JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 185.168.30.20

185.168.30.20 was found in our database!

This IP was reported 14 times. Confidence of Abuse is 26%: ?

26%

ISP	NETLABS LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS213954
Domain Name	netlabs.com.ua
Country	🇩🇪 Germany
City	Berlin, State of Berlin

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 185.168.30.20

Whois 185.168.30.20

IP Abuse Reports for 185.168.30.20:

This IP address has been reported a total of 14 times from 10 distinct sources. 185.168.30.20 was first reported on April 10th 2026, and the most recent report was 15 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇦 URAN Publishing Service	2026-08-25 00:16:13 (15 hours ago)	[25/Aug/2026:03:16:13 +0300] -- 185.168.30.20 Ban reason: User-Agent curl/	Bad Web Bot Web App Attack
🇫🇷 claude CALVET	2026-08-19 18:46:02 (5 days ago)	gee-Joomla Admin : try to force the door...	Hacking
Anonymous	2026-08-01 18:59:18 (3 weeks ago)	[ns3.backorder.gr] httpd-login-spray-site: sites=www.blazos.com; logs=/var/log/httpd/domains/blazos. ... show more [ns3.backorder.gr] httpd-login-spray-site: sites=www.blazos.com; logs=/var/log/httpd/domains/blazos.com.log; samples=site_wide=true \| distinct_ips=13 \| /wp-login.php show less	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-07-27 21:17:29 (4 weeks ago)	(mod_security) mod_security (id:225170) triggered by 185.168.30.20 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:225170) triggered by 185.168.30.20 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 27 17:17:26.412191 2026] [security2:error] [pid 25200:tid 25200] [client 185.168.30.20:57503] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|ibcountn.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "ibcountn.com"] [uri "/wp-json/wp/v2/users"] [unique_id "amfK5m4_BEHkbbVtknNQogAAAAU"], referer: https://www.google.com show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-25 12:19:37 (1 month ago)	(mod_security) mod_security (id:225170) triggered by 185.168.30.20 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:225170) triggered by 185.168.30.20 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 25 08:19:30.759823 2026] [security2:error] [pid 1651640:tid 1651640] [client 185.168.30.20:22647] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|basse.me\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "basse.me"] [uri "/wp-json/wp/v2/users"] [unique_id "amSp0majsECmLLpMkfGdwQAAAAQ"], referer: https://www.google.com show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-21 01:24:36 (1 month ago)	(mod_security) mod_security (id:225170) triggered by 185.168.30.20 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:225170) triggered by 185.168.30.20 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 20 21:24:29.813289 2026] [security2:error] [pid 18134:tid 18134] [client 185.168.30.20:41711] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|mmipro.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "mmipro.com"] [uri "/wp-json/wp/v2/users"] [unique_id "al7KTaJpmwukzowmxJIzlAAAABY"], referer: https://www.google.com show less	Brute-Force Bad Web Bot Web App Attack
🇨🇭 backslash	2026-07-17 12:57:00 (1 month ago)	block ruleset bad bot: wordpress scans 82C095539D4FDAF84E2E2FD6B6FC0664645851A8	Bad Web Bot
