JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 160.20.109.47

160.20.109.47 was found in our database!

This IP was reported 13 times. Confidence of Abuse is 58%: ?

58%

ISP	HostCram LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS402492
Domain Name	hostcram.com
Country	🇨🇿 Czechia
City	Veseli nad Moravou, South Moravian

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 160.20.109.47

Whois 160.20.109.47

IP Abuse Reports for 160.20.109.47:

This IP address has been reported a total of 13 times from 10 distinct sources. 160.20.109.47 was first reported on July 9th 2026, and the most recent report was 1 hour ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 Starburst SysOp Team	2026-08-17 21:07:36 (1 hour ago)	(mod_security-custom) mod_security (id:210730) triggered by 160.20.109.47 (TR/Turkey/Kayseri/İncesu/ ... show more (mod_security-custom) mod_security (id:210730) triggered by 160.20.109.47 (TR/Turkey/Kayseri/İncesu/-/[AS402492 HOSTCRAM - HostCram]): 1 in the last 3600 secs (0-srv1) show less	Hacking
Anonymous	2026-08-17 12:46:15 (9 hours ago)	Multiple web server 400 error codes from same source ip	Web App Attack
🇺🇸 TPI-Abuse	2026-08-17 12:30:42 (10 hours ago)	(mod_security) mod_security (id:210730) triggered by 160.20.109.47 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210730) triggered by 160.20.109.47 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 17 08:30:37.015506 2026] [security2:error] [pid 3998:tid 3998] [client 160.20.109.47:49798] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|www.intra.es\|F\|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.intra.es"] [uri "/logs/combined.log"] [unique_id "aoL-7QlUf70xDsbPi7iCGwAAABk"] show less	Brute-Force Bad Web Bot Web App Attack
🇬🇧 consul.to	2026-08-17 08:30:21 (14 hours ago)	Web attack/malicious scanning detected	Web App Attack
🇮🇹 CoreTech srl	2026-08-13 01:53:56 (4 days ago)	cloudlinux2 fail2ban: 2026-08-13 03:49:26,694 fail2ban.filter [1463]: INFO [plesk-modsecu ... show more cloudlinux2 fail2ban: 2026-08-13 03:49:26,694 fail2ban.filter [1463]: INFO [plesk-modsecurity] Found 160.20.109.47 - 2026-08-13 03:49:26cloudlinux2 fail2ban: 2026-08-13 03:49:26,548 fail2ban.filter [1463]: INFO [plesk-modsecurity] Found 160.20.109.47 - 2026-08-13 03:49:26cloudlinux2 fail2ban: 2026-08-13 03:49:26,760 fail2ban.filter [1463]: INFO [plesk-modsecurity] Found 160.20.109.47 - 2026-08-13 03:49:26cloudlinux2 fail2ban: 2026-08-13 03:49:26,606 fail2ban.filter [1463]: INFO [plesk-modsecurity] Found 160.20.109.47 - 2026-08-13 03:49:26cloudlinux2 fail2ban: 2026-08-13 03:49:26,576 fail2ban.filter [1463]: INFO [plesk-modsecurity] Found 160.20.109.47 - 2026-08-13 03:49:26cloudlinux2 fail2ban: 2026-08-13 03:49:26,818 fail2ban.filter [1463]: INFO [plesk-modsecurity] Found 160.20.109.47 - 2026-08-13 03:49:26cloudlinux2 fail2ban: 2026-08-13 03:49:26,969 fail2ban.filter [1463]: INFO [recidive] Found 160.20.109.47 - 2026-08-13 03:49:26clou show less	Brute-Force
🇦🇺 paulshipley.com.au	2026-08-13 00:20:18 (4 days ago)	[Thu Aug 13 10:20:17.061797 2026] [security2:error] [pid 428455] [client 160.20.109.47:57116] [clien ... show more [Thu Aug 13 10:20:17.061797 2026] [security2:error] [pid 428455] [client 160.20.109.47:57116] [client 160.20.109.47] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dlcarterauthor.com"] [uri "/log/access.log"] [unique_id "an0NwbEhOFXkZxycrtN14QAAAAk"] ... show less	Web App Attack
🇺🇸 TPI-Abuse	2026-08-12 23:42:43 (4 days ago)	(mod_security) mod_security (id:210730) triggered by 160.20.109.47 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210730) triggered by 160.20.109.47 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Aug 12 19:42:37.683619 2026] [security2:error] [pid 32131:tid 32151] [client 160.20.109.47:60091] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|dbestcarting.com\|F\|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "dbestcarting.com"] [uri "/access.log"] [unique_id "an0E7UXi2Nv5Kzh3nF-WJQAAAMs"] show less	Brute-Force Bad Web Bot Web App Attack
