JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 130.193.15.186

130.193.15.186 was found in our database!

This IP was reported 366 times. Confidence of Abuse is 32%: ?

32%

This address is a Tor exit node. Neither the owner nor the provider are directly behind the offending action.

ISP	HOSTING90 systems s.r.o.
Usage Type	Data Center/Web Hosting/Transit
ASN	AS29134
Hostname(s)	vps1936.hosting90.net
Domain Name	hosting90.cz
Country	🇨🇿 Czechia
City	Prague, Prague

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 130.193.15.186

Whois 130.193.15.186

IP Abuse Reports for 130.193.15.186:

This IP address has been reported a total of 366 times from 174 distinct sources. 130.193.15.186 was first reported on April 16th 2022, and the most recent report was 4 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-06-25 13:27:27 (4 days ago)	(mod_security) mod_security (id:225170) triggered by 130.193.15.186 (vps1936.hosting90.net): 1 in th ... show more (mod_security) mod_security (id:225170) triggered by 130.193.15.186 (vps1936.hosting90.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 25 09:27:19.260848 2026] [security2:error] [pid 17527:tid 17527] [client 130.193.15.186:59040] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|goldenvalley1.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "goldenvalley1.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aj0stx7yFoLfNepHq40IRQAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 FeG Deutschland	2026-06-19 07:43:42 (1 week ago)	Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 127	Exploited Host Web App Attack
🇫🇷 ✨	2026-06-01 23:10:11 (4 weeks ago)	Rule : PLESK BOT 2026-06-02 01:09:20 Unauthorized login attempt to Plesk Panel from IP 130.193.15.18 ... show more Rule : PLESK BOT 2026-06-02 01:09:20 Unauthorized login attempt to Plesk Panel from IP 130.193.15.186 with username root show less	Hacking Brute-Force Web App Attack
🇩🇪 4server	2026-05-31 21:22:39 (4 weeks ago)	[SunMay3123:22:34.7448522026][security2:error][pid1733851:tid1733918][client130.193.15.186:0]ModSecu ... show more [SunMay3123:22:34.7448522026][security2:error][pid1733851:tid1733918][client130.193.15.186:0]ModSecurity:Accessdeniedwithcode403$phase1$.Patternmatch\"$\?i$$\?:/\(\?:\^\\|/$\\\\\\\\.$env\\|git\\|svn\\|hg\\|DS_Store$\\|/$\?:wp-config\\|\\\\\\\\.htaccess\\|\\\\\\\\.htpasswd$\\|\\\\\\\\.$\?:sql\\|bak\\|old\\|log$\$\)\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"156\"][id\"960720\"][msg\"Forbiddenfileaccessattempt\"][severity\"CRITICAL\"][hostname\"specialfood.ch\"][uri\"/dump.sql\"][unique_id\"ahymmmn4vk-KxYwOJlo7IgAAAE8\"]\,referer:specialfood.ch/dump.sql show less	Port Scan Brute-Force Web App Attack
🇺🇸 LotPhantom	2026-05-31 07:42:58 (4 weeks ago)	2026/05/31 07:42:57 [error] 4079153#4079153: 115176 connect() failed (111: Connection refused) whil ... show more 2026/05/31 07:42:57 [error] 4079153#4079153: 115176 connect() failed (111: Connection refused) while connecting to upstream, client: 130.193.15.186, server: wynnesmiles.com, request: "GET / HTTP/1.1", upstream: "http://127.0.0.1:4001/", host: "wynnesmiles.com" ... show less	Web App Attack
🇺🇸 TPI-Abuse	2026-05-29 10:25:51 (1 month ago)	(mod_security) mod_security (id:210730) triggered by 130.193.15.186 (vps1936.hosting90.net): 1 in th ... show more (mod_security) mod_security (id:210730) triggered by 130.193.15.186 (vps1936.hosting90.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 29 06:25:46.220407 2026] [security2:error] [pid 29762:tid 29762] [client 130.193.15.186:40148] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|sunsettrailsardmore.com\|F\|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "sunsettrailsardmore.com"] [uri "/dump.sql"] [unique_id "ahlpqhoL7nv5atiaVbqo-wAAABA"], referer: sunsettrailsardmore.com/dump.sql show less	Brute-Force Bad Web Bot Web App Attack
