JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 128.254.190.114

128.254.190.114 was found in our database!

This IP was reported 29 times. Confidence of Abuse is 41%: ?

41%

ISP	Grupo IN SAS
Usage Type	Fixed Line ISP
ASN	AS64123
Domain Name	dodolink.com.ar
Country	🇦🇷 Argentina
City	Moreno, Buenos Aires

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 128.254.190.114

Whois 128.254.190.114

IP Abuse Reports for 128.254.190.114:

This IP address has been reported a total of 29 times from 24 distinct sources. 128.254.190.114 was first reported on June 12th 2026, and the most recent report was 3 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇷 masterguru	2026-10-13 05:34:21 (3 days ago)	(modsec_5040) ModSec 5040: API Basic Auth blocked from 128.254.190.114 (AR/Argentina/-): 1 in the la ... show more (modsec_5040) ModSec 5040: API Basic Auth blocked from 128.254.190.114 (AR/Argentina/-): 1 in the last 3600 secs (0-196) show less	Hacking
Anonymous	2026-10-09 06:35:27 (1 week ago)	Network service scanning detected by FortiGate; source quarantined.	Port Scan
Anonymous	2026-10-09 01:50:03 (1 week ago)	(wordpress) Failed login wp-login.php or xmlrpc.php	Web App Attack
🇩🇪 FeG Deutschland	2026-10-08 10:31:53 (1 week ago)	Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 257	Exploited Host Web App Attack
🇺🇸 TPI-Abuse	2026-10-05 22:57:09 (1 week ago)	(mod_security) mod_security (id:210350) triggered by 128.254.190.114 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210350) triggered by 128.254.190.114 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 05 18:57:03.734403 2026] [security2:error] [pid 17167:tid 17192] [client 128.254.190.114:36290] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|fiefblondel.com\|F\|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "fiefblondel.com"] [uri "/"] [unique_id "asQrPzFubW9w6hyKKbwBtAAAABc"], referer: https://backlinksforsale.website/dir/powerful-seo-backlinks-72003 show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-09-20 18:58:17 (3 weeks ago)	(mod_security) mod_security (id:210350) triggered by 128.254.190.114 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210350) triggered by 128.254.190.114 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 20 14:58:13.453388 2026] [security2:error] [pid 11459:tid 11459] [client 128.254.190.114:59240] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|birdsofnewcaledonia.com\|F\|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "birdsofnewcaledonia.com"] [uri "/"] [unique_id "arAsxXfcZhQJmN8jdjzjBwAAADQ"], referer: https://backlinkspace.com/dir/ranking-focused-backlinks-24383 show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 SX Communications	2026-09-01 10:20:37 (1 month ago)	HTTP application-layer DoS / botnet traffic from 128.254.190.114: repeated high-cost dynamic page an ... show more HTTP application-layer DoS / botnet traffic from 128.254.190.114: repeated high-cost dynamic page and feed requests (profile/tag views, forums, tracker, RSS) at abusive rates via completed TCP/HTTPS. Likely compromised end-user host. show less	DDoS Attack Bad Web Bot Exploited Host
🇺🇸 kosada.com	2026-08-26 20:07:16 (1 month ago)	Web bot: denial-of-service flood	DDoS Attack Bad Web Bot
