JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 192.250.229.111

192.250.229.111 was found in our database!

This IP was reported 18 times. Confidence of Abuse is 64%: ?

64%

ISP	WHG Hosting Services Ltd
Usage Type	Content Delivery Network
ASN	AS209341
Hostname(s)	s3435.fra1.stableserver.net
Domain Name	hosting.com
Country	🇩🇪 Germany
City	Frankfurt am Main, Hesse

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 192.250.229.111

Whois 192.250.229.111

IP Abuse Reports for 192.250.229.111:

This IP address has been reported a total of 18 times from 10 distinct sources. 192.250.229.111 was first reported on July 7th 2026, and the most recent report was 6 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 factor1	2026-07-11 20:24:01 (6 hours ago)	Fail2ban at apollo Reports Abuse.	Bad Web Bot
🇩🇪 london2038.com	2026-07-11 12:32:41 (14 hours ago)	Attacking WordPress 192.250.229.111 - - [11/Jul/2026:14:32:38 +0200] "POST /wp-login.php HTTP/2.0" 5 ... show more Attacking WordPress 192.250.229.111 - - [11/Jul/2026:14:32:38 +0200] "POST /wp-login.php HTTP/2.0" 503 19291 "https://<REDACTED>/wp-login.php" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36" show less	Brute-Force Web App Attack
🇨🇿 ptlab	2026-07-11 10:45:04 (15 hours ago)	Detected wp_login attack from WP-host.	Hacking Web App Attack
🇲🇹 Malta	2026-07-11 09:06:47 (17 hours ago)	192.250.229.111 - - [11/Jul/2026:11:06:47 +0200] "POST /wp-login.php HTTP/1.1" "Mozilla/5.0 (Windows ... show more 192.250.229.111 - - [11/Jul/2026:11:06:47 +0200] "POST /wp-login.php HTTP/1.1" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36" Brute-force password attempt show less	Hacking Web App Attack Brute-Force
🇩🇪 neckaralb-admin.de	2026-07-11 03:09:08 (23 hours ago)	(wordpress) Failed login wp-login.php or xmlrpc.php	Web App Attack
🇩🇪 ger-stg-sifi1	2026-07-11 02:20:42 (1 day ago)	(wordpress) Failed wordpress login using wp-login.php or xmlrpc.php	Web App Attack
🇩🇪 FeG Deutschland	2026-07-10 22:42:05 (1 day ago)	Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 257	Exploited Host Web App Attack
🇺🇸 TPI-Abuse	2026-07-10 19:25:53 (1 day ago)	(mod_security) mod_security (id:225170) triggered by 192.250.229.111 (s3435.fra1.stableserver.net): ... show more (mod_security) mod_security (id:225170) triggered by 192.250.229.111 (s3435.fra1.stableserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 10 15:25:50.192928 2026] [security2:error] [pid 10387:tid 10387] [client 192.250.229.111:37054] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|321q.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "321q.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "alFHPu2-9Qx6YuVZt-oOlQAAAAQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 integrantservices.com	2026-07-10 19:03:27 (1 day ago)	(wordpress) Failed wordpress login from 192.250.229.111 (DE/Germany/s3435.fra1.stableserver.net)	Brute-Force
🇺🇸 TPI-Abuse	2026-07-09 15:05:29 (2 days ago)	(mod_security) mod_security (id:210350) triggered by 192.250.229.111 (s3435.fra1.stableserver.net): ... show more (mod_security) mod_security (id:210350) triggered by 192.250.229.111 (s3435.fra1.stableserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 09 11:05:25.845287 2026] [security2:error] [pid 1250365:tid 1250365] [client 192.250.229.111:60014] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|wealthsec.com\|F\|4"] [data "keep-alive, keep-alive"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "wealthsec.com"] [uri "/xmlrpc"] [unique_id "ak-4tSxFGboifHas4U10ugAAAAo"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-09 14:46:15 (2 days ago)	(mod_security) mod_security (id:210350) triggered by 192.250.229.111 (s3435.fra1.stableserver.net): ... show more (mod_security) mod_security (id:210350) triggered by 192.250.229.111 (s3435.fra1.stableserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 09 10:46:07.836524 2026] [security2:error] [pid 16238:tid 16248] [client 192.250.229.111:60282] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|teresahagadorn.com\|F\|4"] [data "keep-alive, keep-alive"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "teresahagadorn.com"] [uri "/wp-json/wp/v2/users/10"] [unique_id "ak-0LwSfKf5pmalgSaD7dQAAAQc"], referer: https://teresahagadorn.