

🇸🇬 157.245.157.155

🇲🇾 113.23.225.9

🇷🇺 109.194.7.110

🇸🇪 78.70.41.148

🇺🇸 35.252.138.164

🇸🇬 35.187.231.181

🇧🇷 187.54.141.79

🇹🇷 185.21.7.202

🇧🇷 177.220.170.28

🇻🇳 171.235.23.158

🇯🇵 160.251.253.29

🇫🇷 145.239.112.29

🇺🇸 137.131.43.163