JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 159.195.49.27

159.195.49.27 was found in our database!

This IP was reported 19 times. Confidence of Abuse is 75%: ?

75%

ISP	netcup GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS197540
Hostname(s)	v2202604353693453975.powersrv.de
Domain Name	netcup.de
Country	🇩🇪 Germany
City	Nuremberg, Bavaria

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 159.195.49.27

Whois 159.195.49.27

IP Abuse Reports for 159.195.49.27:

This IP address has been reported a total of 19 times from 16 distinct sources. 159.195.49.27 was first reported on June 5th 2026, and the most recent report was 16 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-07-08 09:21:05 (16 hours ago)	(mod_security) mod_security (id:210350) triggered by 159.195.49.27 (v2202604353693453975.powersrv.de ... show more (mod_security) mod_security (id:210350) triggered by 159.195.49.27 (v2202604353693453975.powersrv.de): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 08 05:21:02.684210 2026] [security2:error] [pid 14410:tid 14410] [client 159.195.49.27:56396] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|socialstudiesforkids.com\|F\|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "socialstudiesforkids.com"] [uri "/"] [unique_id "ak4Wfg2pfUTe2lu7Y9OzsQAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-07 07:52:30 (1 day ago)	(mod_security) mod_security (id:210350) triggered by 159.195.49.27 (v2202604353693453975.powersrv.de ... show more (mod_security) mod_security (id:210350) triggered by 159.195.49.27 (v2202604353693453975.powersrv.de): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 07 03:52:23.528164 2026] [security2:error] [pid 31477:tid 31484] [client 159.195.49.27:5392] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|batonrougegazette.com\|F\|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "batonrougegazette.com"] [uri "/uncategorized/blocked-by-courts-biden-admin-turns-to-outside-firms-to-run-its-censorship-activities/"] [unique_id "akywN43IaD2SDSL9N5eqHwAAAEQ"], referer: http://batonrougegazette.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 nowyouknow	2026-07-05 11:35:53 (3 days ago)	(From [email protected]) Hi there, I'm Sophia with Top Talent VAs. I’m reaching out beca ... show more (From [email protected]) Hi there, I'm Sophia with Top Talent VAs. I’m reaching out because we offer Virtual Assistants that utilize our custom-built AI tool, MAVIS (My Advanced Virtual Intelligent System), that easily replaces a 20-man team. We overtake and handle all of your marketing, administrative tasks, graphic design, video animations, accounting, and even all your prospecting with our system. This isn't a software you have to learn, and all you have to do is delegate to a human Virtual Assistant to get everything done! Reply YES to schedule a Zoom meeting or STOP to unsubscribe. show less	Phishing Web Spam
🇷🇸 Smel	2026-07-05 05:52:05 (3 days ago)	HTTP/80/443/8080 Unauthorized Probe, Hack -	Hacking Web App Attack
🇮🇳 liveaspankaj	2026-07-04 21:38:02 (4 days ago)	DDoS attack: 440 requests in 5m (GET / or repair.php).	DDoS Attack
🇦🇺 oncord	2026-07-03 01:15:36 (6 days ago)	Form spam	Web Spam
🇮🇩 sockominfo	2026-07-02 23:00:09 (6 days ago)	Zimbra: Login failures from malicious IP: 159.195.49.27. Threat Score: 6/10 (MEDIUM). Reported by Ta ... show more Zimbra: Login failures from malicious IP: 159.195.49.27. Threat Score: 6/10 (MEDIUM). Reported by TangerangKota-CSIRT show less	Hacking Web App Attack
Anonymous	2026-07-02 20:09:13 (6 days ago)	159.195.49.27 - - [02/Jul/2026:21:31:04 +0200] "POST /xmlrpc.php HTTP/1.1" 200 418 159.195.49.27 - - ... show more 159.195.49.27 - - [02/Jul/2026:21:31:04 +0200] "POST /xmlrpc.php HTTP/1.1" 200 418 159.195.49.27 - - [02/Jul/2026:22:09:11 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 ... show less	Brute-Force Bad Web Bot
🇱🇻 garmtech.com	2026-07-01 14:35:25 (1 week ago)	IM360 WAF: Old style account creation and modification in Joomla! MV:registration	Web App Attack
🇦🇺 oncord	2026-06-30 20:51:33 (1 week ago)	Form spam	Web Spam
🇫🇷 MatStef132	2026-06-29 23:21:42 (1 week ago)	MatShield L7: blocked on dev.mathost.eu (ua-quarantined)	Bad Web Bot
🇫🇷 fastwarp	2026-06-29 12:00:33 (1 week ago)	DDoS / HTTP flood to hosting server from nginx access logs	DDoS Attack
🇸🇮 administrator	2026-06-26 22:09:00 (1 week ago)	2026-06-24 13:36:17,865 fail2ban.actions [1067]: NOTICE [apache-fakegooglebot] Ban 159.195.4 ... show more 2026-06-24 13:36:17,865 fail2ban.actions [1067]: NOTICE [apache-fakegooglebot] Ban 159.195.49.27 2026-06-24 13:36:17,865 fail2ban.actions [1067]: NOTICE [apache-fakegooglebot] Ban 159.195.49.27 2026-06-24 13:36:17,865 fail2ban.actions [1067]: NOTICE [apache-fakegooglebot] Ban 159.195.49.27 ... show less	Bad Web Bot Web Spam Email Spam Blog Spam Port Scan Brute-Force Web App Attack
🇬🇧 Oakley	2026-06-26 00:05:12 (1 week ago)	(mod_security) mod_security (id:900177) triggered by 159.195.49.27 (DE/Germany/v2202604353693453975. ... show more (mod_security) mod_security (id:900177) triggered by 159.195.49.27 (DE/Germany/v2202604353693453975.powersrv.de): 5 in the last 900 secs show less	Web App Attack Hacking
🇳🇴 jad-abuse	2026-06-24 15:41:11 (2 weeks ago)	ActiveDefense automated detection: malicious HTTP scanning / exploit attempts. Signatures: env_probe ... show more ActiveDefense automated detection: malicious HTTP scanning / exploit attempts. Signatures: env_probe, source_backup, phpunit_rce, actuator. Observed by 1 sensor(s); 17 hits. show less	Hacking Web App Attack

Showing 1 to 15 of 19 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 2607:f8b0:4001:c10::12a

🇧🇷 190.52.74.15

🇵🇱 176.53.159.198

🇺🇸 162.216.150.79

🇫🇮 147.185.133.7

🇺🇸 135.237.126.194

🇸🇮 102.220.160.41

🇫🇷 91.231.89.25

🇩🇪 69.5.169.246

🇮🇳 45.194.91.149

🇰🇷 222.117.173.94

🇺🇸 198.98.56.205

🇩🇪 194.88.98.101

🇱🇹 185.169.4.210

🇺🇸 172.212.224.44

🇺🇸 162.216.150.161

🇮🇳 154.61.75.100

🇩🇪 140.248.75.116

🇩🇪 140.248.75.26

🇺🇸 132.148.26.66