JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 185.38.195.232

185.38.195.232 was found in our database!

This IP was reported 44 times. Confidence of Abuse is 58%: ?

58%

ISP	APT_Cable_Memaliaj
Usage Type	Fixed Line ISP
ASN	AS209277
Domain Name	apt.al
Country	🇦🇱 Albania
City	Tepelene, Gjirokaster County

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 185.38.195.232

Whois 185.38.195.232

IP Abuse Reports for 185.38.195.232:

This IP address has been reported a total of 44 times from 22 distinct sources. 185.38.195.232 was first reported on October 8th 2025, and the most recent report was 3 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇷 SpaceHost-Server	2026-07-02 22:28:46 (3 days ago)		Brute-Force Web App Attack
🇳🇱 Site.eu	2026-07-01 23:37:00 (4 days ago)	Excessive 404/403 errors	Brute-Force
🇺🇸 TPI-Abuse	2026-07-01 22:09:00 (4 days ago)	(mod_security) mod_security (id:240335) triggered by 185.38.195.232 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:240335) triggered by 185.38.195.232 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 01 18:08:53.436189 2026] [security2:error] [pid 23125:tid 23125] [client 185.38.195.232:51960] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5965"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 185.38.195.232 (+1 hits since last alert)\|qed-consulting.co\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "qed-consulting.co"] [uri "/xmlrpc.php"] [unique_id "akWP9drCDzwOkDxlBsaR7QAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 bigwavedave	2026-07-01 20:28:17 (4 days ago)	Wordpress Attack	Web App Attack
🇺🇸 TPI-Abuse	2026-07-01 17:46:15 (4 days ago)	(mod_security) mod_security (id:240335) triggered by 185.38.195.232 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:240335) triggered by 185.38.195.232 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 01 13:46:08.530390 2026] [security2:error] [pid 30995:tid 30995] [client 185.38.195.232:31302] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 185.38.195.232 (+1 hits since last alert)\|livingminimal.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "livingminimal.com"] [uri "/xmlrpc.php"] [unique_id "akVSYB-KvQizFhMfTC9QZgAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-22 19:11:30 (1 week ago)	(mod_security) mod_security (id:240335) triggered by 185.38.195.232 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:240335) triggered by 185.38.195.232 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 22 15:11:24.965238 2026] [security2:error] [pid 15652:tid 15652] [client 185.38.195.232:53185] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 185.38.195.232 (+1 hits since last alert)\|yogawithbubba.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "yogawithbubba.com"] [uri "/xmlrpc.php"] [unique_id "ajmI3HvgtZiqkLSgwwXA1AAAACo"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-22 17:59:12 (1 week ago)	(mod_security) mod_security (id:240335) triggered by 185.38.195.232 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:240335) triggered by 185.38.195.232 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 22 13:59:05.705371 2026] [security2:error] [pid 17577:tid 17610] [client 185.38.195.232:63632] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 185.38.195.232 (+1 hits since last alert)\|datuinc.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "datuinc.com"] [uri "/xmlrpc.php"] [unique_id "ajl36VoWo5XV6RbOaeusUAAAAI0"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-06-22 17:56:56 (1 week ago)	(wordpress) Failed wordpress login from 185.38.195.232 (AL/Albania/-)	Brute-Force
🇫🇷 Lunix	2026-06-22 17:15:41 (1 week ago)		Brute-Force Web App Attack
🇫🇷 dynamix	2026-06-22 09:37:44 (2 weeks ago)	WordPress XMLRPC Brute Force Attack	Brute-Force Web App Attack
🇩🇪 rh24	2026-06-22 09:06:43 (2 weeks ago)	(xmlrpc_405) XMLRPC-Bot 405 185.38.195.232 (AL/Albania/-)	Hacking
🇺🇸 integrantservices.com	2026-06-22 04:30:52 (2 weeks ago)	(wordpress) Failed wordpress login from 185.38.195.232 (AL/Albania/-)	Brute-Force
🇺🇸 TPI-Abuse	2026-06-22 04:03:10 (2 weeks ago)	(mod_security) mod_security (id:240335) triggered by 185.38.195.232 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:240335) triggered by 185.38.195.232 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 22 00:03:05.508430 2026] [security2:error] [pid 15781:tid 15829] [client 185.38.195.232:63482] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 185.38.195.232 (+1 hits since last alert)\|metropaint.net\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "metropaint.net"] [uri "/xmlrpc.php"] [unique_id "ajiz-Zrf-uYO0in_MiPYDAAAAdM"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 rh24	2026-06-10 18:46:43 (3 weeks ago)	(wordpress) Failed wordpress login from 185.38.195.232 (AL/Albania/-): (CF_ENABLE)	Brute-Force
Anonymous	2026-06-10 18:14:57 (3 weeks ago)	185.38.195.232 - - [10/Jun/2026:20:14:34 +0200] "POST /xmlrpc.php HTTP/1.1" 200 593 "-" "Jetpack by ... show more 185.38.195.232 - - [10/Jun/2026:20:14:34 +0200] "POST /xmlrpc.php HTTP/1.1" 200 593 "-" "Jetpack by WordPress.com (Jetpack 12.5; WordPress 6.2)" 185.38.195.232 - - [10/Jun/2026:20:14:37 +0200] "POST /xmlrpc.php HTTP/1.1" 200 403 "-" "Jetpack by WordPress.com (Jetpack 12.5; WordPress 6.2)" 185.38.195.232 - - [10/Jun/2026:20:14:45 +0200] "POST /xmlrpc.php HTTP/1.1" 200 403 "-" "Jetpack/13.0; WordPress/6.2; http://site26166278.com" 185.38.195.232 - - [10/Jun/2026:20:14:44 +0200] "POST /xmlrpc.php HTTP/1.1" 200 593 "-" "Jetpack/13.0; WordPress/6.2; http://site26166278.com" 185.38.195.232 - - [10/Jun/2026:20:14:54 +0200] "POST /xmlrpc.php HTTP/1.1" 200 593 "-" "WordPress.com; https://wordpress.com" ... show less	Brute-Force Web App Attack

Showing 1 to 15 of 44 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇮🇶 37.239.16.54

🇧🇷 205.210.31.217

🇷🇺 195.19.215.154

🇫🇷 185.177.72.53

🇮🇳 182.48.210.10

🇮🇳 139.167.225.126

🇻🇳 103.179.174.112

🇳🇱 80.91.65.208

🇨🇳 61.155.63.94

🇰🇷 14.46.87.209

🇱🇹 141.98.11.224

🇹🇭 125.25.134.71

🇭🇰 103.56.115.187

🇬🇧 91.237.124.245

🇱🇹 45.227.254.170

🇨🇳 14.103.114.136

🇷🇴 2.57.122.209

🇦🇷 181.116.220.251

🇧🇷 177.93.214.136

🇭🇰 139.198.113.29