JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 185.126.252.120

185.126.252.120 was found in our database!

This IP was reported 16 times. Confidence of Abuse is 50%: ?

50%

ISP	GRANAT ISP
Usage Type	Fixed Line ISP
ASN	AS56899
Domain Name	granatua.net
Country	🇺🇦 Ukraine
City	Pryluky, Chernihiv Oblast

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 185.126.252.120

Whois 185.126.252.120

IP Abuse Reports for 185.126.252.120:

This IP address has been reported a total of 16 times from 13 distinct sources. 185.126.252.120 was first reported on August 6th 2026, and the most recent report was 4 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇮🇹 Inartis	2026-10-27 15:21:43 (4 hours ago)	185.126.252.120 - - [27/Oct/2026:16:21:42 +0100] "POST /xmlrpc.php HTTP/2.0" 403 285 "-" "Mozilla/5. ... show more 185.126.252.120 - - [27/Oct/2026:16:21:42 +0100] "POST /xmlrpc.php HTTP/2.0" 403 285 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36" ... show less	Brute-Force Bad Web Bot Web App Attack
🇲🇽 octageeks.com	2026-10-24 04:20:17 (3 days ago)	Wordpress malicious attack:[octawp]	Web App Attack
🇩🇪 LRob	2026-10-23 21:51:47 (3 days ago)	WordPress attack-tool calls \| method: POST \| path: /xmlrpc.php \| ua: Mozilla/5.0 (Windows NT 10.0; W ... show more WordPress attack-tool calls \| method: POST \| path: /xmlrpc.php \| ua: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 show less	Web App Attack Hacking
🇺🇸 nationaleventpros.com	2026-10-22 19:02:12 (5 days ago)	WordPress login attempt	Brute-Force
Anonymous	2026-10-22 06:30:04 (5 days ago)	\| [Dangerous/Ukraine] Aggressive IP 185.126.252.120 (~30 hits). Type: DoS Defender- Web server 400 e ... show more \| [Dangerous/Ukraine] Aggressive IP 185.126.252.120 (~30 hits). Type: DoS Defender- Web server 400 error code show less	Web App Attack Hacking SQL Injection
🇩🇪 FeG Deutschland	2026-10-17 15:26:30 (1 week ago)	Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 257	Exploited Host Web App Attack
🇺🇸 lostswordfish.com	2026-10-10 19:24:02 (2 weeks ago)	Wordfence waf block on registrymatters	Web App Attack
🇺🇸 TPI-Abuse	2026-10-10 18:35:11 (2 weeks ago)	(mod_security) mod_security (id:225170) triggered by 185.126.252.120 (as56899-185-126-252-120.ptr.gr ... show more (mod_security) mod_security (id:225170) triggered by 185.126.252.120 (as56899-185-126-252-120.ptr.granatua.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 10 14:35:01.518237 2026] [security2:error] [pid 31216:tid 31216] [client 185.126.252.120:0] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|avaliantlife.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "avaliantlife.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "asqFVR72XNlBAY54rLPmSgAAAEY"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-10-09 22:58:48 (2 weeks ago)	(mod_security) mod_security (id:225170) triggered by 185.126.252.120 (as56899-185-126-252-120.ptr.gr ... show more (mod_security) mod_security (id:225170) triggered by 185.126.252.120 (as56899-185-126-252-120.ptr.granatua.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 09 18:58:43.124924 2026] [security2:error] [pid 13134:tid 13134] [client 185.126.252.120:42176] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|semisysteme.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "semisysteme.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "aslxo89Az0ATVtvHhQ2kOgAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack
🇲🇽 octageeks.com	2026-10-09 04:14:51 (2 weeks ago)	Wordpress malicious attack:[octaflood]	Web App Attack
🇩🇪 anycast_ac	2026-08-30 08:03:20 (1 month ago)	[WebProtection] L4/L7 attack source · L4-UDP-RATE-BAN · 5 hits/window	Port Scan
🇺🇸 kosada.com	2026-08-25 12:01:28 (2 months ago)	Web bot: denial-of-service flood	DDoS Attack Bad Web Bot
🇫🇷 Tilellit.PRO	2026-08-20 00:23:38 (2 months ago)	PrestaShop faceted search filter flooding attempt	DDoS Attack Bad Web Bot
🇫🇷 Zkillu	2026-08-19 22:29:22 (2 months ago)	UDP flood (DDoS) vs AS215599: 7185 pkts / 10.27 MB to UDP 80/8443 across 610 dst IP(s), 2026-08-19 2 ... show more UDP flood (DDoS) vs AS215599: 7185 pkts / 10.27 MB to UDP 80/8443 across 610 dst IP(s), 2026-08-19 21:46 to 2026-08-20 00:36 CEST. No legitimate service on these UDP ports (7-day baseline 0 GB/day). Carpet-bombing of a /24, likely botnet-compromised host. Evidence: sFlow + hardware ACL counters. show less	DDoS Attack Exploited Host
🇫🇷 HaloAgencySAS	2026-08-19 22:29:22 (2 months ago)	UDP flood (DDoS) vs AS215599: 7185 pkts / 10.27 MB to UDP 80/8443 across 610 dst IP(s), 2026-08-19 2 ... show more UDP flood (DDoS) vs AS215599: 7185 pkts / 10.27 MB to UDP 80/8443 across 610 dst IP(s), 2026-08-19 21:46 to 2026-08-20 00:36 CEST. No legitimate service on these UDP ports (7-day baseline 0 GB/day). Carpet-bombing of a /24, likely botnet-compromised host. Evidence: sFlow + hardware ACL counters. show less	DDoS Attack Exploited Host

Showing 1 to 15 of 16 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇰🇿 212.154.234.9

🇧🇷 190.89.136.218

🇨🇳 120.237.113.139

🇨🇳 115.190.219.169

🇲🇾 113.211.215.156

🇺🇸 107.151.195.174

🇩🇪 77.83.25.217

🇺🇸 70.183.157.65

🇺🇸 50.6.225.165

🇺🇸 50.6.23.110

🇸🇬 43.156.212.6

🇬🇧 35.203.210.189

🇨🇳 1.62.145.206

🇩🇪 212.30.36.103

🇦🇷 190.112.37.132

🇰🇷 183.109.124.136

🇨🇳 111.10.224.70

🇳🇬 102.88.137.80

🇫🇷 92.205.165.71

🇺🇸 67.180.57.76