JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 109.252.126.161

109.252.126.161 was found in our database!

This IP was reported 32 times. Confidence of Abuse is 68%: ?

68%

ISP	Moscow Local Telephone Network (OAO MGTS)
Usage Type	Fixed Line ISP
ASN	AS25513
Domain Name	spd-mgts.ru
Country	🇷🇺 Russian Federation
City	Moscow, Moscow

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 109.252.126.161

Whois 109.252.126.161

IP Abuse Reports for 109.252.126.161:

This IP address has been reported a total of 32 times from 11 distinct sources. 109.252.126.161 was first reported on October 21st 2026, and the most recent report was 15 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇷 conseilgouz	2026-10-26 21:23:22 (15 hours ago)	sle-7 : Trying access unauthorized files/dir=>/tmp/963963.phtm	Hacking
🇧🇾 lns.bz	2026-10-26 09:17:49 (1 day ago)	Too many 404 requests [BY]	Web App Attack
🇳🇱 pixelXp	2026-10-26 03:44:36 (1 day ago)	Reason:10 (Web Spam), Via: jasperjaspers.nl/index-ajax.php, Message: detectSuspiciousPost count:6 de ... show more Reason:10 (Web Spam), Via: jasperjaspers.nl/index-ajax.php, Message: detectSuspiciousPost count:6 details: Array - show less	Web Spam
🇳🇱 pixelXp	2026-10-25 22:40:31 (1 day ago)	Reason:15 (Hacking), Via: www.sintannaboxmeer.nl/index-ajax.php, Message: Blocked URL pattern: &#039 ... show more Reason:15 (Hacking), Via: www.sintannaboxmeer.nl/index-ajax.php, Message: Blocked URL pattern: 'index-ajax.php'. [POST] Gevaarlijk woord 'EVAL' in Value in 'search' [+35] #IN_KEYWORD{word=EVAL,part=value,field=search}; Gevaarlijk woord 'eval' in Value in 'ucfg' [+35] #IN_KEYWORD{word=eval,part=value,field=ucfg}; Verdachte string 'base64_decode' in Value in 'ucfg' [+20] #IN_LOOSE{str=base64_decode,part=value,field=ucfg}; Verdachte Base64 content: [ show less	Hacking
🇺🇸 TPI-Abuse	2026-10-25 21:27:04 (1 day ago)	(mod_security) mod_security (id:210730) triggered by 109.252.126.161 (109-252-126-161.nat.spd-mgts.r ... show more (mod_security) mod_security (id:210730) triggered by 109.252.126.161 (109-252-126-161.nat.spd-mgts.ru): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 25 17:27:00.931272 2026] [security2:error] [pid 1947:tid 1947] [client 109.252.126.161:1109] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|alfadventurecenter.org\|F\|2"] [data ".pkg_sourcerer.sys.ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "alfadventurecenter.org"] [uri "/language/en-GB/en-GB.pkg_sourcerer.sys.ini"] [unique_id "at50JN7GiMYMHJlxPj497AAAAAI"], referer: https://alfadventurecenter.org/administrator/manifests/packages/pkg_sourcerer.xml show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 pixelXp	2026-10-25 20:45:15 (1 day ago)	Reason:10 (Web Spam), Via: yopix.nl/index-ajax.php, Message: detectSuspiciousPost count:6 details: A ... show more Reason:10 (Web Spam), Via: yopix.nl/index-ajax.php, Message: detectSuspiciousPost count:6 details: Array - show less	Web Spam
🇬🇧 thetomtaylor.co.uk	2026-10-25 18:00:07 (1 day ago)	Fail2Ban - [WAF]ModSecurity rule violation on modsecurity ... [wa01]	Hacking SQL Injection Web App Attack
🇳🇱 pixelXp	2026-10-25 03:24:22 (2 days ago)	Reason:10 (Web Spam), Via: watishijmooi.nl/index-ajax.php, Message: detectSuspiciousPost count:6 det ... show more Reason:10 (Web Spam), Via: watishijmooi.nl/index-ajax.php, Message: detectSuspiciousPost count:6 details: Array - show less	Web Spam
