AbuseIPDB » 189.104.128.72
189.104.128.72
This IP was reported 8 times. Confidence of
Abuse
is 44% : ?
ISP
UAB code200
Usage Type
Data Center/Web Hosting/Transit
ASN
AS10753
Domain Name
code200.global
Country
🇸🇬
Singapore
City
Singapore
IP info including ISP, Usage Type, and Location provided
by IPInfo . Updated weekly.
IP Abuse Reports for 189.104.128.72 :
This IP address has been reported a total of
8
times from
7 distinct
sources.
189.104.128.72 was first reported on
August 1st 2026 , and the most recent report was
1 hour ago
Recent Reports:
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Reporter
IoA Timestamp (UTC)
Comment
Categories
🇩🇪
bancix
2026-08-25 04:53:42
(1 hour ago)
Heimdall NIDS: Automatic ban triggered. Reason: RST_LIMIT_EXCEEDED (5/5)
Port Scan
🇩🇪
FeG Deutschland
2026-08-24 18:20:34
(11 hours ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 28
Exploited Host
Web App Attack
🇩🇪
bescared
2026-08-24 12:04:00
(18 hours ago)
WAF (2) - Malicious activity detected: URL probing.
Bad Web Bot
Web App Attack
Hacking
🇺🇸
TPI-Abuse
2026-08-17 09:58:13
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 189.104.128.72 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 189.104.128.72 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 17 05:58:09.659672 2026] [security2:error] [pid 12019:tid 12041] [client 189.104.128.72:15652] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||newtrendmag.org|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "newtrendmag.org"] [uri "/[email protected] "] [unique_id "aoLbMQLOSqDpA_9BRs9ucwAAAFE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
DrLex0
2026-08-17 07:57:57
(1 week ago)
BnL006: Obvious dumb distributed botnet crawler stepping into honeypot trap, violating robots.txt an ...
show more
BnL006: Obvious dumb distributed botnet crawler stepping into honeypot trap, violating robots.txt and meta directives
189.104.128.72 443 - [17/Aug/2026:07:57:53 +0000] "GET [redacted] HTTP/1.1" 200 6778 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36"
189.104.128.72 443 - [17/Aug/2026:07:57:57 +0000] "GET [redacted] HTTP/1.1" 200 930 "[redacted]" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36"
show less
Bad Web Bot
Exploited Host
🇺🇸
TPI-Abuse
2026-08-13 08:44:54
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 189.104.128.72 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 189.104.128.72 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 13 04:44:46.476226 2026] [security2:error] [pid 2306366:tid 2306366] [client 189.104.128.72:32912] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||www.homebuilt.org|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.homebuilt.org"] [uri "/vendors/powerplants/[email protected] "] [unique_id "an2D_qdHIbYN3Lv72TEg9QAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-08-11 17:31:01
(1 week ago)
Malicious activity detected
Hacking
Web App Attack
🇨🇭
backslash
2026-08-01 07:21:03
(3 weeks ago)
block ruleset DA4A07AEE48B136A3922182BE8AA8BFBC1840803
Bad Web Bot
Showing 1 to
8
of 8 reports
Think this IP has been falsely reported? You may request to have the associated
reports reviewed and removed.
Request Takedown 🚩
Recently Reported IPs: