JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 185.209.199.107

185.209.199.107 was found in our database!

This IP was reported 38 times. Confidence of Abuse is 49%: ?

49%

ISP	31173 Services AB infrastructure in Gothenburg, SE.
Usage Type	Data Center/Web Hosting/Transit
ASN	AS39351
Domain Name	31173.se
Country	🇸🇪 Sweden
City	Gothenburg, Vastra Gotaland

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 185.209.199.107

Whois 185.209.199.107

IP Abuse Reports for 185.209.199.107:

This IP address has been reported a total of 38 times from 21 distinct sources. 185.209.199.107 was first reported on September 1st 2024, and the most recent report was 1 day ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 NetGuard	2026-07-13 19:04:20 (1 day ago)	#honeypot #netguard247 #ciscoasa Captured by NetGuard 24/7 T-Pot honeypot (netguard24-7.com). Timest ... show more #honeypot #netguard247 #ciscoasa Captured by NetGuard 24/7 T-Pot honeypot (netguard24-7.com). Timestamp: 2026-07-13T19:04:20.33+00:00 Attacker IP: 185.209.199.107 \| Port: N/A \| Country: Sweden Honeypot: ciscoasa \| Attack: unknown Source: NetGuard 24/7 (netguard24-7.com) \| PhantomGrid Defense show less	Web App Attack
🇨🇿 lp	2026-07-13 13:49:13 (1 day ago)	Unauthorized VPN login attempts: 1 attempts were recorded from 185.209.199.107 2026-07-13T14:48:15+0 ... show more Unauthorized VPN login attempts: 1 attempts were recorded from 185.209.199.107 2026-07-13T14:48:15+02:00 vpn Access-Reject 'scanner' station: 185.209.199.107 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>' show less	Brute-Force Web App Attack
🇺🇸 NetGuard	2026-07-08 09:40:41 (6 days ago)	#honeypot #netguard247 #ciscoasa Captured by NetGuard 24/7 T-Pot honeypot (netguard24-7.com). Timest ... show more #honeypot #netguard247 #ciscoasa Captured by NetGuard 24/7 T-Pot honeypot (netguard24-7.com). Timestamp: 2026-07-08T09:40:41.463+00:00 Attacker IP: 185.209.199.107 \| Port: N/A \| Country: Sweden Honeypot: ciscoasa \| Attack: unknown Source: NetGuard 24/7 (netguard24-7.com) \| PhantomGrid Defense show less	Web App Attack
🇧🇪 cmbplf	2026-07-08 09:39:09 (6 days ago)	275 requests with url.path .git/	Brute-Force Bad Web Bot
🇺🇸 TPI-Abuse	2026-07-08 08:06:42 (6 days ago)	(mod_security) mod_security (id:210492) triggered by 185.209.199.107 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210492) triggered by 185.209.199.107 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 08 04:06:36.578659 2026] [security2:error] [pid 17106:tid 17106] [client 185.209.199.107:52724] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "davidwoodard.com"] [uri "/.git/index"] [unique_id "ak4FDDsefhrxKznM7NJbXgAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-08 07:50:40 (6 days ago)	(mod_security) mod_security (id:210492) triggered by 185.209.199.107 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210492) triggered by 185.209.199.107 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 08 03:50:34.778237 2026] [security2:error] [pid 22650:tid 22650] [client 185.209.199.107:49030] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "darrenj.com"] [uri "/.git/index"] [unique_id "ak4BSn976Ga8V6AAb4jndQAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack
🇦🇺 paulshipley.com.au	2026-07-08 07:35:37 (6 days ago)	[Wed Jul 08 17:35:36.171325 2026] [security2:error] [pid 349501] [client 185.209.199.107:33564] [cli ... show more [Wed Jul 08 17:35:36.171325 2026] [security2:error] [pid 349501] [client 185.209.199.107:33564] [client 185.209.199.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dance4fitness.com.au"] [uri "/.git/index"] [unique_id "ak39yAVniYWxEaYG38tPGQAAAAs"] ... show less	Web App Attack
