JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 185.243.11.55

185.243.11.55

Recent Activity

118 reports found in our database

100% ▲ ▲ ▲ Critical

Abuse confidence score ?

ISP

netcup GmbH

Usage Type

Content Delivery Network

ASN

AS197540

Hostname(s)

rw0b37.webhosting.systems

Domain Name

netcup.de

Country

🇩🇪 Germany

City

Nuremberg, Bavaria

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Top Reporter Countries (Last 60 Days)

Example preview

Report Categories (Last 60 Days)

Example preview

Reports Activity

Example preview

Account required for the enhanced features Log in Sign up

IP Abuse Reports for 185.243.11.55:

This IP address has been reported a total of 118 times from 50 distinct sources. 185.243.11.55 was first reported on April 3rd 2024, and the most recent report was 5 minutes ago. In the last 60 days, the top reporter locations were: Germany with 8 reports; United States of America with 7 reports; France with 5 reports. The most common categories in these recent reports were: Web App Attack 22 times; Brute-Force 16 times; Hacking 8 times; Bad Web Bot 7 times.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-09-05 06:55:51 (5 minutes ago)	(mod_security) mod_security (id:225170) triggered by 185.243.11.55 (rw0b37.webhosting.systems): 1 in ... show more (mod_security) mod_security (id:225170) triggered by 185.243.11.55 (rw0b37.webhosting.systems): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 05 02:55:44.614341 2026] [security2:error] [pid 6759:tid 6778] [client 185.243.11.55:59288] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|www.coloradomountain.homes\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.coloradomountain.homes"] [uri "/wp-json/wp/v2/users/me"] [unique_id "apu88HT5tWMI-_oP6fzqngAAAVA"] show less	Brute-Force Bad Web Bot Web App Attack
🇮🇹 CoreTech srl	2026-09-05 06:33:57 (27 minutes ago)	cloudlinux2 fail2ban: 2026-09-05 08:28:46,411 fail2ban.filter [1594]: INFO [plesk-wordpre ... show more cloudlinux2 fail2ban: 2026-09-05 08:28:46,411 fail2ban.filter [1594]: INFO [plesk-wordpress] Found 162.241.62.187 - 2026-09-05 08:28:46cloudlinux2 fail2ban: 2026-09-05 08:28:50,262 fail2ban.filter [1594]: INFO [plesk-wordpress] Found 185.243.11.55 - 2026-09-05 08:28:49cloudlinux2 fail2ban: 2026-09-05 08:30:55,175 fail2ban.filter [1594]: INFO [plesk-modsecurity] Found 103.124.165.53 - 2026-09-05 08:30:55cloudlinux2 fail2ban: 2026-09-05 08:30:51,885 fail2ban.filter [1594]: INFO [plesk-wordpress] Found 31.134.13.233 - 2026-09-05 08:30:51cloudlinux2 fail2ban: 2026-09-05 08:31:28,662 fail2ban.filter [1594]: INFO [plesk-wordpress] Found 103.190.47.9 - 2026-09-05 08:31:28cloudlinux2 fail2ban: 2026-09-05 08:32:16,246 fail2ban.actions [1594]: NOTICE [plesk-wordpress] Unban 5.196.194.156cloudlinux2 fail2ban: 2026-09-05 08:32:28,120 fail2ban.filter [1594]: INFO [plesk-modsecurity] Found 112.50.131.1 - 2026-09-05 08:32:28cloudlinux2 fail2ban: 2026- show less	Web App Attack
Anonymous	2026-09-05 06:32:09 (29 minutes ago)	WordPress Brute Force	Brute-Force
🇺🇸 TPI-Abuse	2026-09-05 06:00:57 (1 hour ago)	(mod_security) mod_security (id:225170) triggered by 185.243.11.55 (rw0b37.webhosting.systems): 1 in ... show more (mod_security) mod_security (id:225170) triggered by 185.243.11.55 (rw0b37.webhosting.systems): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 05 02:00:49.344868 2026] [security2:error] [pid 1091:tid 1091] [client 185.243.11.55:59984] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|bostonlog.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "bostonlog.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "apuwEWCnivkazWwhg8dwwQAAACA"] show less	Brute-Force Bad Web Bot Web App Attack
🇮🇩 IndoAbuse	2026-09-05 05:53:46 (1 hour ago)	WordPress brute-force attack detected on wp-login.php / xmlrpc.php. IP automatically banned.	Brute-Force Web App Attack
🇫🇷 masterguru	2026-09-05 05:51:19 (1 hour ago)	(wordpress) Apache: Failed WordPress login from 185.243.11.55 (DE/Germany/rw0b37.webhosting.systems) ... show more (wordpress) Apache: Failed WordPress login from 185.243.11.55 (DE/Germany/rw0b37.webhosting.systems): 10 in the last 3600 secs (0-197) show less	Hacking