🇩🇪 4server	2026-06-11 21:12:45 (2 months ago)	[ThuJun1123:12:41.9717542026][security2:error][pid2628925:tid2628956][client185.168.30.20:0]ModSecur ... show more [ThuJun1123:12:41.9717542026][security2:error][pid2628925:tid2628956][client185.168.30.20:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"170\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"studio-portale.ch\"][uri\"/xmlrpc.php\"][unique_id\"aiskyX3gK6PFMwpZWCqopAAAAAg\"] show less	Port Scan Brute-Force Web App Attack
🇫🇷 dynamix	2026-05-29 11:45:48 (2 months ago)	Multiple WAF Violations	Web App Attack
🇬🇧 [email protected]	2026-05-17 00:08:17 (3 months ago)	185.168.30.20 - - [17/May/2026:00:08:15 +0000] "GET /badges/badge.php?hash=2a8d95eb294d52604f68eb59a ... show more 185.168.30.20 - - [17/May/2026:00:08:15 +0000] "GET /badges/badge.php?hash=2a8d95eb294d52604f68eb59a948200abbf02d4c%27%29+AND+AND%250A3566%2501IN%250E%28SELECT%2503%28%2527~%2527%2B%28SELECT%250A%28CASE%2504WHEN%2505%283566%3D3566%29%2503THEN%250F%25271%2527%2503ELSE%2505%25270%2527%2507END%29%29%2B%2527~%2527%29%29--+- HTTP/1.1" 301 645 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" 185.168.30.20 - - [17/May/2026:00:08:16 +0000] "GET /badges/badge.php?hash=2a8d95eb294d52604f68eb59a948200abbf02d4c%27+AND+AND%2F%2A%2A%2F7122%3D%28SELECT%2F%2A%2A%2FUPPER%28XMLType%28CHR%2860%29%7C%7CCHR%2858%29%7C%7C%27~%27%7C%7C%28SELECT%2F%2A%2A%2F%28CASE%2F%2A%2A%2FWHEN%2F%2A%2A%2F%287122%3D7122%29%2F%2A%2A%2FTHEN%2F%2A%2A%2F1%2F%2A%2A%2FELSE%2F%2A%2A%2F0%2F%2A%2A%2FEND%29%2F%2A%2A%2FFROM%2F%2A%2A%2FDUAL%29%7C%7C%27~%27%7C%7CCHR%2862%29%29%29%2F%2A%2A%2FFROM%2F%2A%2A%2FDUAL%29--+- HTTP/1.1" 301 814 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" 185.168.30.20 - - ... show less	Web App Attack
🇺🇸 interbiznw.com	2026-05-16 02:52:32 (3 months ago)	wordpress-bruteforce	Hacking Brute-Force Exploited Host Web App Attack
🇩🇪 nyt	2026-05-13 22:57:51 (3 months ago)	SQLi (quote probe)	SQL Injection Web App Attack
🇺🇸 TPI-Abuse	2026-04-10 08:13:20 (4 months ago)	(mod_security) mod_security (id:225170) triggered by 185.168.30.20 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:225170) triggered by 185.168.30.20 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Apr 10 04:13:12.787546 2026] [security2:error] [pid 1357631:tid 1357631] [client 185.168.30.20:15603] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|primacomm.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "primacomm.com"] [uri "/wp-json/wp/v2/users"] [unique_id "adixGMAePADEWF4odtlzPAAAAAg"], referer: https://www.google.com show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-04-10 02:11:05 (4 months ago)	(mod_security) mod_security (id:225170) triggered by 185.168.30.20 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:225170) triggered by 185.168.30.20 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Apr 09 22:11:00.358429 2026] [security2:error] [pid 1926442:tid 1926442] [client 185.168.30.20:36297] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|fsmfl.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "fsmfl.com"] [uri "/wp-json/wp/v2/users"] [unique_id "adhcNL5B0lu0c8C_EGayjAAAAAs"], referer: https://www.google.com show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 14 of 14 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇧🇪 198.235.24.133

🇷🇴 193.46.255.86

🇺🇦 178.159.218.96

🇺🇸 161.123.130.109

🇹🇭 118.193.56.229

🇨🇳 117.156.229.133

🇳🇱 91.92.40.239

🇺🇸 52.23.26.158

🇮🇳 43.243.80.145

🇹🇼 35.194.162.14

🇰🇷 210.105.171.28

🇺🇸 172.174.130.156

🇺🇸 162.241.29.37

🇺🇸 137.184.112.30

🇷🇴 92.118.39.77

🇳🇱 91.92.40.217

🇺🇸 82.23.222.66

🇺🇸 82.23.222.65

🇺🇸 70.15.196.43

🇱🇹 62.60.130.242