JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

136.0.220.227

Neutral Activity

Abuse Confidence Score

0% Low Risk

5 reports

3 reporters · latest 1 year ago

ISP: Ace Data Centers II, L.L.C.
Usage Type: Data Center/Web Hosting/Transit
ASN: AS18779
Hostname(s): 136-0-220-227.ips.acedatacenter.com
Domain Name: acedatacenter.com
Country: 🇺🇸 United States of America
City: San Jose, California

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

No reports in the last 60 days

136.0.220.227 has been reported 5 times. The most recent report is from 1 year ago.

The full history is preserved below and remains searchable. A 0% score reflects the absence of recent activity, but this is not a guarantee that earlier reports were invalid. Abuse confidence score decays, naturally, over time, when the abusive activity stops.

Abuse Reports

Export reports CSV

Total reports

5 from 3 distinct reporters

First reported

January 26th 2025

Most recent report

1 year ago

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2025-07-26 23:43:06 UTC · (1 year ago)	(mod_security) mod_security (id:212620) triggered by 136.0.220.227 (136-0-220-227.ips.acedatacenter.com): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 26 19:41:57.808807 2025] [security2:error] [pid 26440:tid 266 ... show more (mod_security) mod_security (id:212620) triggered by 136.0.220.227 (136-0-220-227.ips.acedatacenter.com): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 26 19:41:57.808807 2025] [security2:error] [pid 26440:tid 26622] [client 136.0.220.227:40657] ModSecurity: Access denied with code 403 (phase 2). Pattern match "<script\\\\b" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/07_XSS_XSS.conf"] [line "65"] [id "212620"] [rev "4"] [msg "COMODO WAF: Cross-site Scripting (XSS) Attack\|\|ftp.kettlehill.com\|F\|2"] [data "Matched Data: <script found within REQUEST_URI: /?s=</script><script>alert(document.domain)</script>"] [severity "CRITICAL"] [tag "CWAF"] [tag "XSS"] [hostname "ftp.kettlehill.com"] [uri "/"] [unique_id "aIVnxci-n1PXCScDgLsGxwAAAUg"], referer: http://ftp.kettlehill.com/?s=<%2Fscript><script>alert%28document.domain%29<%2Fscript> show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-05-29 22:20:33 UTC · (1 year ago)	(mod_security) mod_security (id:221260) triggered by 136.0.220.227 (136-0-220-227.ips.acedatacenter.com): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 29 18:20:26.087127 2025] [security2:error] [pid 3632054:tid 3 ... show more (mod_security) mod_security (id:221260) triggered by 136.0.220.227 (136-0-220-227.ips.acedatacenter.com): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 29 18:20:26.087127 2025] [security2:error] [pid 3632054:tid 3632054] [client 136.0.220.227:33791] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^(?:\\\\'\\\\w+?=)?\\\\(\\\\)\\\\s{" at MATCHED_VAR. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "77"] [id "221260"] [rev "3"] [msg "COMODO WAF: Shellshock Command Injection Vulnerabilities in GNU Bash through 4.3 bash43-026 (CVE-2014-7187, CVE-2014-7186, CVE-2014-7169, CVE-2014-6278, CVE-2014-6277, CVE-2014-6271)\|\|webmail.farmers123.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.farmers123.com"] [uri "/cgi-bin/test-cgi"] [unique_id "aDjdquWf7XC-PAafTaYJNQAAAAY"], referer: () { ignored; }; echo Content-Type: text/html; echo ; /bin/cat /etc/passwd show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-04-19 05:23:21 UTC · (1 year ago)	(mod_security) mod_security (id:210730) triggered by 136.0.220.227 (136-0-220-227.ips.acedatacenter.com): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Apr 19 01:23:08.419762 2025] [security2:error] [pid 22650:tid 226 ... show more (mod_security) mod_security (id:210730) triggered by 136.0.220.227 (136-0-220-227.ips.acedatacenter.com): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Apr 19 01:23:08.419762 2025] [security2:error] [pid 22650:tid 22671] [client 136.0.220.227:38285] [client 136.0.220.227] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|www.blog.spinningdesigns.com\|F\|2"] [data ".conf"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "blog.spinningdesigns.com"] [uri "/vpns/cfg/smb.conf"] [unique_id "aAMzPMLYwl69KqC_78iZFgAAAFI"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 Faolan	2025-02-08 07:32:00 UTC · (1 year ago)	[08/Feb/2025 08:32:09] Failed IMAP login from 136-0-220-227.ips.acedatacenter.com	Brute-Force
Anonymous	2025-01-26 02:40:14 UTC · (1 year ago)	\| Common web attack.	Hacking SQL Injection Web App Attack

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇩🇪 195.182.16.23

🇭🇳 168.232.169.163

🇩🇪 161.35.21.193

🇺🇸 91.132.198.116

🇨🇳 42.194.182.170

🇬🇧 35.203.210.20

🇨🇴 201.49.131.34

🇷🇴 193.46.255.86

🇬🇧 185.247.137.19

🇰🇷 183.106.237.242

🇧🇷 177.221.179.121

🇺🇸 159.223.98.51

🇨🇴 129.222.203.33

🇺🇸 104.248.229.66

🇺🇸 65.49.1.76

🇺🇸 47.3.223.14

🇬🇧 5.226.140.13

🇺🇸 216.180.246.93

172.18.0.1

🇵🇱 162.158.103.128