AbuseIPDB » 135.125.171.106
135.125.171.106
This IP was reported 7 times. Confidence of
Abuse
is 39% : ?
ISP
OVH GmbH
Usage Type
Data Center/Web Hosting/Transit
ASN
AS16276
Hostname(s)
ns3158805.ip-135-125-171.eu
Domain Name
ovh.net
Country
🇩🇪
Germany
City
Frankfurt am Main, Hesse
IP info including ISP, Usage Type, and Location provided
by IPInfo . Updated weekly.
IP Abuse Reports for 135.125.171.106 :
This IP address has been reported a total of
7
times from
7 distinct
sources.
135.125.171.106 was first reported on
June 6th 2026 , and the most recent report was
5 days ago
Recent Reports:
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Reporter
IoA Timestamp (UTC)
Comment
Categories
🇮🇩
Burayot
2026-06-21 18:25:03
(5 days ago)
LF_MODSEC: (mod_security) mod_security (id:949110) triggered by 135.125.171.106 (FR/France/ns3158805 ...
show more
LF_MODSEC: (mod_security) mod_security (id:949110) triggered by 135.125.171.106 (FR/France/ns3158805.ip-135-125-171.eu): 2 in the last 3600 secs
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-06-17 23:10:36
(1 week ago)
(mod_security) mod_security (id:210831) triggered by 135.125.171.106 (ns3158805.ip-135-125-171.eu): ...
show more
(mod_security) mod_security (id:210831) triggered by 135.125.171.106 (ns3158805.ip-135-125-171.eu): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 17 19:10:29.176296 2026] [security2:error] [pid 27725:tid 27740] [client 135.125.171.106:36674] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||uoexpanse.com|F|4"] [data "security scan"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "uoexpanse.com"] [uri "/"] [unique_id "ajMpZauKAyD4X79DojlsWgAAAEw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇦
polycoda
2026-06-15 01:05:03
(1 week ago)
AutoBlock: 📡 Port 22 Scan (Non Decay-Based) - ↪️ Excessive 30X Errors (Decay-Based)
Port Scan
Bad Web Bot
SSH
🇦🇩
bakunin1848
2026-06-14 03:08:46
(1 week ago)
SSH Login Attemp Blocked
SSH
Brute-Force
🇪🇸
el-brujo
2026-06-11 06:31:36
(2 weeks ago)
Cloudflare WAF: Request Path: / Request Query: Host: api.elhacker.net userAgent: PQScore/1.0 Action ...
show more
Cloudflare WAF: Request Path: / Request Query: Host: api.elhacker.net userAgent: PQScore/1.0 Action: block Source: zonelockdown ASN Description: OVH SAS Country: DE Method: GET Timestamp: 2026-06-11T06:31:36Z ruleId: 9b344b1f2f6c43dd860f1fb2a59d4d32. Report generated by Cloudflare-WAF-to-AbuseIPDB (https://github.com/MHG-LAB/Cloudflare-WAF-to-AbuseIPDB).
show less
Hacking
SQL Injection
Web App Attack
🇨🇭
backslash
2026-06-07 01:06:00
(2 weeks ago)
block ruleset AA06B7315BA6AEB6421B52F0B32E14B509FD5FF0
SQL Injection
🇫🇷
LRob.fr
2026-06-06 07:00:05
(3 weeks ago)
WAF repeated trigger detected by Fail2Ban in plesk-modsecurity jail
Web App Attack
Showing 1 to
7
of 7 reports
Think this IP has been falsely reported? You may request to have the associated
reports reviewed and removed.
Request Takedown 🚩
Recently Reported IPs: