JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 181.199.54.56

181.199.54.56 was found in our database!

This IP was reported 9 times. Confidence of Abuse is 4%: ?

ISP	ECUANET - CORPORACION ECUATORIANA DE INFORMACION
Usage Type	Fixed Line ISP
ASN	AS27947
Hostname(s)	host-181-199-54-56.ecua.net.ec
Domain Name	megadatos.net
Country	🇪🇨 Ecuador
City	Quito, Pichincha

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 181.199.54.56

Whois 181.199.54.56

IP Abuse Reports for 181.199.54.56:

This IP address has been reported a total of 9 times from 8 distinct sources. 181.199.54.56 was first reported on September 23rd 2025, and the most recent report was 2 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-09-17 01:36:49 (2 days ago)	(mod_security) mod_security (id:210350) triggered by 181.199.54.56 (host-181-199-54-56.ecua.net.ec): ... show more (mod_security) mod_security (id:210350) triggered by 181.199.54.56 (host-181-199-54-56.ecua.net.ec): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 16 21:36:45.454513 2026] [security2:error] [pid 24801:tid 24801] [client 181.199.54.56:28181] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|serviciosysolucionesindustrialesreal.com\|F\|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "serviciosysolucionesindustrialesreal.com"] [uri "/"] [unique_id "aqtELWQFnOyejA7nJ10YewAAAAY"], referer: https://backlinkanalysis.space/dir/ranking-focused-backlinks-186583 show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-05-30 04:37:26 (3 months ago)	Attack Signature Blocked: /wishlist/index/add/product/9352/form_key/IqczqgV3HPGwaHUE/ \| UA: Mozilla/ ... show more Attack Signature Blocked: /wishlist/index/add/product/9352/form_key/IqczqgV3HPGwaHUE/ \| UA: Mozilla/5.0 (Windows; U; Windows 98) AppleWebKit/535.26.5 (KHTML, like Gecko) Version/5.1 Safari/535.26.5 \| (Magento Site) (Botnet activity attributed to: Angara... show less	Web App Attack Bad Web Bot
🇩🇪 pltcldvlpr	2026-05-29 06:38:17 (3 months ago)	Bogus Useragent: 181.199.54.56 - - [29/May/2026:08:38:16 +0200] "GET /protocol?id=st_8_94&offset=215 ... show more Bogus Useragent: 181.199.54.56 - - [29/May/2026:08:38:16 +0200] "GET /protocol?id=st_8_94&offset=2150&seq=2154 HTTP/1.1" 403 5 "-" "Opera/9.22.(Windows CE; ga-IE) Presto/2.9.166 Version/12.00" asn=27947 org="Telconet S.A" country=EC ... show less	Bad Web Bot
Anonymous	2026-04-30 16:06:09 (4 months ago)	Trying to access config files	Web App Attack
🇮🇩 hermawan	2026-02-03 05:21:15 (7 months ago)	[Tue Feb 03 12:21:14.017377 2026] [security2:error] [pid 759811:tid 140241523410624] [client 181.199 ... show more [Tue Feb 03 12:21:14.017377 2026] [security2:error] [pid 759811:tid 140241523410624] [client 181.199.54.56:10975] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "image/heif" at REQUEST_HEADERS:Accept. [file "/etc/modsecurity/coreruleset-4.22.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "425"] [id "440009"] [msg " Image Heif"] [data " Matched Data ARGS charset: - Matched Data TX.1: found within Content-Type multipart form Matched Data: text/html found within REQUEST_HEADERS:Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/heif,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 request_line = GET /index.php/prakiraan-iklim/prakiraan-bulanan/prakiraan-curah-hujan-bulanan/3-bulan-ke-depan/555561304-prakiraan-bulanan-curah-hujan-bulan-november-tahun-2024-update-dari-analisis-bulan-juli-..."] [hostname "staklim-jatim.bmkg.go.id"] [uri "/index.php/prakiraan-iklim/prakiraan-bulanan/prakiraan-curah-hujan-bulanan/3- ... show less	Hacking Web App Attack
Anonymous	2025-11-18 10:06:07 (10 months ago)	scanning http requests from known botnet	Web App Attack
Anonymous	2025-11-14 17:26:11 (10 months ago)	scanning http requests from known botnet	Web App Attack
🇭🇺 ksol-hostmaster	2025-10-20 00:22:40 (10 months ago)	Massive botnet baited into scraping tarpit	Bad Web Bot
🇩🇪 pressler.pro	2025-09-23 06:14:14 (11 months ago)	Fail2ban - DDoS attack on woocommerce shop ...	DDoS Attack

Showing 1 to 9 of 9 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 2a03:2880:f804:3e::

🇧🇷 205.210.31.237

🇧🇷 205.210.31.231

🇺🇸 198.144.189.91

🇵🇾 190.128.241.2

🇲🇽 189.232.75.149

🇺🇸 162.216.149.243

🇮🇳 103.255.235.11

🇮🇳 103.207.9.246

🇿🇦 102.64.39.12

🇺🇸 70.166.129.80

🇨🇳 43.143.182.124

🇺🇸 20.29.58.78

🇧🇷 205.210.31.230

🇧🇷 205.210.31.221

🇻🇪 189.127.167.64

🇧🇷 187.93.68.178

🇧🇴 181.188.176.242

🇵🇭 180.190.241.78

🇳🇱 176.65.148.136