🇨🇭 4server	2026-08-12 23:42:40 (4 days ago)	[ThuAug1301:42:36.8038592026][security2:error][pid2758386:tid2758735][client160.20.109.47:0]ModSecur ... show more [ThuAug1301:42:36.8038592026][security2:error][pid2758386:tid2758735][client160.20.109.47:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Stringmatchwithin\".asa/.asax/.ascx/.backup/.bak/.bat/.cdx/.cer/.cfg/.cmd/.com/.config/.conf/.cs/.csproj/.csr/.dat/.db/.dbf/.dll/.dos/.htr/.htw/.ida/.idc/.idq/.inc/.ini/.key/.licx/.lnk/.log/.mdb/.old/.pass/.pdb/.pol/.printer/.pwd/.rdb/.resources/.resx/.sql/.swp/.sys/.vb/.vbs/.vbproj/.vsdisco/.webinfo/.xsx/\"atTX:extension.[file\"/etc/apache2/conf.d/modsec_rules/00_asl_zz_strict.conf\"][line\"91\"][id\"390716\"][rev\"2\"][msg\"Atomicorp.comWAFRules:URLfileextensionisrestrictedbypolicy\"][data\".log\"][severity\"ERROR\"][hostname\"dc-graphicart.com\"][uri\"/log/access.log\"][unique_id\"an0E7FAKoikinmAP99hVUAAAANc\"] show less	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-08-12 23:13:58 (4 days ago)	(mod_security) mod_security (id:210730) triggered by 160.20.109.47 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210730) triggered by 160.20.109.47 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Aug 12 19:13:51.934538 2026] [security2:error] [pid 32230:tid 32230] [client 160.20.109.47:62857] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|csmedicalbilling.com\|F\|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "csmedicalbilling.com"] [uri "/storage/logs/app.log"] [unique_id "anz-L1Xtrep213JRD4sn-wAAAA4"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-08-12 20:30:05 (5 days ago)	\| [Dangerous/Turkey] Aggressive IP 160.20.109.47 (~30 hits). Type: DoS Defender- Web server 400 erro ... show more \| [Dangerous/Turkey] Aggressive IP 160.20.109.47 (~30 hits). Type: DoS Defender- Web server 400 error code show less	Web App Attack Hacking SQL Injection
🇨🇭 YF	2026-08-12 20:00:53 (5 days ago)	Distributed subnet attack — coordinated scanning from multiple IPs in the same /24	DDoS Attack Web App Attack
🇺🇸 TPI-Abuse	2026-08-12 19:01:07 (5 days ago)	(mod_security) mod_security (id:210730) triggered by 160.20.109.47 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210730) triggered by 160.20.109.47 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Aug 12 15:00:54.910586 2026] [security2:error] [pid 1489892:tid 1489892] [client 160.20.109.47:62989] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|cartoondelivery.com\|F\|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "cartoondelivery.com"] [uri "/access.log"] [unique_id "anzC5iKxsnw71bfROR8roQAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 MeduzaCTI	2026-07-09 20:02:17 (1 month ago)	Indicator Report Indicator: 160.20.109.47 Reporter: HeatherM Description: DcRAT C2 Found Tags: RAT, ... show more Indicator Report Indicator: 160.20.109.47 Reporter: HeatherM Description: DcRAT C2 Found Tags: RAT,DcRat,C2 Source: MeduzaCTI Platform Reference: https://meduzacti.com show less	Hacking

Showing 1 to 13 of 13 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇷🇺 185.180.229.105

🇨🇳 171.83.49.242

🇫🇷 51.77.158.34

🇸🇬 47.84.176.81

🇺🇸 23.235.197.206

🇺🇸 173.255.249.14

🇺🇸 136.117.87.189

🇳🇱 94.154.43.219

🇱🇹 91.224.92.17

🇳🇱 45.142.193.239

🇺🇸 44.192.31.3

🇺🇸 35.153.169.42

🇺🇸 13.217.84.69

🇮🇩 210.79.142.230

🇬🇧 193.176.29.7

🇫🇷 176.146.171.182

🇬🇧 217.146.80.106

🇸🇬 213.35.113.47

🇺🇸 104.207.70.204

🇺🇸 66.132.186.207