JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

181.117.184.153

Recent Activity

Abuse Confidence Score

34% Elevated

33 reports

22 reporters · latest 46 minutes ago

ISP: AMX Paraguay SA
Usage Type: Fixed Line ISP
ASN: AS11664
Domain Name: claro.com.py
Country: 🇵🇾 Paraguay
City: San Lorenzo, Central Department

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Example preview

Account required for the enhanced features Log in Sign up

Abuse Reports

Export reports CSV

Total reports

33 from 22 distinct reporters

First reported

November 15th 2025

Most recent report

46 minutes ago

Last 60 days

Top reporter locations 🇺🇸 United States of America 5 🇩🇪 Germany 2 🇮🇹 Italy 1

Most common categories Web App Attack 7 Bad Web Bot 7 Brute-Force 4 Hacking 2 SSH 1

Recent reports We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 4server	2026-11-08 10:34:26 UTC · (46 minutes ago)	[SunNov0811:34:19.6389932026][security2:error][pid4011770:tid4011887][client181.117.184.153:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Stringmatchwithin\".asa/.asax/.ascx/.backup/.bak/.bat/.cdx/.cer/.cfg/.cmd/.com/.config/.conf/.cs/.csproj/.csr/ ... show more [SunNov0811:34:19.6389932026][security2:error][pid4011770:tid4011887][client181.117.184.153:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Stringmatchwithin\".asa/.asax/.ascx/.backup/.bak/.bat/.cdx/.cer/.cfg/.cmd/.com/.config/.conf/.cs/.csproj/.csr/.dat/.db/.dbf/.dll/.dos/.htr/.htw/.ida/.idc/.idq/.inc/.ini/.key/.licx/.lnk/.log/.mdb/.old/.pass/.pdb/.pol/.printer/.pwd/.rdb/.resources/.resx/.sql/.swp/.sys/.vb/.vbs/.vbproj/.vsdisco/.webinfo/.xsx/\"atTX:extension.[file\"/etc/apache2/conf.d/modsec_rules/00_asl_zz_strict.conf\"][line\"91\"][id\"390716\"][rev\"2\"][msg\"Atomicorp.comWAFRules:URLfileextensionisrestrictedbypolicy\"][data\".com\"][severity\"ERROR\"][hostname\"noleggi.ch\"][uri\"/web/image/blog.post/48/author_avatar/SitoWebOCST.com\"][unique_id\"avBQKySO3QdupMaJLKz0pwAAAQY\"]\,referer:https://noleggi.ch/blog/realizzazioneweb-6/tag/web-5 show less	Port Scan Brute-Force Web App Attack
Anonymous	2026-10-30 06:30:27 UTC · (1 week ago)	Large-scale coordinated botnet (8M+ IPs). Ordered by Alexander Pen'kov (alexander-pen-kov-7b41aa6a/Shursky [yordim\|LIS\|MOW]): Retaliation after theft; Attacker: Mikhail Smirnov (mikhail-smirnov-79830323/Aidan [MOW]): Employed by Angara Technologies G ... show more Large-scale coordinated botnet (8M+ IPs). Ordered by Alexander Pen'kov (alexander-pen-kov-7b41aa6a/Shursky [yordim\|LIS\|MOW]): Retaliation after theft; Attacker: Mikhail Smirnov (mikhail-smirnov-79830323/Aidan [MOW]): Employed by Angara Technologies Group \| Offpeak: Sessionless Catalog Access Blocked: /catalog/product_compare/add/product/9977/uenc/aHR0cHM6Ly93d3cuZDJvZmZpY2UucnUvYnJhbmRzL3Nob3BieS9tYW51ZmFjdHVyZXItY2hpZWYtY2hyaXN0aWUtZm9ydGluZXQuaHRtbD9fX19TSUQ9MjJjZTNmYWEzYmMxOTgwNTQwYzdkMzI3ZGFhNmEzZjdV/form_key/zZd5TAGyyJh6S76c/ \| UA: Opera/9.35.(X11; Linux x86_64; wal-ET) Presto/2.9.185 Version/10.00 \| (Magento Site) show less	Hacking Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-10-26 21:39:52 UTC · (1 week ago)	(mod_security) mod_security (id:210350) triggered by 181.117.184.153 (host153.181-117-184.in-addr.arpa.claro.com.py): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 26 17:39:47.720222 2026] [security2:error] [pid 1 ... show more (mod_security) mod_security (id:210350) triggered by 181.117.184.153 (host153.181-117-184.in-addr.arpa.claro.com.py): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 26 17:39:47.720222 2026] [security2:error] [pid 10802:tid 10802] [client 181.117.184.153:15130] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|beautyradio.com\|F\|4"] [data "close, keep-alive"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "beautyradio.com"] [uri "/"] [unique_id "at_IoxSV01t6PNFf8Q9NbQAAAAI"], referer: https://five.co.in/redirect.php?ref_host=stuttgarttrust.de show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-10-22 04:22:39 UTC · (2 weeks ago)	(mod_security) mod_security (id:210350) triggered by 181.117.184.153 (host153.181-117-184.in-addr.arpa.claro.com.py): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 22 00:22:32.330068 2026] [security2:error] [pid 1 ... show more (mod_security) mod_security (id:210350) triggered by 181.117.184.153 (host153.181-117-184.in-addr.arpa.claro.com.py): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 22 00:22:32.330068 2026] [security2:error] [pid 12220:tid 12220] [client 181.117.184.153:55726] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|cbcfargo.com\|F\|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "cbcfargo.com"] [uri "/resources/promise/true_joy.pdf"] [unique_id "atmPiJxddnlmQgaFTvmRewAAAAE"], referer: https://cbcfargo.