🇸🇬 garrymenata	2026-08-24 01:56:05 (1 month ago)	128.254.190.114 - - [24/Aug/2026:02:28:20 +0700] "GET / HTTP/1.1" 403 3258 "-" "Dalvik/2.1.0 (Linux; ... show more 128.254.190.114 - - [24/Aug/2026:02:28:20 +0700] "GET / HTTP/1.1" 403 3258 "-" "Dalvik/2.1.0 (Linux; U; Android 12; Dcolor GD2 Build/SGZ4.240805.001)" 128.254.190.114 - - [24/Aug/2026:02:28:21 +0700] "GET / HTTP/1.1" 403 3258 "-" "Dalvik/2.1.0 (Linux; U; Android 12; Dcolor GD2 Build/SGZ4.240805.001)" 128.254.190.114 - - [24/Aug/2026:02:28:23 +0700] "GET / HTTP/1.1" 403 3258 "-" "Dalvik/2.1.0 (Linux; U; Android 12; Dcolor GD2 Build/SGZ4.240805.001)" ... show less	DDoS Attack Bad Web Bot
🇫🇷 Zkillu	2026-08-19 22:29:22 (1 month ago)	UDP flood (DDoS) vs AS215599: 6253 pkts / 8.94 MB to UDP 80/8443 across 577 dst IP(s), 2026-08-19 21 ... show more UDP flood (DDoS) vs AS215599: 6253 pkts / 8.94 MB to UDP 80/8443 across 577 dst IP(s), 2026-08-19 21:46 to 2026-08-20 00:36 CEST. No legitimate service on these UDP ports (7-day baseline 0 GB/day). Carpet-bombing of a /24, likely botnet-compromised host. Evidence: sFlow + hardware ACL counters. show less	DDoS Attack Exploited Host
🇫🇷 dmallet	2026-08-19 22:29:22 (1 month ago)	UDP flood (DDoS) vs AS215599: 6253 pkts / 8.94 MB to UDP 80/8443 across 577 dst IP(s), 2026-08-19 21 ... show more UDP flood (DDoS) vs AS215599: 6253 pkts / 8.94 MB to UDP 80/8443 across 577 dst IP(s), 2026-08-19 21:46 to 2026-08-20 00:36 CEST. No legitimate service on these UDP ports (7-day baseline 0 GB/day). Carpet-bombing of a /24, likely botnet-compromised host. Evidence: sFlow + hardware ACL counters. show less	DDoS Attack Exploited Host
🇪🇸 librebit	2026-08-19 11:12:21 (1 month ago)	Brute force	Brute-Force
🇩🇪 Vegascosmetics	2026-08-16 06:19:04 (2 months ago)	Kingcopy.org AI-IDS (Vegas Cosmetics shop): auto-blocked after deep/obfuscated attack (encoding nest ... show more Kingcopy.org AI-IDS (Vegas Cosmetics shop): auto-blocked after deep/obfuscated attack (encoding nesting / CPU-drain risk). Evidence: DEEP ATTACK: Recursive currentUrl nesting detected show less	Hacking Exploited Host Web App Attack
🇦🇺 MAGIC	2026-08-13 00:05:36 (2 months ago)	VM5 Bad user agents ignoring web crawling rules. Draing bandwidth	DDoS Attack Bad Web Bot
🇩🇪 LRob	2026-08-05 00:00:57 (2 months ago)	CrowdSec: Distributed L7 HTTP flood on WordPress 'The Events Calendar' AJAX endpoints (request_forma ... show more CrowdSec: Distributed L7 HTTP flood on WordPress 'The Events Calendar' AJAX endpoints (request_format~json) - DDoS \| req: /calendrier-2/action~agenda/time_limit~1763247600/cat_ids~134,152,142/tag_ids~404,274,554,472,551,729,210/request_format~json/ \| UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 show less	DDoS Attack Web App Attack

Showing 1 to 15 of 29 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 2602:80d:1007::2d

🇳🇱 204.76.203.231

🇦🇷 201.180.197.101

🇳🇱 195.178.110.30

🇨🇱 190.102.238.73

🇧🇷 177.172.67.177

🇧🇷 177.128.7.202

🇺🇸 170.23.14.79

🇺🇸 147.185.132.75

🇺🇸 91.230.168.236

🇨🇦 85.217.149.54

🇳🇱 85.11.167.38

🇸🇪 83.233.149.38

🇺🇸 79.135.120.207

🇮🇱 40.223.212.166

🇺🇸 23.239.185.34

🇺🇸 23.94.73.235

🇺🇸 199.165.159.71

🇨🇭 185.191.236.38

🇺🇸 162.216.150.36