JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 185.137.164.2

185.137.164.2 was found in our database!

This IP was reported 206 times. Confidence of Abuse is 100%: ?

100%

ISP	IPLuo BV
Usage Type	Data Center/Web Hosting/Transit
ASN	AS137409
Domain Name	ipluo.com
Country	🇩🇪 Germany
City	Frankfurt am Main, Hesse

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 185.137.164.2

Whois 185.137.164.2

IP Abuse Reports for 185.137.164.2:

This IP address has been reported a total of 206 times from 93 distinct sources. 185.137.164.2 was first reported on January 23rd 2024, and the most recent report was 22 minutes ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 4server	2026-07-21 22:49:18 (22 minutes ago)	[WedJul2200:49:13.2694512026][security2:error][pid3720026:tid3720164][client185.137.164.2:0]ModSecur ... show more [WedJul2200:49:13.2694512026][security2:error][pid3720026:tid3720164][client185.137.164.2:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Patternmatch\"\(\?i\)\(curl\\|wget\\|python\\|nikto\\|sqlmap\\|acunetix\\|fimap\\|dirbuster\\|cmsmap\)\"atREQUEST_HEADERS:User-Agent.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"217\"][id\"990210\"][msg\"Suspicioususer-agentblocked\"][hostname\"mail.ilmiotrentino.it\"][uri\"/.git/HEAD\"][unique_id\"al_3aVtb1euJ4xaBhavplAAAANI\"] show less	Port Scan Brute-Force Web App Attack
🇩🇪 Vegascosmetics	2026-07-21 16:28:29 (6 hours ago)	(Kingcopy.org-AI-IDS-Report):IP automatically blocked after high abuse score + block. Vegas Security	DDoS Attack Hacking Exploited Host
🇩🇪 Ba-Yu	2026-07-21 14:55:43 (8 hours ago)	General hacking/exploits/scanning	Web Spam Hacking Brute-Force Exploited Host Web App Attack
🇩🇪 Blexyel	2026-07-21 13:28:54 (9 hours ago)	185.137.164.2 - - [21/Jul/2026:15:28:53 +0200] "GET /.git/config HTTP/1.1" 200 265 "-" "Python-urlli ... show more 185.137.164.2 - - [21/Jul/2026:15:28:53 +0200] "GET /.git/config HTTP/1.1" 200 265 "-" "Python-urllib/3.10" "pingusmc.org" ... show less	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-07-21 12:00:16 (11 hours ago)	(mod_security) mod_security (id:210492) triggered by 185.137.164.2 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 185.137.164.2 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 21 08:00:10.361431 2026] [security2:error] [pid 293874:tid 293874] [client 185.137.164.2:57615] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.jerusalem-korczak-home.com"] [uri "/.git/HEAD"] [unique_id "al9fSvvXcyUOMXycXDIergAAABM"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-21 11:10:19 (12 hours ago)	(mod_security) mod_security (id:210492) triggered by 185.137.164.2 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 185.137.164.2 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 21 07:10:13.435702 2026] [security2:error] [pid 10512:tid 10512] [client 185.137.164.2:20803] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.criarteste.com.creartest.com"] [uri "/.git/HEAD"] [unique_id "al9TlVijHIKu6PaatsIJMwAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 masterguru	2026-07-21 08:42:58 (14 hours ago)	(modsec_5080) ModSec 5080: Infrastructure subdomain probe from 185.137.164.2 (MA/Morocco/-): 1 in th ... show more (modsec_5080) ModSec 5080: Infrastructure subdomain probe from 185.137.164.2 (MA/Morocco/-): 1 in the last 3600 secs (0-195) show less	Hacking
🇲🇳 Public CSIRT/CC of Mongolia	2026-07-21 07:08:00 (16 hours ago)	Honeypot hit: HTTP/1.1 request on 3000 GET / User-Agent: Mozilla/5.0 (Windows NT 6.2; rv:128.12) Ge ... show more Honeypot hit: HTTP/1.1 request on 3000 GET / User-Agent: Mozilla/5.0 (Windows NT 6.2; rv:128.12) Gecko/20100101 Firefox/128.12 Accept-Encoding: gzip; 3000 [6], 3001 [6], 3080 [6], 3003 [6], 4001 [6], 4002 [6] TCP show less	Web App Attack
🇺🇸 TPI-Abuse	2026-07-21 06:03:39 (17 hours ago)	(mod_security) mod_security (id:210492) triggered by 185.137.164.2 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 185.137.164.2 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 21 02:03:32.502542 2026] [security2:error] [pid 1879182:tid 1879182] [client 185.137.164.2:39143] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.eileensharaga.com"] [uri "/.git/HEAD"] [unique_id "al8LtPTQZBdFzuueZtB6DwAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇮 inlink.ltd	2026-07-21 05:16:53 (17 hours ago)	dot file probe	Web App Attack
🇺🇸 TPI-Abuse	2026-07-20 14:41:07 (1 day ago)	(mod_security) mod_security (id:949110) triggered by 185.137.164.2 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:949110) triggered by 185.137.164.2 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 20 10:41:00.610382 2026] [security2:error] [pid 3110001:tid 3110001] [client 185.137.164.2:53749] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.letahitibookings.hamiltonbookings.com"] [uri "/.git/HEAD"] [unique_id "al4zfCGbSSFmWo2_SvaBGgAAAA4"] show less	Brute-Force Bad Web Bot Web App Attack
🇿🇦 conure	2026-07-20 12:11:16 (1 day ago)	csagent: score 20.2: secrets grab x2, 404 noise floor x2; 2 domain(s) in 5s	Web App Attack
🇷🇸 Smel	2026-07-20 10:00:23 (1 day ago)	MH/MP Probe, Scan, Hack -	Port Scan Hacking
🇩🇪 Bedios GmbH	2026-07-20 05:30:57 (1 day ago)	Login credentials theft attempt	Hacking
🇨🇭 4server	2026-07-20 04:28:01 (1 day ago)	[MonJul2006:27:58.7588402026][security2:error][pid4157751:tid4158057][client185.137.164.2:0]ModSecur ... show more [MonJul2006:27:58.7588402026][security2:error][pid4157751:tid4158057][client185.137.164.2:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Matchedphrase\".git\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"365\"][id\"960720\"][msg\"Forbiddenfileaccess\"][hostname\"www.endlesspoolsticino.ch.81-17-25-250.cpanel.site\"][uri\"/.git/HEAD\"][unique_id\"al2jzlj4o4Mmu6kTZ8rLNQAAABY\"] show less	Hacking Web App Attack

Showing 1 to 15 of 206 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇸🇬 165.154.200.214

🇨🇦 20.151.10.161

🇧🇷 205.210.31.172

🇬🇧 195.96.139.39

🇷🇺 185.244.182.178

🇻🇳 171.244.141.86

🇳🇱 88.210.63.69

🇩🇪 64.226.85.205

🇩🇪 51.195.39.149

🇨🇳 218.25.233.22

🇬🇧 188.240.59.9

🇲🇽 187.195.125.196

🇧🇷 177.85.247.230

🇳🇬 165.73.201.216

🇯🇵 152.32.146.235

🇦🇫 149.54.62.114

🇺🇸 144.225.187.57

🇺🇸 136.144.33.16

🇺🇸 47.85.43.178

🇳🇱 45.148.10.157