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 LRob	2026-10-17 00:04:58 UTC · (3 weeks ago)	Calendar filter flood (L7 DDoS) \| host: escrime-auvergnerhonealpes.fr \| path: /calendrier-2/action~agenda/cat_ids~132/tag_ids~220,638,467,641,264,485,677/request_format~json/ \| src_port: 47804	DDoS Attack Web App Attack
Anonymous	2026-10-10 06:42:06 UTC · (4 weeks ago)	Search protection: facets on category: 8 values in one group (limit 5), 2 groups (limit 3) / reCAPTCHA challenge timed out	Bad Web Bot
🇺🇸 鬼影233	2026-10-01 05:03:45 UTC · (1 month ago)	Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36	Bad Web Bot
🇺🇸 鬼影233	2026-09-26 19:54:52 UTC · (1 month ago)	Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36	Bad Web Bot
🇺🇸 TPI-Abuse	2026-09-26 05:24:12 UTC · (1 month ago)	(mod_security) mod_security (id:210350) triggered by 181.117.184.153 (host153.181-117-184.in-addr.arpa.claro.com.py): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 26 01:24:07.037487 2026] [security2:error] [pid 7 ... show more (mod_security) mod_security (id:210350) triggered by 181.117.184.153 (host153.181-117-184.in-addr.arpa.claro.com.py): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 26 01:24:07.037487 2026] [security2:error] [pid 7447:tid 7447] [client 181.117.184.153:53059] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|artizandecor.com\|F\|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "artizandecor.com"] [uri "/"] [unique_id "ardW9yoadylrTKikx2KzvwAAAAg"], referer: https://bulkdadrchecker.store/dir/trusted-backlink-services-13393 show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 homeshowdomain.nl	2026-09-19 22:01:22 UTC · (1 month ago)	Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-09-18.	Web App Attack SSH Hacking
🇺🇸 kosada.com	2026-08-26 18:09:38 UTC · (2 months ago)	Web bot: denial-of-service flood	DDoS Attack Bad Web Bot
🇫🇷 Zkillu	2026-08-19 22:29:28 UTC · (2 months ago)	UDP flood (DDoS) vs AS215599: 19 pkts / 0.03 MB to UDP 8443 across 17 dst IP(s), 2026-08-19 21:46 to 2026-08-20 00:36 CEST. No legitimate service on these UDP ports (7-day baseline 0 GB/day). Carpet-bombing of a /24, likely botnet-compromised host. E ... show more UDP flood (DDoS) vs AS215599: 19 pkts / 0.03 MB to UDP 8443 across 17 dst IP(s), 2026-08-19 21:46 to 2026-08-20 00:36 CEST. No legitimate service on these UDP ports (7-day baseline 0 GB/day). Carpet-bombing of a /24, likely botnet-compromised host. Evidence: sFlow + hardware ACL counters. show less	DDoS Attack Exploited Host
🇫🇷 HaloAgencySAS	2026-08-19 22:29:28 UTC · (2 months ago)	UDP flood (DDoS) vs AS215599: 19 pkts / 0.03 MB to UDP 8443 across 17 dst IP(s), 2026-08-19 21:46 to 2026-08-20 00:36 CEST. No legitimate service on these UDP ports (7-day baseline 0 GB/day). Carpet-bombing of a /24, likely botnet-compromised host. E ... show more UDP flood (DDoS) vs AS215599: 19 pkts / 0.03 MB to UDP 8443 across 17 dst IP(s), 2026-08-19 21:46 to 2026-08-20 00:36 CEST. No legitimate service on these UDP ports (7-day baseline 0 GB/day). Carpet-bombing of a /24, likely botnet-compromised host. Evidence: sFlow + hardware ACL counters. show less	DDoS Attack Exploited Host
🇺🇸 NetVexor	2026-08-16 19:26:50 UTC · (2 months ago)	Attack source identified and submitted via NetVexor BGP Blackhole Network	Port Scan Hacking Brute-Force
🇩🇪 LRob	2026-08-11 16:09:50 UTC · (2 months ago)	Web application probing \| req: \x1E\xE2n\x1A:/\xA0\x00\xD6\xFE\xA0.*\x7F\xABG\xD3\x1BA8 \| 11 distinct paths \| UA: -	Port Scan Web App Attack

Showing 1 to 15 of 33 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇩🇪 213.209.159.238

🇳🇱 193.176.31.216

🇮🇳 122.170.111.140

🇬🇪 85.117.58.67

🇺🇸 24.198.211.111

🇺🇸 20.118.203.173

🇺🇸 20.115.91.255

🇺🇸 15.204.75.123

🇺🇸 172.58.165.114

🇺🇸 149.72.120.130

🇲🇾 123.253.33.161

🇰🇷 106.244.120.37

🇸🇬 85.199.255.141

🇮🇶 65.20.129.28

🇩🇪 49.51.171.140

🇬🇧 35.203.211.253

🇺🇸 20.112.236.17

🇯🇵 1.66.222.119

🇨🇳 1.27.251.252

🇧🇭 193.188.113.139