JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

191.253.41.50

Recent Activity

Abuse Confidence Score

57% Elevated

48 reports

25 reporters · latest 20 hours ago

ISP: SERRA GERAL SOLUCOES PARA INTERNET LTDA
Usage Type: Fixed Line ISP
ASN: AS263527
Hostname(s): host50-41-rf.serrageral.net.br
Domain Name: serrageral.net.br
Country: 🇧🇷 Brazil
City: Sao Jose, Santa Catarina

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Example preview

Account required for the enhanced features Log in Sign up

Abuse Reports

Export reports CSV

Total reports

48 from 25 distinct reporters

First reported

October 31st 2023

Most recent report

20 hours ago

Last 60 days

Top reporter locations 🇺🇸 United States of America 14 🇬🇧 United Kingdom of Great Britain and Northern Ireland 2 🇦🇺 Australia 1

Most common categories Bad Web Bot 13 Web App Attack 8 Brute-Force 5 Exploited Host 1 Hacking 1

Recent reports We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇲🇽 octageeks.com	2026-11-12 05:23:23 UTC · (20 hours ago)	Wordpress malicious attack:[octaflood]	Web App Attack
🇦🇺 paulshipley.com.au	2026-11-12 04:26:46 UTC · (21 hours ago)	[Thu Nov 12 15:26:45.514246 2026] [security2:error] [pid 471775] [client 191.253.41.50:11109] [client 191.253.41.50] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQU ... show more [Thu Nov 12 15:26:45.514246 2026] [security2:error] [pid 471775] [client 191.253.41.50:11109] [client 191.253.41.50] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "shop.levellapromotions.co.nz"] [uri "/xmlrpc.php"] [unique_id "avVABSmHJKIqIdp8ZoBmQQAAAAQ"] ... show less	Web App Attack
🇬🇧 gigatech	2026-11-12 00:40:04 UTC · (1 day ago)	Webserver Probing	Web App Attack
🇺🇸 TPI-Abuse	2026-11-11 17:39:24 UTC · (1 day ago)	(mod_security) mod_security (id:225170) triggered by 191.253.41.50 (host50-41-rf.serrageral.net.br): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 12:39:16.440125 2026] [security2:error] [pid 6165:tid 6165] [cl ... show more (mod_security) mod_security (id:225170) triggered by 191.253.41.50 (host50-41-rf.serrageral.net.br): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 12:39:16.440125 2026] [security2:error] [pid 6165:tid 6165] [client 191.253.41.50:11108] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|stukabird.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "stukabird.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "avSoRLXChQXf-INL6rybmQAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 cwytech	2026-11-11 12:53:16 UTC · (1 day ago)	Fleet-wide ban from the Ghostfleet 👻. Triggered by scenario: cwy/wp-us-login-only-high.	Bad Web Bot Web App Attack
Anonymous	2026-11-10 21:16:03 UTC · (2 days ago)	WordPress REST API Plugin Information Disclosure.	Hacking
🇸🇪 vaia.cloud	2026-11-10 09:30:04 UTC · (2 days ago)	crowdsecurity/http-cve-probing	Brute-Force Web App Attack
🇺🇸 nationaleventpros.com	2026-11-09 22:11:48 UTC · (3 days ago)	WordPress login attempt	Brute-Force
🇺🇸 TPI-Abuse	2026-11-07 08:52:14 UTC · (5 days ago)	(mod_security) mod_security (id:225170) triggered by 191.253.41.50 (host50-41-rf.serrageral.net.br): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 03:52:06.426657 2026] [security2:error] [pid 2898:tid 2898] [cl ... show more (mod_security) mod_security (id:225170) triggered by 191.253.41.50 (host50-41-rf.serrageral.net.br): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 03:52:06.426657 2026] [security2:error] [pid 2898:tid 2898] [client 191.253.41.50:11334] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|latentpixel.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "latentpixel.com"] [uri "/wp-json/wp/v2/users"] [unique_id "au7mtkC8HELj3nnEuLuK4wAAABE"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 鬼影233	2026-10-01 18:09:09 UTC · (1 month ago)	Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36	Bad Web Bot
🇺🇸 鬼影233	2026-09-29 10:30:54 UTC · (1 month ago)	Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36	Bad Web Bot
🇺🇸 鬼影233	2026-09-28 22:49:42 UTC · (1 month ago)	Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36	Bad Web Bot
🇺🇸 TPI-Abuse	2026-09-27 02:39:46 UTC · (1 month ago)	(mod_security) mod_security (id:210350) triggered by 191.253.41.50 (host50-41-rf.serrageral.net.br): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 26 22:39:39.232748 2026] [security2:error] [pid 14849:tid 14849] [ ... show more (mod_security) mod_security (id:210350) triggered by 191.253.41.50 (host50-41-rf.serrageral.net.br): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 26 22:39:39.232748 2026] [security2:error] [pid 14849:tid 14849] [client 191.253.41.50:18653] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|schonar.com\|F\|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "schonar.com"] [uri "/"] [unique_id "ariB68kVG2gD5q5yPU8Y7AAAAA8"], referer: https://drurchecker.shop/dir/strategic-seo-backlinks-183910 show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 鬼影233	2026-09-24 22:25:55 UTC · (1 month ago)	Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36	Bad Web Bot
🇺🇸 鬼影233	2026-09-24 13:12:54 UTC · (1 month ago)	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Edg/144.0.0.0	Bad Web Bot

Showing 1 to 15 of 48 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇩🇪 2a01:4020:31:0:101::690

🇩🇪 2a01:4020:31:0:101::2fd

🇩🇪 2a01:4020:31:0:101::117

🇩🇪 2a01:4020:31:0:101::61

🇺🇸 199.165.159.88

🇰🇷 183.104.220.152

🇺🇸 162.216.149.119

🇳🇱 138.226.239.233

🇭🇰 118.193.32.92

🇧🇩 103.155.71.84

🇷🇴 92.118.39.56

🇳🇱 91.92.40.12

🇫🇷 62.210.114.228

🇺🇸 34.186.108.131

🇹🇼 34.81.45.243

🇺🇸 20.171.192.68

🇩🇪 2a01:4020:31:0:101::71f

🇩🇪 2a01:4020:31:0:101::542

🇩🇪 2a01:4020:31:0:101::532

🇩🇪 2a01:4020:31:0:101::44e