JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

110.38.226.66

Neutral Activity

Abuse confidence score ?

0% Low Risk

211 reports

104 reporters · latest 1 month ago

ISP	National Wimax/IMS environment
Usage Type	Fixed Line ISP
ASN	AS38264
Hostname(s)	GPONUser38226-66.wateen.net
Domain Name	wateen.com
Country	🇵🇰 Pakistan
City	Sahiwal, Punjab

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Reports Activity

Example preview

Report Categories (Last 60 Days)

Example preview

Top Reporter Countries (Last 60 Days)

Example preview

Account required for the enhanced features Log in Sign up

IP Abuse Reports for 110.38.226.66

This IP address has been reported a total of 211 times from 104 distinct sources. 110.38.226.66 was first reported on March 17th 2026, and the most recent report was 1 month ago. In the last 60 days, the only reporter location was: India with 1 report. The most common categories in these recent reports were: SSH 1 time; Brute-Force 1 time; Hacking 1 time.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇮🇳 evicky2002	2026-08-17 03:44:05 (1 month ago)	Confirmed malicious by STILWaters CTI platform (score=96, sources=1)	Hacking Brute-Force SSH
🇺🇸 octageeks.com	2026-04-29 04:08:06 (4 months ago)	Wordpress malicious attack:[octablocked]	Web App Attack
🇺🇸 TPI-Abuse	2026-04-29 02:54:53 (4 months ago)	(mod_security) mod_security (id:210492) triggered by 110.38.226.66 (GPONUser38226-66.wateen.net): 1 ... show more (mod_security) mod_security (id:210492) triggered by 110.38.226.66 (GPONUser38226-66.wateen.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Apr 28 22:54:47.775041 2026] [security2:error] [pid 2153:tid 2153] [client 110.38.226.66:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webfrog.ws"] [uri "/.git/config"] [unique_id "afFy9xI8hU4YOLjuyh1HTAAAABA"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇮 YF	2026-04-29 01:01:28 (4 months ago)	Git config exposure probe	Web App Attack
🇪🇸 masterguru	2026-04-28 18:35:24 (4 months ago)	Restricted File Access Attempt. Matched phrase "/.git/" at REQUEST_FILENAME. (930130-122)	Hacking Web App Attack
🇫🇷 Baking333	2026-04-28 16:00:06 (4 months ago)	[redacted] 110.38.226.66 - - [28/Apr/2026:17:00:03 +0100] "GET /.git/config HTTP/1.1" 302 5308 0/120 ... show more [redacted] 110.38.226.66 - - [28/Apr/2026:17:00:03 +0100] "GET /.git/config HTTP/1.1" 302 5308 0/120884 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Opera/78.0.0.0" [redacted] 110.38.226.66 - - [28/Apr/2026:17:00:03 +0100] "GET /.git/config HTTP/1.1" 302 5308 0/246383 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Opera/78.0.0.0" show less	Bad Web Bot Web App Attack
🇩🇪 4server	2026-04-28 15:44:37 (4 months ago)	[TueApr2817:44:32.4301702026][security2:error][pid846562:tid846626][client110.38.226.66:0]ModSecurit ... show more [TueApr2817:44:32.4301702026][security2:error][pid846562:tid846626][client110.38.226.66:0]ModSecurity:Accessdeniedwithcode403\(phase2\).OperatorGEmatched5atTX:anomaly_score.[file\"/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf\"][line\"94\"][id\"949110\"][msg\"InboundAnomalyScoreExceeded\(TotalScore:5\)\"][severity\"CRITICAL\"][ver\"OWASP_CRS/3.3.9\"][tag\"application-multi\"][tag\"language-multi\"][tag\"platform-multi\"][tag\"attack-generic\"][hostname\"casaplusticino.ch.136-243-54-122.cpanel.site\"][uri\"/.git/config\"][unique_id\"afDV4EoAlMMpIKAb7SQv-wAAAIM\"] show less	Port Scan Brute-Force Web App Attack
🇩🇪 Progetto1	2026-04-28 14:19:02 (4 months ago)	Detected via HAProxyScanner at 2026-04-28 14:19:02 UTC on destination port WEB (80/443). Repeated sc ... show more Detected via HAProxyScanner at 2026-04-28 14:19:02 UTC on destination port WEB (80/443). Repeated scan / connection. show less	Port Scan Hacking Brute-Force