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-09 14:08:05 (2 days ago)	(mod_security) mod_security (id:210350) triggered by 192.250.229.111 (s3435.fra1.stableserver.net): ... show more (mod_security) mod_security (id:210350) triggered by 192.250.229.111 (s3435.fra1.stableserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 09 10:08:00.592318 2026] [security2:error] [pid 32112:tid 32112] [client 192.250.229.111:49260] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|giganticmediallc.com\|F\|4"] [data "keep-alive, keep-alive"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "giganticmediallc.com"] [uri "/"] [unique_id "ak-rQDFsQLndmGJSAkGc9gAAAAU"], referer: https://giganticmediallc.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-09 13:45:15 (2 days ago)	(mod_security) mod_security (id:210350) triggered by 192.250.229.111 (s3435.fra1.stableserver.net): ... show more (mod_security) mod_security (id:210350) triggered by 192.250.229.111 (s3435.fra1.stableserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 09 09:45:06.587033 2026] [security2:error] [pid 31477:tid 31477] [client 192.250.229.111:42466] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|swinjury.co.forefrontmusic.com\|F\|4"] [data "keep-alive, keep-alive"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "swinjury.co.forefrontmusic.com"] [uri "/"] [unique_id "ak-l4r3MrR3xTnvJszHObgAAABY"], referer: https://swinjury.co.forefrontmusic.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-09 12:17:18 (2 days ago)	(mod_security) mod_security (id:210350) triggered by 192.250.229.111 (s3435.fra1.stableserver.net): ... show more (mod_security) mod_security (id:210350) triggered by 192.250.229.111 (s3435.fra1.stableserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 09 08:17:10.645547 2026] [security2:error] [pid 16051:tid 16051] [client 192.250.229.111:39376] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|localpetsitters.com\|F\|4"] [data "keep-alive, keep-alive"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "localpetsitters.com"] [uri "/index.php"] [unique_id "ak-RRuDc_Ur_T4Ve8rlKHAAAABI"], referer: https://localpetsitters.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-09 08:01:15 (2 days ago)	(mod_security) mod_security (id:225170) triggered by 192.250.229.111 (s3435.fra1.stableserver.net): ... show more (mod_security) mod_security (id:225170) triggered by 192.250.229.111 (s3435.fra1.stableserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 09 04:01:11.834117 2026] [security2:error] [pid 21514:tid 21514] [client 192.250.229.111:42512] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|site.ablogisticsgroup.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "site.ablogisticsgroup.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "ak9VR1W1816QVrgKikwNcQAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 18 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇮🇩 103.161.207.6

🇺🇸 20.40.218.140

🇧🇪 198.235.24.241

🇹🇼 198.235.24.55

🇹🇭 152.32.245.27

🇺🇸 143.198.148.183

🇨🇳 117.72.212.5

🇮🇳 103.249.82.242

🇮🇩 103.153.190.105

🇿🇦 102.64.36.112

🇳🇱 85.11.167.203

🇺🇸 81.30.98.81

🇺🇸 65.49.1.162

🇺🇸 52.180.137.70

🇨🇳 49.69.92.27

🇺🇸 45.79.207.111

🇬🇧 35.203.210.229

🇬🇧 5.252.83.208

🇪🇨 200.41.3.165

🇹🇼 198.235.24.45