JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 185.137.164.9

185.137.164.9 was found in our database!

This IP was reported 221 times. Confidence of Abuse is 100%: ?

100%

ISP	IPLuo BV
Usage Type	Data Center/Web Hosting/Transit
ASN	AS137409
Domain Name	ipluo.com
Country	🇩🇪 Germany
City	Frankfurt am Main, Hesse

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 185.137.164.9

Whois 185.137.164.9

IP Abuse Reports for 185.137.164.9:

This IP address has been reported a total of 221 times from 110 distinct sources. 185.137.164.9 was first reported on December 13th 2023, and the most recent report was 1 hour ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 CBJ	2026-07-22 03:01:33 (1 hour ago)	fail2ban: apache-filepath-recon ...	Web App Attack
🇩🇪 4server	2026-07-21 22:49:28 (6 hours ago)	[WedJul2200:49:22.8131112026][security2:error][pid3720022:tid3720103][client185.137.164.9:0]ModSecur ... show more [WedJul2200:49:22.8131112026][security2:error][pid3720022:tid3720103][client185.137.164.9:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Patternmatch\"\(\?i\)\(curl\\|wget\\|python\\|nikto\\|sqlmap\\|acunetix\\|fimap\\|dirbuster\\|cmsmap\)\"atREQUEST_HEADERS:User-Agent.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"217\"][id\"990210\"][msg\"Suspicioususer-agentblocked\"][hostname\"mail.immobiliaretrentino.it\"][uri\"/.git/HEAD\"][unique_id\"al_3chDm_Yqn_0Sahsp8RQAAAIw\"] show less	Port Scan Brute-Force Web App Attack
🇩🇪 Blexyel	2026-07-21 13:28:54 (15 hours ago)	185.137.164.9 - - [21/Jul/2026:15:28:53 +0200] "GET /.git/config HTTP/1.1" 301 169 "-" "Python-urlli ... show more 185.137.164.9 - - [21/Jul/2026:15:28:53 +0200] "GET /.git/config HTTP/1.1" 301 169 "-" "Python-urllib/3.10" "pingusmc.org" ... show less	Brute-Force Web App Attack
🇧🇪 sid3windr	2026-07-21 11:36:48 (17 hours ago)	GET /.git/HEAD (Tarpitted for 2m10s, wasted 7.73kB)	Web App Attack
🇮🇳 evicky2002	2026-07-21 06:00:00 (22 hours ago)	Confirmed malicious by STILWaters CTI platform (score=100, sources=1)	Hacking Brute-Force SSH
🇨🇭 filou812	2026-07-20 17:22:30 (1 day ago)	url tried is "/.git/HEAD"	Web App Attack
🇺🇸 TPI-Abuse	2026-07-20 14:41:07 (1 day ago)	(mod_security) mod_security (id:949110) triggered by 185.137.164.9 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:949110) triggered by 185.137.164.9 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 20 10:41:01.150761 2026] [security2:error] [pid 3091092:tid 3091092] [client 185.137.164.9:44935] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.hamiltonbookings.com"] [uri "/.git/HEAD"] [unique_id "al4zffS-uV0_oV4aGSelTQAAAAQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇨🇿 SystemAdmin	2026-07-20 11:01:45 (1 day ago)	Doing bad things...	Bad Web Bot Web App Attack
🇩🇪 4server	2026-07-20 10:59:10 (1 day ago)	[MonJul2012:59:04.6109702026][security2:error][pid1445818:tid1445901][client185.137.164.9:0]ModSecur ... show more [MonJul2012:59:04.6109702026][security2:error][pid1445818:tid1445901][client185.137.164.9:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Patternmatch\"\(\?i\)\(curl\\|wget\\|python\\|nikto\\|sqlmap\\|acunetix\\|fimap\\|dirbuster\\|cmsmap\)\"atREQUEST_HEADERS:User-Agent.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"217\"][id\"990210\"][msg\"Suspicioususer-agentblocked\"][hostname\"www.allegraravizza.it\"][uri\"/.git/HEAD\"][unique_id\"al3_eH9oyQcOJpsK-h6-GAAAAEQ\"] show less	Port Scan Brute-Force Web App Attack
🇬🇧 gurnip	2026-07-20 06:50:18 (1 day ago)	Vulnerability probe of page /.git/HEAD, not found on server.	Brute-Force Web App Attack
🇩🇪 Bedios GmbH	2026-07-20 05:30:40 (1 day ago)	Login credentials theft attempt	Hacking
🇩🇪 mravb	2026-07-20 05:14:42 (1 day ago)	185.137.164.9 - - [20/Jul/2026:08:14:41 +0300] "GET /.git/HEAD HTTP/1.1" 404 16325 "-" "Python-urlli ... show more 185.137.164.9 - - [20/Jul/2026:08:14:41 +0300] "GET /.git/HEAD HTTP/1.1" 404 16325 "-" "Python-urllib/3.10" ... show less	Web App Attack Hacking
🇫🇷 Donovan	2026-07-20 04:12:22 (2 days ago)	Web scan/exploit blocked by fail2ban on commitshift.fr - jail: npm-scan - 1 attempt(s)	Web App Attack
🇺🇸 TPI-Abuse	2026-07-20 02:26:15 (2 days ago)	(mod_security) mod_security (id:210492) triggered by 185.137.164.9 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 185.137.164.9 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 19 22:26:12.690481 2026] [security2:error] [pid 580:tid 580] [client 185.137.164.9:49663] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.navarreunited.org"] [uri "/.git/HEAD"] [unique_id "al2HRFYojdqLNjMsg_WMfAAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-20 02:06:28 (2 days ago)	(mod_security) mod_security (id:210492) triggered by 185.137.164.9 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 185.137.164.9 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 19 22:06:23.481766 2026] [security2:error] [pid 4474:tid 4474] [client 185.137.164.9:45177] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.awinwinsolution4u.ceitampa.com"] [uri "/.git/HEAD"] [unique_id "al2Cn7n4vLL5J6qnJBdeAQAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 221 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇳 180.95.238.42

🇫🇮 144.31.184.236

🇺🇸 76.132.238.43

🇫🇮 65.108.83.55

🇺🇸 64.62.156.24

🇺🇸 20.84.41.22

🇨🇳 219.139.32.68

🇧🇷 179.42.148.123

🇫🇮 147.185.133.179

🇺🇸 64.62.156.184

🇺🇸 31.204.30.213

🇷🇺 31.173.2.172

🇺🇸 20.64.105.0

🇺🇸 18.190.15.50

🇬🇧 5.226.140.9

🇨🇳 223.85.251.55

🇬🇧 195.206.182.210

🇺🇸 195.184.76.221

🇮🇩 124.40.252.3

🇮🇳 103.88.76.27