JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 181.94.225.202

181.94.225.202 was found in our database!

This IP was reported 32 times. Confidence of Abuse is 13%: ?

13%

ISP	Núcleo S.A.
Usage Type	Fixed Line ISP
ASN	AS27895
Domain Name	personal.com.py
Country	🇵🇾 Paraguay
City	San Lorenzo, Central Department

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 181.94.225.202

Whois 181.94.225.202

IP Abuse Reports for 181.94.225.202:

This IP address has been reported a total of 32 times from 21 distinct sources. 181.94.225.202 was first reported on September 21st 2021, and the most recent report was 1 day ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-10-26 01:13:48 (1 day ago)	(mod_security) mod_security (id:210350) triggered by 181.94.225.202 (host-181-94-225-202.personal.ne ... show more (mod_security) mod_security (id:210350) triggered by 181.94.225.202 (host-181-94-225-202.personal.net.py): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 25 21:13:42.870262 2026] [security2:error] [pid 20209:tid 20219] [client 181.94.225.202:7888] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|iamfluff.com\|F\|4"] [data "close, keep-alive"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "iamfluff.com"] [uri "/"] [unique_id "at6pRtz0sOlHhJ3vlBi6sgAAAMQ"], referer: https://moblpornographya.blogspot.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-10-25 02:49:57 (2 days ago)	(mod_security) mod_security (id:210350) triggered by 181.94.225.202 (host-181-94-225-202.personal.ne ... show more (mod_security) mod_security (id:210350) triggered by 181.94.225.202 (host-181-94-225-202.personal.net.py): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 24 22:49:52.840769 2026] [security2:error] [pid 17723:tid 17723] [client 181.94.225.202:32064] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|thevenicecafe.com\|F\|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "thevenicecafe.com"] [uri "/"] [unique_id "at1uUDhZKoRNZvjLnTXo5wAAAAc"], referer: https://loonyhiker.blogspot.com/2009_03_01_archive.html show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-09-27 12:19:32 (1 month ago)	(mod_security) mod_security (id:210350) triggered by 181.94.225.202 (host-181-94-225-202.personal.ne ... show more (mod_security) mod_security (id:210350) triggered by 181.94.225.202 (host-181-94-225-202.personal.net.py): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 27 08:19:24.282360 2026] [security2:error] [pid 8737:tid 8737] [client 181.94.225.202:4853] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|arcadiapropertiesllc.com\|F\|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "arcadiapropertiesllc.com"] [uri "/"] [unique_id "arkJzKRpYVt8m59bDo6LpwAAACA"], referer: https://websitelinkschecker.space/dir/trusted-domain-backlinks-12171 show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 鬼影233	2026-09-25 02:06:34 (1 month ago)	Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0. ... show more Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 show less	Bad Web Bot
🇺🇸 鬼影233	2026-09-23 17:49:09 (1 month ago)	Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0. ... show more Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36 show less	Bad Web Bot
🇺🇸 鬼影233	2026-08-19 00:04:27 (2 months ago)	Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0. ... show more Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 show less	Bad Web Bot
🇺🇸 kosada.com	2026-08-18 19:40:36 (2 months ago)	Web bot: denial-of-service flood	DDoS Attack Bad Web Bot
Anonymous	2026-08-07 22:00:43 (2 months ago)	Large-scale coordinated botnet (1M+ IPs). Ordered by Alexander Pen'kov (alexander-pen-kov-7b41aa6a/S ... show more Large-scale coordinated botnet (1M+ IPs). Ordered by Alexander Pen'kov (alexander-pen-kov-7b41aa6a/Shursky); Attacker: Mikhail Smirnov (mikhail-smirnov-79830323/Aidan) employed by Angara Technologies Group \| Attack Signature Blocked: /wishlist/index/add/product/11860/form_key/FAZ91iFmksspp6DX/ \| UA: Mozilla/5.0 (iPod; U; CPU iPhone OS 4_2 like Mac OS X; nr-ZA) AppleWebKit/532.22.5 (KHTML, like Gecko) Version/3.0.5 Mobile/8B119 Safari/6532.22.5 \| (Magento Site) show less	Hacking Bad Web Bot Web App Attack
🇩🇪 Vegascosmetics	2026-06-18 10:07:59 (4 months ago)	(Kingcopy.org-AI-IDS-Report):IP automatically blocked after obfuscated redirect. Vegas Security	DDoS Attack Hacking Exploited Host
🇬🇧 PeravixGroup	2026-05-16 18:50:43 (5 months ago)	Honeypot detection: Telnet / IoT device brute-force or exploitation attempt on port 23. Severity: ME ... show more Honeypot detection: Telnet / IoT device brute-force or exploitation attempt on port 23. Severity: MEDIUM. Aaran.cloud show less	IoT Targeted Brute-Force
Anonymous	2026-05-08 06:42:19 (5 months ago)	Unauthorized connection attempt on Port 2323	Port Scan Hacking Exploited Host
🇫🇮 6kilowatti	2026-04-23 03:22:21 (6 months ago)	2026-04-23T06:22:20.411287+03:00 oh6ah kernel: [UFW BLOCK] IN=enp2s0 OUT= MAC=00:26:18:a8:d6:75:2e:2 ... show more 2026-04-23T06:22:20.411287+03:00 oh6ah kernel: [UFW BLOCK] IN=enp2s0 OUT= MAC=00:26:18:a8:d6:75:2e:2d:5e:71:aa:73:08:00 SRC=181.94.225.202 DST=192.168.0.102 LEN=60 TOS=0x00 PREC=0x00 TTL=35 ID=12500 DF PROTO=TCP SPT=23236 DPT=6037 WINDOW=65535 RES=0x00 SYN URGP=0 ... show less	Port Scan
🇩🇪 EGP Abuse Dept	2026-04-07 01:48:32 (6 months ago)	Scraping webshop URLs (creall.com), likely botnet drone	Bad Web Bot Exploited Host
🇨🇦 polycoda	2026-03-05 12:44:58 (7 months ago)	🥶 Part of massive botnet scraping campaign that nearly turned into a DDoS on 2025-11-27	DDoS Attack
🇺🇸 TPI-Abuse	2026-03-04 16:53:45 (7 months ago)	(mod_security) mod_security (id:210730) triggered by 181.94.225.202 (host-202.181-94-225.personal.ne ... show more (mod_security) mod_security (id:210730) triggered by 181.94.225.202 (host-202.181-94-225.personal.net.py): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Mar 04 11:53:37.656538 2026] [security2:error] [pid 9446:tid 9446] [client 181.94.225.202:62631] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|www.disabilitiestravel.com\|F\|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.disabilitiestravel.com"] [uri "/amazon/WS_FTP.LOG"] [unique_id "aahjkdEh1ySG4uF_rVitPgAAAAw"], referer: http://www.disabilitiestravel.com/ show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 32 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇳 223.109.255.233

🇩🇪 69.5.169.62

🇰🇷 218.148.17.156

🇵🇰 182.188.24.243

🇧🇷 130.49.115.111

🇩🇪 109.160.32.113

🇯🇵 107.155.15.218

🇫🇷 85.217.140.35

🇹🇷 46.2.171.125

🇮🇩 203.145.35.161

🇳🇱 193.47.62.69

🇵🇾 190.112.210.251

🇮🇶 91.106.34.211

🇵🇹 81.84.132.249

🇺🇸 74.235.187.112

🇺🇸 70.183.226.9

🇺🇸 67.21.89.44

🇳🇱 195.178.110.228

🇲🇽 187.190.215.150

🇲🇽 187.170.163.138