🇺🇸 TPI-Abuse	2026-07-08 07:34:51 (6 days ago)	(mod_security) mod_security (id:210492) triggered by 185.209.199.107 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210492) triggered by 185.209.199.107 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 08 03:34:47.740707 2026] [security2:error] [pid 15822:tid 15822] [client 185.209.199.107:58682] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "danafrostick.com"] [uri "/.git/index"] [unique_id "ak39l1L98KN5-OTSNYUpFgAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-08 07:14:15 (6 days ago)	(mod_security) mod_security (id:210492) triggered by 185.209.199.107 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210492) triggered by 185.209.199.107 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 08 03:14:12.724328 2026] [security2:error] [pid 25072:tid 25072] [client 185.209.199.107:55034] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cynthiabaxter.com"] [uri "/.git/index"] [unique_id "ak34xHyOD0dCJzXFClJqOQAAAAQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-08 06:17:13 (6 days ago)	(mod_security) mod_security (id:210492) triggered by 185.209.199.107 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210492) triggered by 185.209.199.107 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 08 02:17:07.461757 2026] [security2:error] [pid 26860:tid 26860] [client 185.209.199.107:44628] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "bddev.com"] [uri "/.git/index"] [unique_id "ak3rYyiRmWdEf6Le_fWsZQAAAA4"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-08 05:41:08 (6 days ago)	(mod_security) mod_security (id:210492) triggered by 185.209.199.107 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210492) triggered by 185.209.199.107 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 08 01:41:01.007203 2026] [security2:error] [pid 16375:tid 16375] [client 185.209.199.107:44838] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "banis-associates.com"] [uri "/.git/index"] [unique_id "ak3i7SCvtZwLFJokaT3PgQAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-08 05:03:04 (6 days ago)	(mod_security) mod_security (id:210492) triggered by 185.209.199.107 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210492) triggered by 185.209.199.107 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 08 01:02:59.319316 2026] [security2:error] [pid 4178:tid 4178] [client 185.209.199.107:34114] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "andrejblatnik.com"] [uri "/.git/index"] [unique_id "ak3aA9ygNXKOXbOCo0d8cgAAAAc"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 ke1v3y_OTU	2026-07-07 11:42:57 (1 week ago)	SQL injection attempt against a public web endpoint.	SQL Injection Web App Attack
🇨🇭 backslash	2026-06-29 13:21:05 (2 weeks ago)	block ruleset 3D3AFA921A373ECE19B6BA285C2D722163304638	Bad Web Bot
🇺🇸 TPI-Abuse	2026-06-06 03:28:43 (1 month ago)	(mod_security) mod_security (id:210492) triggered by 185.209.199.107 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210492) triggered by 185.209.199.107 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 05 23:28:38.060518 2026] [security2:error] [pid 15559:tid 15559] [client 185.209.199.107:52730] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "enriquejezik.com"] [uri "/.git/index"] [unique_id "aiOT5nzBWV_WGIGGXILayQAAAAQ"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 38 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 216.25.89.89

🇺🇸 192.169.213.186

🇫🇮 147.185.133.58

🇧🇩 103.183.140.129

🇹🇷 94.154.43.230

🇨🇳 61.240.17.66

🇺🇸 24.144.84.83

🇨🇳 222.176.200.183

🇸🇬 212.73.148.20

🇮🇳 171.61.23.199

🇻🇪 143.105.147.101

🇺🇸 138.68.9.158

🇨🇳 123.13.41.128

🇨🇳 112.94.252.34

🇨🇳 106.115.104.240

🇸🇦 51.36.78.95

🇨🇦 45.194.92.75

🇨🇳 36.32.3.162

🇨🇳 1.24.16.233

🇹🇷 204.93.246.104