JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 191.96.106.18

191.96.106.18 was found in our database!

This IP was reported 49 times. Confidence of Abuse is 11%: ?

11%

ISP	Internet Utilities Europe and Asia Limited
Usage Type	Fixed Line ISP
ASN	AS174
Domain Name	netutils.io
Country	🇺🇸 United States of America
City	Los Angeles, California

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 191.96.106.18

Whois 191.96.106.18

IP Abuse Reports for 191.96.106.18:

This IP address has been reported a total of 49 times from 18 distinct sources. 191.96.106.18 was first reported on August 22nd 2022, and the most recent report was 14 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 entangled_mongoose	2026-06-18 06:41:20 (14 hours ago)	Probed /wp-admin/admin-ajax.php?action=admin_init&log_filename=../../../../../../../../../../../../. ... show more Probed /wp-admin/admin-ajax.php?action=admin_init&log_filename=../../../../../../../../../../../../../etc/passwd. show less	Web App Attack
🇺🇸 mw	2026-05-17 00:00:44 (1 month ago)	GET /vegadns/index.php HTTP/1.1	Web App Attack
🇩🇪 Hary74656	2026-01-03 03:50:29 (5 months ago)	[Sat Jan 03 04:50:20.019736 2026] [security2:error] [pid 189218:tid 189360] [client 191.96.106.18:48 ... show more [Sat Jan 03 04:50:20.019736 2026] [security2:error] [pid 189218:tid 189360] [client 191.96.106.18:48843] [client 191.96.106.18] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "/.env" at REQUEST_FILENAME. [file "/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "78.46.107.184"] [uri "/.env"] [unique_id "aViR_P43keUlob5dEJsKLQAAAKM"] [Sat Jan 03 04:50:21.779415 2026] [security2:error] [pid 189880:tid 189955] [client 191.96.106.18:13595] [client 191.96.106.18] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "/composer.json" at REQUEST_FILENAME. [file "/usr/share ... show less	Web App Attack
Anonymous	2025-12-19 20:45:11 (5 months ago)	Unauthorized connection attempt detected in the last 24 hours	Hacking
Anonymous	2025-12-09 01:20:11 (6 months ago)	Unauthorized connection attempt detected in the last 24 hours	Hacking
🇺🇸 xmission.com	2025-12-07 01:28:32 (6 months ago)	Blocked by UFW (TCP on 51413) Source port: 21888 TTL: 115 Packet length: 52 TOS: 0x08 This report ( ... show more Blocked by UFW (TCP on 51413) Source port: 21888 TTL: 115 Packet length: 52 TOS: 0x08 This report (for 191.96.106.18) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
Anonymous	2025-12-06 01:15:13 (6 months ago)	Unauthorized connection attempt detected in the last 24 hours	Hacking
🇺🇸 xmission.com	2025-12-04 12:39:09 (6 months ago)	Blocked by UFW (TCP on 51413) Source port: 13049 TTL: 118 Packet length: 52 TOS: 0x08 This report ( ... show more Blocked by UFW (TCP on 51413) Source port: 13049 TTL: 118 Packet length: 52 TOS: 0x08 This report (for 191.96.106.18) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
Anonymous	2025-12-03 01:10:14 (6 months ago)	Unauthorized connection attempt detected in the last 24 hours	Hacking
🇮🇹 VHosting	2025-11-28 18:39:34 (6 months ago)	Detected mail brute force attack from 4 different servers	Brute-Force
🇿🇦 maximonline.co.za	2025-11-26 12:46:13 (6 months ago)	Brute Force SMTP AUTH Attack	Brute-Force
🇺🇸 xmission.com	2025-10-19 19:24:43 (7 months ago)	Blocked by UFW (TCP on 50220) Source port: 43357 TTL: 54 Packet length: 60 TOS: 0x08 This report (f ... show more Blocked by UFW (TCP on 50220) Source port: 43357 TTL: 54 Packet length: 60 TOS: 0x08 This report (for 191.96.106.18) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇺🇸 xmission.com	2025-08-31 03:56:21 (9 months ago)	Blocked by UFW (TCP on 1) Source port: 62601 TTL: 118 Packet length: 52 TOS: 0x08 This report (for ... show more Blocked by UFW (TCP on 1) Source port: 62601 TTL: 118 Packet length: 52 TOS: 0x08 This report (for 191.96.106.18) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇦🇺 oncord	2025-06-21 04:41:24 (11 months ago)	Form spam	Web Spam
🇮🇪 tines_bot	2025-04-25 12:00:20 (1 year ago)	This IP is associated with RDP abuse. It was found in a paste by https://twitter.com/RdpSnitch - htt ... show more This IP is associated with RDP abuse. It was found in a paste by https://twitter.com/RdpSnitch - https://pastebin.com/yQkW4wQX For more information, or to report interesting/incorrect findings, contact us - [email protected] show less	Brute-Force

Showing 1 to 15 of 49 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇯🇵 220.219.184.105

🇨🇳 220.181.51.90

🇺🇸 138.186.136.210

🇺🇸 47.77.180.67

🇺🇸 158.94.187.196

🇺🇸 103.143.231.24

🇰🇷 49.173.65.19

🇨🇳 14.103.84.166

🇷🇴 2.57.122.177

🇺🇸 216.25.89.105

🇮🇹 185.156.235.155

🇭🇰 152.32.189.134

🇷🇴 92.118.39.224

🇬🇧 45.198.224.141

🇳🇱 45.156.87.166

🇨🇳 36.143.3.122

🇺🇸 20.163.15.167

🇰🇷 14.49.245.167

🇨🇳 183.165.244.160

🇺🇸 172.81.130.94