🇧🇪 cmbplf	2026-05-16 10:42:44 (1 month ago)	513 limiting connections by zone (14m59s)	DDoS Attack
🇷🇴 Fn4ticHz	2026-05-10 12:00:24 (1 month ago)	Repeated DDoS targeted -- ZeroGuard X ManagedSRV	DDoS Attack Exploited Host
Anonymous	2026-05-06 04:00:21 (1 month ago)	2026-05-05 19:00:09,127 fail2ban.actions [3625835]: NOTICE [tor] Ban 130.193.15.186 2026-05- ... show more 2026-05-05 19:00:09,127 fail2ban.actions [3625835]: NOTICE [tor] Ban 130.193.15.186 2026-05-05 22:00:06,552 fail2ban.actions [3625835]: NOTICE [tor] Ban 130.193.15.186 2026-05-06 01:00:05,511 fail2ban.actions [3625835]: NOTICE [tor] Ban 130.193.15.186 2026-05-06 04:00:11,859 fail2ban.actions [3625835]: NOTICE [tor] Ban 130.193.15.186 2026-05-06 07:00:20,350 fail2ban.actions [3625835]: NOTICE [tor] Ban 130.193.15.186 show less	Brute-Force
Anonymous	2026-04-24 21:00:37 (2 months ago)	2026-04-24 12:00:07,194 fail2ban.actions [7718]: NOTICE [tor] Ban 130.193.15.186 2026-04-24 ... show more 2026-04-24 12:00:07,194 fail2ban.actions [7718]: NOTICE [tor] Ban 130.193.15.186 2026-04-24 15:00:07,042 fail2ban.actions [7718]: NOTICE [tor] Ban 130.193.15.186 2026-04-24 18:00:06,952 fail2ban.actions [7718]: NOTICE [tor] Ban 130.193.15.186 2026-04-24 21:00:17,882 fail2ban.actions [7718]: NOTICE [tor] Ban 130.193.15.186 2026-04-25 00:00:32,659 fail2ban.actions [7718]: NOTICE [tor] Ban 130.193.15.186 show less	Brute-Force
🇺🇸 TPI-Abuse	2026-04-22 03:14:36 (2 months ago)	(mod_security) mod_security (id:210831) triggered by 130.193.15.186 (vps1936.hosting90.net): 1 in th ... show more (mod_security) mod_security (id:210831) triggered by 130.193.15.186 (vps1936.hosting90.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Apr 21 23:14:27.060057 2026] [security2:error] [pid 23517:tid 23528] [client 130.193.15.186:39078] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.inal.org\|F\|4"] [data "panscient.com"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.inal.org"] [uri "/robots.txt"] [unique_id "aeg9E8jQGqw1Lj2oB7VbCgAAAIY"] show less	Brute-Force Bad Web Bot Web App Attack
🇨🇭 Origon	2026-04-21 14:55:34 (2 months ago)	http-bad-user-agent - IP: 130.193.15.186 - time="2026-04-21T16:55:34+02:00" level=info msg="(555f66 ... show more http-bad-user-agent - IP: 130.193.15.186 - time="2026-04-21T16:55:34+02:00" level=info msg="(555f66b4f6a74558bc11e3f93469658es8App0Mcc0TKEeje/crowdsec) crowdsecurity/http-bad-user-agent by ip 130.193.15.186 (CZ/29134) : 4h ban on Ip 130.193.15.186" module=db show less	Bad Web Bot
🇩🇪 LRob.fr	2026-04-07 19:45:02 (2 months ago)	Plesk panel login attempt with forbidden username (root/admin), blocked by Fail2Ban in custom-plesk- ... show more Plesk panel login attempt with forbidden username (root/admin), blocked by Fail2Ban in custom-plesk-login jail show less	Brute-Force Web App Attack
🇩🇪 LRob.fr	2026-04-07 11:00:15 (2 months ago)	Repeated requests on blocked xmlrpc.php, blocked by fail2ban in custom-503-xmlrpc jail	Bad Web Bot Web App Attack
🇮🇩 securejdprop	2026-04-06 11:38:56 (2 months ago)	This IP was detected by CrowdSec triggering crowdsecurity/suricata-major-severity(ET TOR Known Tor E ... show more This IP was detected by CrowdSec triggering crowdsecurity/suricata-major-severity(ET TOR Known Tor Exit Node Traffic group 13). Ip 130.193.15.186 performed 'crowdsecurity/suricata-major-severity' (1 events over 0s) at 2026-04-06 11:38:54.823491655 +0000 UTC show less	Hacking Web App Attack

Showing 1 to 15 of 366 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇦🇷 186.148.224.219

🇸🇪 94.255.255.26

🇷🇺 91.245.146.236

🇮🇳 4.240.96.30

🇩🇪 213.209.159.231

🇳🇱 193.176.31.252

🇺🇸 147.185.132.69

🇺🇸 108.30.128.229

🇳🇱 45.148.10.147

🇬🇧 45.82.76.112

🇭🇰 43.155.21.198

🇨🇭 20.203.151.222

🇺🇸 20.38.33.1

🇷🇺 5.3.154.1

🇩🇪 2a00:1450:4001:c00::122

🇵🇪 190.119.63.98

🇷🇺 188.65.132.106

🇫🇷 185.177.72.58

🇩🇴 179.52.250.198

🇩🇪 178.105.9.204