🇺🇸 TPI-Abuse	2026-04-28 12:23:55 (4 months ago)	(mod_security) mod_security (id:210492) triggered by 110.38.226.66 (GPONUser38226-66.wateen.net): 1 ... show more (mod_security) mod_security (id:210492) triggered by 110.38.226.66 (GPONUser38226-66.wateen.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Apr 28 08:23:48.770011 2026] [security2:error] [pid 29580:tid 29580] [client 110.38.226.66:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.nyemdr-online.com"] [uri "/.git/config"] [unique_id "afCm1OK6N4NRa14dGJTGFgAAACs"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 Mundo Bueno	2026-04-22 06:23:52 (5 months ago)	[ISILIA Protection v2.1] Tentative d'accès: /.git/config \| Pays: PK \| UA: DigitalOcean-API/2.32.1	Hacking Web App Attack
🇫🇷 pocketpark	2026-04-22 03:49:42 (5 months ago)	Triggered Cloudflare WAF (firewallManaged) from PK. Action: BLOCK \| Protocol: HTTP/1.1 (GET) \| Endpo ... show more Triggered Cloudflare WAF (firewallManaged) from PK. Action: BLOCK \| Protocol: HTTP/1.1 (GET) \| Endpoint: /.git/config \| UA: HubSpot-Integration/3.4.1 • Generated by: github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
🇺🇸 TPI-Abuse	2026-04-22 01:16:18 (5 months ago)	(mod_security) mod_security (id:210492) triggered by 110.38.226.66 (GPONUser38226-66.wateen.net): 1 ... show more (mod_security) mod_security (id:210492) triggered by 110.38.226.66 (GPONUser38226-66.wateen.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Apr 21 21:16:12.041949 2026] [security2:error] [pid 29069:tid 29069] [client 110.38.226.66:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "abdulhameeds.art"] [uri "/.git/config"] [unique_id "aeghXFqVpNo-3Epg2FSw4QAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
🇨🇭 4server	2026-04-21 22:27:44 (5 months ago)	[WedApr2200:27:36.4279022026][security2:error][pid3541670:tid3541688][client110.38.226.66:0]ModSecur ... show more [WedApr2200:27:36.4279022026][security2:error][pid3541670:tid3541688][client110.38.226.66:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Matchedphrase\".git\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"364\"][id\"960720\"][msg\"Forbiddenfileaccess\"][hostname\"www.hostingedominio.ch.81-17-25-250.cpanel.site\"][uri\"/.git/config\"][unique_id\"aef52G2aarHRKD8JwCdxwgAAAIQ\"] show less	Hacking Web App Attack
🇳🇱 thedreamer.nl	2026-04-21 19:49:41 (5 months ago)	110.38.226.66 - - [21/Apr/2026:21:45:18 +0200] "GET /.git/config HTTP/1.1" 499 0 "-" "Mozilla/5.0 (i ... show more 110.38.226.66 - - [21/Apr/2026:21:45:18 +0200] "GET /.git/config HTTP/1.1" 499 0 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 15_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.6 Mobile/15E148 Safari/604.1" "PK" "Lahore" "31.58260" "74.32760" 110.38.226.66 - - [21/Apr/2026:21:45:18 +0200] "GET /.git/config HTTP/1.1" 499 0 "-" "httpx/1.4.0 (+https://www.python-httpx.org)" "PK" "Lahore" "31.58260" "74.32760" 110.38.226.66 - - [21/Apr/2026:21:45:18 +0200] "GET /.git/config HTTP/1.1" 499 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:119.0) Gecko/20100101 Firefox/119.0" "PK" "Lahore" "31.58260" "74.32760" 110.38.226.66 - - [21/Apr/2026:21:45:18 +0200] "GET /.git/config HTTP/1.1" 499 0 "-" "libcurl-agent/2.0" "PK" "Lahore" "31.58260" "74.32760" ... show less	Hacking Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-04-21 13:05:06 (5 months ago)	Blocked: Reason='Suspicious traffic score=85 (review-based detection)'; Requests=21	Hacking

Showing 1 to 15 of 211 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇫🇮 104.28.254.16

🇺🇸 64.202.186.161

🇧🇪 35.240.24.255

🇺🇸 34.138.71.185

🇺🇸 34.106.26.7

🇧🇪 34.79.159.22

🇳🇱 20.160.86.7

🇳🇱 195.178.110.26

🇱🇧 185.87.171.185

🇮🇳 165.101.250.169

🇺🇸 154.40.33.241

🇺🇸 143.110.140.116

🇺🇸 143.42.164.97

🇮🇳 122.187.230.169

🇫🇷 91.231.89.70

🇫🇷 91.196.152.46

🇸🇬 82.38.180.242

🇺🇸 74.142.66.174

🇵🇱 45.227.253.153

🇺🇸 45.32.160.61