JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 144.31.108.1

144.31.108.1 was found in our database!

This IP was reported 33 times. Confidence of Abuse is 47%: ?

47%

ISP	SERV.HOST GROUP LTD
Usage Type	Data Center/Web Hosting/Transit
ASN	AS207957
Hostname(s)	mx1.mxge.comcast.net
Domain Name	serv.host
Country	🇩🇪 Germany
City	Frankfurt am Main, Hesse

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 144.31.108.1

Whois 144.31.108.1

IP Abuse Reports for 144.31.108.1:

This IP address has been reported a total of 33 times from 21 distinct sources. 144.31.108.1 was first reported on May 24th 2026, and the most recent report was 1 month ago.

Old Reports: The most recent abuse report for this IP address is from 1 month ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 conseilgouz	2026-05-26 02:43:16 (1 month ago)	vew-Joomla User : try to access forms...	Hacking
🇫🇷 conseilgouz	2026-05-26 01:49:54 (1 month ago)	hae-Joomla Admin : try to force the door...	Hacking
🇫🇷 conseilgouz	2026-05-26 00:10:08 (1 month ago)	sae-Joomla Admin : try to force the door...	Hacking
🇩🇪 sverson	2026-05-25 23:53:06 (1 month ago)	Abusive use detected / Unauthorized connection attempt	Hacking Brute-Force
🇩🇪 4server	2026-05-25 23:35:04 (1 month ago)	[TueMay2601:34:59.5689752026][security2:error][pid616610:tid616703][client144.31.108.1:0]ModSecurity ... show more [TueMay2601:34:59.5689752026][security2:error][pid616610:tid616703][client144.31.108.1:0]ModSecurity:Accessdeniedwithcode403\(phase2\).OperatorGEmatched5atTX:anomaly_score.[file\"/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf\"][line\"94\"][id\"949110\"][msg\"InboundAnomalyScoreExceeded\(TotalScore:5\)\"][severity\"CRITICAL\"][ver\"OWASP_CRS/3.3.9\"][tag\"application-multi\"][tag\"language-multi\"][tag\"platform-multi\"][tag\"attack-generic\"][hostname\"mail.studio-portale.ch\"][uri\"/wp-content/plugins/wp-automatic/css/wp-automatic.css\"][unique_id\"ahTco0EXdYEP96mvcEjN6QAAAMc\"] show less	Port Scan Brute-Force Web App Attack
🇩🇪 conseilgouz	2026-05-25 19:46:38 (1 month ago)	ece-Joomla Admin : try to force the door...	Hacking
🇩🇪 ecs.ge	2026-05-25 19:28:19 (1 month ago)	Automatic Fail2Ban report from jail plesk-modsecurity: multiple matching events detected.	Web App Attack Hacking
🇫🇷 IRISIO	2026-05-25 08:55:58 (1 month ago)	scans/SQL injection/spam posts : 15 queries	Web App Attack SQL Injection
🇩🇪 conseilgouz	2026-05-25 07:41:30 (1 month ago)	doe-Joomla Admin : try to force the door...	Hacking
🇩🇪 conseilgouz	2026-05-25 04:57:17 (1 month ago)	lae-Joomla Admin : try to force the door...	Hacking
Anonymous	2026-05-25 04:11:15 (1 month ago)	hiw-Joomla User : try to access forms...	Hacking
🇩🇪 conseilgouz	2026-05-25 03:42:17 (1 month ago)	ave-Joomla Admin : try to force the door...	Hacking
🇨🇭 4server	2026-05-25 03:01:54 (1 month ago)	[MonMay2505:01:50.3451552026][security2:error][pid2667872:tid2668324][client144.31.108.1:0]ModSecuri ... show more [MonMay2505:01:50.3451552026][security2:error][pid2667872:tid2668324][client144.31.108.1:0]ModSecurity:Accessdeniedwithcode403\(phase2\).OperatorGEmatched5atTX:anomaly_score.[file\"/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf\"][line\"94\"][id\"949110\"][msg\"InboundAnomalyScoreExceeded\(TotalScore:5\)\"][severity\"CRITICAL\"][ver\"OWASP_CRS/3.3.9\"][tag\"application-multi\"][tag\"language-multi\"][tag\"platform-multi\"][tag\"attack-generic\"][hostname\"4host.biz\"][uri\"/plugins/system/nrframework/nrframework.xml\"][unique_id\"ahO7nlJ3SueOjzRs6E8MQQAAANE\"] show less	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-05-25 01:40:46 (1 month ago)	(mod_security) mod_security (id:210730) triggered by 144.31.108.1 (mx1.mxge.comcast.net): 1 in the l ... show more (mod_security) mod_security (id:210730) triggered by 144.31.108.1 (mx1.mxge.comcast.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 24 21:40:39.424976 2026] [security2:error] [pid 12233:tid 12233] [client 144.31.108.1:43808] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|www.hacertests.com\|F\|2"] [data ".astroid.ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.hacertests.com"] [uri "/language/en-GB/en-GB.astroid.ini"] [unique_id "ahOol2dVO60Z0_4a3PZfPwAAAAk"], referer: http://www.hacertests.com/ show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-05-25 01:01:49 (1 month ago)	144.31.108.1 - - [25/May/2026:02:55:21 +0200] "GET /info.php HTTP/1.1" 403 913 "https://academievoor ... show more 144.31.108.1 - - [25/May/2026:02:55:21 +0200] "GET /info.php HTTP/1.1" 403 913 "https://academievoorbeeldendevorming.nl/.env" "Mozilla/5.0 (X11; Linux i686 on x86_64; rv:46.0) Gecko/20100101 Firefox/46.0" 144.31.108.1 - - [25/May/2026:02:55:21 +0200] "GET /info.php HTTP/1.1" 403 574 "https://academievoorbeeldendevorming.nl/.env" "Mozilla/5.0 (X11; Linux i686 on x86_64; rv:46.0) Gecko/20100101 Firefox/46.0" 144.31.108.1 - - [25/May/2026:02:55:37 +0200] "GET /phpi.php HTTP/1.1" 403 913 "https://academievoorbeeldendevorming.nl/.env" "Mozilla/5.0 (X11; Linux i686 on x86_64; rv:46.0) Gecko/20100101 Firefox/46.0" 144.31.108.1 - - [25/May/2026:02:55:50 +0200] "GET /phpinfo.php HTTP/1.1" 403 913 "https://academievoorbeeldendevorming.nl/.env" "Mozilla/5.0 (X11; Linux i686 on x86_64; rv:46.0) Gecko/20100101 Firefox/46.0" 144.31.108.1 - - [25/May/2026:02:55:50 +0200] "GET /phpinfo.php HTTP/1.1" 403 574 "https://academievoorbeeldendevorming.nl/.env" "Mozilla/5.0 (X11; Linux i686 on x86_64; rv:46.0 ... show less	DDoS Attack

Showing 1 to 15 of 33 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 216.25.89.111

🇳🇱 176.65.139.217

🇺🇸 173.239.224.46

🇺🇸 172.69.205.156

🇺🇸 104.236.66.186

🇺🇸 66.132.186.221

🇺🇸 52.40.172.194

🇩🇪 46.101.180.162

🇨🇳 223.85.111.229

🇪🇨 181.188.237.220

🇧🇷 172.69.114.51

🇯🇵 162.158.119.173

🇮🇳 159.65.148.158

🇫🇮 147.185.133.192

🇧🇩 118.179.89.198

🇺🇸 40.112.183.29

🇨🇳 27.216.41.146

🇸🇬 13.229.128.185

🇸🇬 172.68.164.53

🇹🇭 162.158.204.175