This IP address has been reported a total of
10
times from
6 distinct
sources.
189.63.161.8 was first reported on
November 16th 2025 , and the most recent report was
11 hours ago United States of America
with 2
reports.
The most common categories in these recent reports were:
Bad Web Bot
2
times;
Web App Attack
2
times;
Brute-Force
2
times.
Recent Reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Reporter
IoA Timestamp (UTC)
Comment
Categories
🇺🇸
TPI-Abuse
2026-10-26 11:42:33
(11 hours ago)
(mod_security) mod_security (id:210350) triggered by 189.63.161.8 (bd3fa108.virtua.com.br): 1 in the ...
show more
(mod_security) mod_security (id:210350) triggered by 189.63.161.8 (bd3fa108.virtua.com.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 26 07:42:25.427195 2026] [security2:error] [pid 32739:tid 356] [client 189.63.161.8:14293] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rodela.com|F|4"] [data "close, keep-alive"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rodela.com"] [uri "/"] [unique_id "at88oZniFxEX0cxJUaP8XAAAAUE"], referer: https://addurl.in/redirect.php?ref_host=meerkat-your-weekend.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-24 09:07:39
(2 days ago)
(mod_security) mod_security (id:210350) triggered by 189.63.161.8 (bd3fa108.virtua.com.br): 1 in the ...
show more
(mod_security) mod_security (id:210350) triggered by 189.63.161.8 (bd3fa108.virtua.com.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 24 05:07:33.731452 2026] [security2:error] [pid 10534:tid 10534] [client 189.63.161.8:14168] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rharano.org|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rharano.org"] [uri "/"] [unique_id "atx1VRY0lfDvVU9IVaOdsgAAABI"], referer: https://addurl.in/redirect.php?ref_host=schoolcounselorbooks.online
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-07-21 23:11:25
(3 months ago)
denied traffic to a honeypot network. destination port 23.
Port Scan
Hacking
🇨🇦
polycoda
2026-05-16 12:37:28
(5 months ago)
🥶 Part of massive botnet scraping campaign that nearly turned into a DDoS on 2025-11-27
DDoS Attack
🇺🇸
TPI-Abuse
2026-02-25 16:36:24
(8 months ago)
(mod_security) mod_security (id:218580) triggered by 189.63.161.8 (bd3fa108.virtua.com.br): 1 in the ...
show more
(mod_security) mod_security (id:218580) triggered by 189.63.161.8 (bd3fa108.virtua.com.br): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Feb 25 11:36:16.810888 2026] [security2:error] [pid 10006:tid 10006] [client 189.63.161.8:2801] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:\\\\/\\\\*[!+](?:[\\\\w\\\\s=_\\\\-()]+)?\\\\*\\\\/)" at ARGS:menu. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/22_SQL_SQLi.conf"] [line "76"] [id "218580"] [rev "1"] [msg "COMODO WAF: MySQL in-line comment detected.||caferutadelaseda.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "SQLi"] [hostname "caferutadelaseda.com"] [uri "/menu-detalle.php"] [unique_id "aZ8lAOL4KxO3LYbryq5V_QAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
HandyTreff.de
2025-12-04 12:51:55
(10 months ago)
Bot/Spam/Scrapper attack detected on www.handytreff.de - Score: -55.205 (Bad < -10 / Very Bad < -20 ...
show more
Bot/Spam/Scrapper attack detected on www.handytreff.de - Score: -55.205 (Bad < -10 / Very Bad < -20 / Extreme < -35) | UA: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.3
show less
Bad Web Bot
Web App Attack
2025-11-24 20:25:40
(11 months ago)
scanning http requests from known botnet
Web App Attack
🇨🇭
backslash
2025-11-21 01:05:51
(11 months ago)
block ruleset A5EE6C8F745F0934168261886A3817E5C386412A
Bad Web Bot
2025-11-19 13:16:09
(11 months ago)
scanning http requests from known botnet
Web App Attack
2025-11-16 22:53:28
(11 months ago)
scanning http requests from known botnet
Web App Attack
Showing 1 to
10
of 10 reports