🇳🇱 Site.eu	2026-10-24 22:50:17 (2 days ago)	Excessive 404/403 errors	Brute-Force
🇨🇭 4server	2026-10-24 18:52:35 (2 days ago)	[SatOct2420:52:27.5626312026][security2:error][pid3623310:tid3623444][client109.252.126.161:0]ModSec ... show more [SatOct2420:52:27.5626312026][security2:error][pid3623310:tid3623444][client109.252.126.161:0]ModSecurity:Accessdeniedwithcode403\(phase2\).OperatorGEmatched5atTX:anomaly_score.[file\"/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf\"][line\"94\"][id\"949110\"][msg\"InboundAnomalyScoreExceeded\(TotalScore:5\)\"][severity\"CRITICAL\"][ver\"OWASP_CRS/3.3.10\"][tag\"application-multi\"][tag\"language-multi\"][tag\"platform-multi\"][tag\"attack-generic\"][hostname\"hosting-domini.ch\"][uri\"/media/sourcerer/js/popup.js\"][unique_id\"atz-ax2Mwr0MObV4VRI7mQAAARM\"] show less	Hacking Web App Attack
🇳🇱 pixelXp	2026-10-24 18:06:16 (2 days ago)	Reason:10 (Web Spam), Via: jasperjaspers.nl/index-ajax.php, Message: detectSuspiciousPost count:6 de ... show more Reason:10 (Web Spam), Via: jasperjaspers.nl/index-ajax.php, Message: detectSuspiciousPost count:6 details: Array - show less	Web Spam
🇫🇷 claude CALVET	2026-10-24 17:04:01 (2 days ago)	gee-7 : Trying access unauthorized files/dir=>/tmp/229229.shtml	Hacking
🇺🇸 TPI-Abuse	2026-10-24 16:29:54 (2 days ago)	(mod_security) mod_security (id:210730) triggered by 109.252.126.161 (109-252-126-161.nat.spd-mgts.r ... show more (mod_security) mod_security (id:210730) triggered by 109.252.126.161 (109-252-126-161.nat.spd-mgts.ru): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 24 12:29:49.996163 2026] [security2:error] [pid 8166:tid 8166] [client 109.252.126.161:2296] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|www.fusteriafontane.com\|F\|2"] [data ".pkg_sourcerer.sys.ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.fusteriafontane.com"] [uri "/language/en-GB/en-GB.pkg_sourcerer.sys.ini"] [unique_id "atzc_dH9Lp-dHp8X83AsigAAAAo"], referer: https://www.fusteriafontane.com/administrator/manifests/packages/pkg_sourcerer.xml show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-10-24 08:39:16 (3 days ago)	(mod_security) mod_security (id:210730) triggered by 109.252.126.161 (109-252-126-161.nat.spd-mgts.r ... show more (mod_security) mod_security (id:210730) triggered by 109.252.126.161 (109-252-126-161.nat.spd-mgts.ru): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 24 04:39:11.986458 2026] [security2:error] [pid 1925:tid 1925] [client 109.252.126.161:2591] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|bayarealangarts.com\|F\|2"] [data ".pkg_sourcerer.sys.ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "bayarealangarts.com"] [uri "/language/en-GB/en-GB.pkg_sourcerer.sys.ini"] [unique_id "atxur3k9tMIsXntu1zQoswAAAAo"], referer: https://bayarealangarts.com/administrator/manifests/packages/pkg_sourcerer.xml show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 conseilgouz	2026-10-24 08:14:29 (3 days ago)	doe-7 : Trying access unauthorized files/dir=>/tmp/739739.pht	Hacking

Showing 1 to 15 of 32 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇳🇱 213.177.179.79

🇨🇭 209.99.190.200

🇧🇷 191.183.37.96

🇮🇳 182.79.112.190

🇦🇷 181.23.57.3

🇹🇭 147.50.227.79

🇲🇴 125.31.2.160

🇮🇷 85.185.201.10

🇩🇪 46.151.182.211

🇺🇸 45.132.115.15

🇫🇮 13.140.86.214

🇵🇰 203.6.209.166

🇮🇩 182.8.227.168

🇬🇧 159.65.62.75

🇻🇳 103.200.22.154

🇳🇱 83.137.145.19

🇺🇸 57.141.20.31

🇻🇳 221.132.21.185

🇰🇷 220.118.173.234

🇲🇩 217.156.122.137