JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 185.146.112.128

185.146.112.128 was found in our database!

This IP was reported 28 times. Confidence of Abuse is 39%: ?

39%

ISP	AG Telekom MMC.
Usage Type	Fixed Line ISP
ASN	AS57293
Hostname(s)	128-dynamic-ip.katv1-dot-net
Domain Name	katv1.az
Country	🇦🇿 Azerbaijan
City	Baku, Baki

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 185.146.112.128

Whois 185.146.112.128

IP Abuse Reports for 185.146.112.128:

This IP address has been reported a total of 28 times from 20 distinct sources. 185.146.112.128 was first reported on August 6th 2024, and the most recent report was 1 day ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-10-15 09:43:44 (1 day ago)	(mod_security) mod_security (id:225170) triggered by 185.146.112.128 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:225170) triggered by 185.146.112.128 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 05:43:26.453921 2026] [security2:error] [pid 30653:tid 30653] [client 185.146.112.128:19098] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|dixiegeek.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "dixiegeek.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "atCgPs8rQ9XO-NT1WiTRTwAAAAc"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 etu brutus	2026-10-15 07:48:42 (1 day ago)	185.146.112.128 has been banned for [WebApp Pipeline] ...	Hacking Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-10-15 06:37:35 (1 day ago)	(mod_security) mod_security (id:225170) triggered by 185.146.112.128 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:225170) triggered by 185.146.112.128 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 02:37:16.976691 2026] [security2:error] [pid 2021:tid 2021] [client 185.146.112.128:19096] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|modalguitarist.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "modalguitarist.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "atB0nI8tDZ9znOLGlb8CagAAAA8"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 mnsf	2026-10-15 05:06:16 (1 day ago)	Too many Status 40X (11)	Brute-Force Web App Attack
🇷🇺 Darth Vader	2026-10-13 10:03:26 (3 days ago)	nfdump top talker: 185.146.112.128 \| first seen 2026-10-13 13:03:26.592 \| duration 00:00:00.285 \| fl ... show more nfdump top talker: 185.146.112.128 \| first seen 2026-10-13 13:03:26.592 \| duration 00:00:00.285 \| flows=3 \| packets=79794 \| bytes=57.5 M \| pps=279 \| bps=1.6 M \| bpp=721 \| proto=udp show less	DDoS Attack Port Scan Exploited Host
🇷🇺 Darth Vader	2026-10-13 10:03:26 (3 days ago)	nfdump top talker: 185.146.112.128 \| first seen 2026-10-13 13:03:26.592 \| duration 00:00:00.289 \| fl ... show more nfdump top talker: 185.146.112.128 \| first seen 2026-10-13 13:03:26.592 \| duration 00:00:00.289 \| flows=4 \| packets=102300 \| bytes=75.0 M \| pps=353 \| bps=2.1 M \| bpp=733 \| proto=udp show less	DDoS Attack Port Scan Exploited Host
🇷🇺 Darth Vader	2026-10-08 10:22:10 (1 week ago)	nfdump top talker: 185.146.112.128 \| first seen 2026-10-08 13:22:10.432 \| duration 00:00:00.076 \| fl ... show more nfdump top talker: 185.146.112.128 \| first seen 2026-10-08 13:22:10.432 \| duration 00:00:00.076 \| flows=4 \| packets=122760 \| bytes=89.9 M \| pps=1598 \| bps=9.4 M \| bpp=731 \| proto=any show less	DDoS Attack Port Scan Exploited Host
🇫🇷 Tilellit.PRO	2026-10-02 04:47:32 (2 weeks ago)	WooCommerce YITH AJAX Filder product_cat filter flood attempt with taxonomies	DDoS Attack Bad Web Bot
🇺🇸 TPI-Abuse	2026-09-18 20:53:20 (3 weeks ago)	(mod_security) mod_security (id:210350) triggered by 185.146.112.128 (nat-pool-185.146.112.128.katv1 ... show more (mod_security) mod_security (id:210350) triggered by 185.146.112.128 (nat-pool-185.146.112.128.katv1.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 18 16:53:13.935030 2026] [security2:error] [pid 5701:tid 5701] [client 185.146.112.128:36242] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|saadehcomputers.com\|F\|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "saadehcomputers.com"] [uri "/cgi-bin"] [unique_id "aq2kueBetb3xbd2anDkmegAAABM"], referer: https://saadehcomputers.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 鬼影233	2026-08-30 10:54:37 (1 month ago)	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Sa ... show more Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 show less	Bad Web Bot
Anonymous	2026-08-29 11:00:32 (1 month ago)	Large-scale coordinated botnet (3M+ IPs). Ordered by Alexander Pen'kov (alexander-pen-kov-7b41aa6a/S ... show more Large-scale coordinated botnet (3M+ IPs). Ordered by Alexander Pen'kov (alexander-pen-kov-7b41aa6a/Shursky [yordim\|LIS\|MOW]); Attacker: Mikhail Smirnov (mikhail-smirnov-79830323/Aidan [MOW]) employed by Angara Technologies Group \| Attack Signature Blocked: /wishlist/index/add/product/13642/form_key/SOoiHCIgAfn8hoC8/ \| UA: Mozilla/5.0 (Linux; Android 4.4) AppleWebKit/533.2 (KHTML, like Gecko) Chrome/31.0.825.0 Safari/533.2 \| (Magento Site) show less	Hacking Bad Web Bot Web App Attack
🇺🇸 kosada.com	2026-08-15 21:28:19 (2 months ago)	Web bot: denial-of-service flood	DDoS Attack Bad Web Bot
🇺🇸 kosada.com	2026-08-01 10:29:12 (2 months ago)	Web bot: denial-of-service flood	DDoS Attack Bad Web Bot
🇩🇪 pltcldvlpr	2026-07-22 13:03:01 (2 months ago)	Bogus Useragent: 185.146.112.128 - - [22/Jul/2026:15:03:00 +0200] "GET /protocol?id=sn_6_87&offset=1 ... show more Bogus Useragent: 185.146.112.128 - - [22/Jul/2026:15:03:00 +0200] "GET /protocol?id=sn_6_87&offset=1450&seq=1450 HTTP/1.1" 444 0 "-" "Mozilla/5.0 (compatible; MSIE 6.0; Windows NT 5.2; Trident/5.0)" asn=57293 org="AG Telekom MMC." country=AZ ... show less	Bad Web Bot
🇺🇸 kosada.com	2026-06-29 18:02:37 (3 months ago)	Web bot: denial-of-service flood	DDoS Attack Bad Web Bot

Showing 1 to 15 of 28 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇳 221.226.114.202

🇧🇬 213.91.235.218

🇧🇴 181.188.176.242

🇵🇱 145.239.85.118

🇮🇳 139.59.28.253

🇵🇭 126.209.52.228

🇳🇱 109.160.32.142

🇺🇸 50.104.94.242

🇺🇸 20.65.217.249

🇷🇴 2.57.121.112

🇨🇴 190.242.58.154

🇰🇿 185.217.188.134

🇮🇳 117.192.41.235

🇵🇱 78.31.146.191

🇳🇱 45.148.10.240

🇮🇳 20.204.146.105

🇮🇳 223.188.168.33

🇧🇬 158.173.89.50

🇨🇳 115.190.211.57

🇮🇩 103.187.165.26