🇺🇸 TPI-Abuse	2026-09-05 05:44:00 (1 hour ago)	(mod_security) mod_security (id:225170) triggered by 185.243.11.55 (rw0b37.webhosting.systems): 1 in ... show more (mod_security) mod_security (id:225170) triggered by 185.243.11.55 (rw0b37.webhosting.systems): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 05 01:43:53.146042 2026] [security2:error] [pid 27710:tid 27710] [client 185.243.11.55:47778] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|grasslakepizzatime.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "grasslakepizzatime.com"] [uri "/wp-json/wp/v2/users"] [unique_id "apusGcrG4Oh6oDFwb7ffugAAAAw"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 maxxsense	2026-09-05 05:33:26 (1 hour ago)	(wordpress) Failed wordpress login from 185.243.11.55 (DE/Germany/rw0b37.webhosting.systems)	Brute-Force
🇩🇪 neckaralb-admin.de	2026-09-05 05:29:12 (1 hour ago)	(wordpress) Failed login wp-login.php or xmlrpc.php	Web App Attack
Anonymous	2026-09-05 05:24:03 (1 hour ago)	Bot / scanning and/or hacking attempts: [1/1] done, GET /wp-login.php HTTP/2.0	Hacking Web App Attack
Anonymous	2026-09-05 05:22:41 (1 hour ago)	(wordpress) Failed login wp-login.php or xmlrpc.php	Web App Attack
🇨🇦 KIsmay	2026-09-05 05:22:00 (1 hour ago)	Sep 5 00:01:28 www4 WPAudit[2874364]: 185.243.11.55 hvrhaulers.com "Mozilla/5.0 (Windows NT 10.0; W ... show more Sep 5 00:01:28 www4 WPAudit[2874364]: 185.243.11.55 hvrhaulers.com "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" sbd-admin:sbd-admin12345 FAIL Sep 5 00:16:46 www4 WPAudit[2875635]: 185.243.11.55 westkootenayrentals.com "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" root:root123!@# FAIL Sep 5 00:36:17 www4 WPAudit[2877093]: 185.243.11.55 bestnelson.org "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" katietabor-developer:bestnelson@123 FAIL Sep 5 01:19:55 www4 WPAudit[2880424]: 185.243.11.55 www.vhsport.ca "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" vhsport:VhSpOrT FAIL Sep 5 01:21:59 www4 WPAudit[2880507]: 185.243.11.55 www.servicesfyi.ca "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gec ... show less	Brute-Force Web App Attack
🇩🇪 Marc	2026-09-05 05:21:54 (1 hour ago)	185.243.11.55 - - [05/Sep/2026:06:23:32 +0200] "GET /wp-login.php HTTP/2.0" 200 3451 "https://als-ar ... show more 185.243.11.55 - - [05/Sep/2026:06:23:32 +0200] "GET /wp-login.php HTTP/2.0" 200 3451 "https://als-arnsberg.de/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" 185.243.11.55 - - [05/Sep/2026:06:23:33 +0200] "GET /wp-login.php HTTP/2.0" 200 3147 "https://als-arnsberg.de/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" 185.243.11.55 - - [05/Sep/2026:06:27:09 +0200] "GET /wp-login.php HTTP/2.0" 200 3918 "https://weiss-blau-hemer.de/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" 185.243.11.55 - - [05/Sep/2026:06:40:26 +0200] "GET /wp-login.php HTTP/2.0" 200 3919 "https://weiss-blau-hemer.de/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" 185.243.11.55 - - [05/Sep/2026:07:21:53 +0200] "GET /wp-login.ph show less	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-09-05 05:18:32 (1 hour ago)	(mod_security) mod_security (id:225170) triggered by 185.243.11.55 (rw0b37.webhosting.systems): 1 in ... show more (mod_security) mod_security (id:225170) triggered by 185.243.11.55 (rw0b37.webhosting.systems): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 05 01:18:29.102300 2026] [security2:error] [pid 12805:tid 12805] [client 185.243.11.55:59166] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|mail.mainstreetofficesuites.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "mail.mainstreetofficesuites.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "apumJfuULV-hFdjF0F3pKwAAABE"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 cwytech	2026-09-05 05:15:54 (1 hour ago)	Fleet-wide ban from the Ghostfleet 👻. Triggered by scenario: cwy/wp-us-login-only-high.	Bad Web Bot Web App Attack

Showing 1 to 15 of 118 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇪🇨 190.155.217.118

🇺🇸 172.174.201.12

🇬🇧 35.246.4.30

🇨🇦 20.48.232.178

🇧🇪 207.175.93.96

🇺🇸 205.201.134.52

192.168.202.126

192.168.44.193

🇸🇪 185.189.45.230

🇺🇸 153.66.177.193

🇰🇷 121.1.65.137

🇳🇱 89.21.67.141

🇩🇪 84.178.227.156

🇺🇸 66.132.172.141

🇹🇼 49.213.153.168

🇬🇧 35.203.210.31

🇸🇬 34.158.60.179

🇧🇪 34.62.177.160

🇺🇸 20.106.59.151

10.92.130.26