JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 195.214.235.99

195.214.235.99 was found in our database!

This IP was reported 69 times. Confidence of Abuse is 100%: ?

100%

ISP	Sindad Network Technology PJSC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS59623
Hostname(s)	shahrivar.pws-dns.net
Domain Name	sindad.com
Country	🇮🇷 Iran (Islamic Republic of)
City	Tehran, Tehran

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 195.214.235.99

Whois 195.214.235.99

IP Abuse Reports for 195.214.235.99:

This IP address has been reported a total of 69 times from 50 distinct sources. 195.214.235.99 was first reported on July 8th 2026, and the most recent report was 18 minutes ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇷 Yepngo	2026-07-09 06:11:01 (18 minutes ago)	195.214.235.99 - - [09/Jul/2026:08:11:00 +0200] "POST /wp-login.php HTTP/2.0" 200 11372 "https://blo ... show more 195.214.235.99 - - [09/Jul/2026:08:11:00 +0200] "POST /wp-login.php HTTP/2.0" 200 11372 "https://blog.yepngo.com/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36" ... show less	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-07-09 05:43:43 (45 minutes ago)	(mod_security) mod_security (id:225170) triggered by 195.214.235.99 (shahrivar.pws-dns.net): 1 in th ... show more (mod_security) mod_security (id:225170) triggered by 195.214.235.99 (shahrivar.pws-dns.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 09 01:43:39.503916 2026] [security2:error] [pid 30737:tid 30737] [client 195.214.235.99:58150] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|inquisitivequincie.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "inquisitivequincie.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "ak81C31f14UBUa5DTkTAhgAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 Mundo Bueno	2026-07-09 05:31:50 (57 minutes ago)	[ISILIA Protection v2.1] Tentative d'accès: /xmlrpc.php \| Pays: IR \| UA: Mozilla/5.0 (Linux; Android ... show more [ISILIA Protection v2.1] Tentative d'accès: /xmlrpc.php \| Pays: IR \| UA: Mozilla/5.0 (Linux; Android 12; SM-G998B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Mo show less	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-07-09 05:13:09 (1 hour ago)	(mod_security) mod_security (id:225170) triggered by 195.214.235.99 (shahrivar.pws-dns.net): 1 in th ... show more (mod_security) mod_security (id:225170) triggered by 195.214.235.99 (shahrivar.pws-dns.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 09 01:13:01.593848 2026] [security2:error] [pid 8209:tid 8269] [client 195.214.235.99:46722] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|almerirock.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "almerirock.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "ak8t3ZcKm98t-um5Z9Cu3wAAAEc"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-07-09 05:09:43 (1 hour ago)	<jail> banned by fail2ban	Brute-Force Web App Attack
🇪🇸 masterguru	2026-07-09 04:49:21 (1 hour ago)	(PERMBLOCK) 195.214.235.99 (IR/Iran/shahrivar.pws-dns.net) has had more than 4 temp blocks in the la ... show more (PERMBLOCK) 195.214.235.99 (IR/Iran/shahrivar.pws-dns.net) has had more than 4 temp blocks in the last 86400 secs (0-122) show less	Hacking
🇲🇽 octageeks.com	2026-07-09 04:22:50 (2 hours ago)	Wordpress malicious attack:[octaflood]	Web App Attack
🇩🇪 4server	2026-07-09 03:53:31 (2 hours ago)	[ThuJul0905:53:26.7330762026][security2:error][pid3598966:tid3599100][client195.214.235.99:0]ModSecu ... show more [ThuJul0905:53:26.7330762026][security2:error][pid3598966:tid3599100][client195.214.235.99:0]ModSecurity:Accessdeniedwithcode403\(phase2\).OperatorGEmatched5atTX:anomaly_score.[file\"/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf\"][line\"94\"][id\"949110\"][msg\"InboundAnomalyScoreExceeded\(TotalScore:5\)\"][severity\"CRITICAL\"][ver\"OWASP_CRS/3.3.9\"][tag\"application-multi\"][tag\"language-multi\"][tag\"platform-multi\"][tag\"attack-generic\"][hostname\"mgevents.ch\"][uri\"/wp-login.php\"][unique_id\"ak8bNhKIEWAMWHpQaSoExwAAARM\"]\,referer:https://mgevents.ch/wp-login.php show less	Port Scan Brute-Force Web App Attack
🇫🇷 ELYAZ	2026-07-09 03:41:51 (2 hours ago)	(y4) Failed scan -byebye- from 195.214.235.99 (IR/Iran/shahrivar.pws-dns.net): (CF_ENABLE)	Hacking
🇪🇸 SweetHoneyPress	2026-07-09 03:36:16 (2 hours ago)	WordPress honeypot: POST to /xmlrpc.php \| event_id=1012139 \| UA: Mozilla/5.0 (Linux; Android 13; Pix ... show more WordPress honeypot: POST to /xmlrpc.php \| event_id=1012139 \| UA: Mozilla/5.0 (Linux; Android 13; Pixel 7 Pro) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Mobile Safari/537.36 show less	Web App Attack Brute-Force
🇩🇪 Marc	2026-07-09 03:29:44 (2 hours ago)	195.214.235.99 - - [09/Jul/2026:04:21:42 +0200] "GET /wp-login.php HTTP/2.0" 200 3927 "https://weiss ... show more 195.214.235.99 - - [09/Jul/2026:04:21:42 +0200] "GET /wp-login.php HTTP/2.0" 200 3927 "https://weiss-blau-hemer.de/wp-login.php" "Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36" 195.214.235.99 - - [09/Jul/2026:04:26:31 +0200] "GET /wp-login.php HTTP/2.0" 200 3469 "-" "Mozilla/5.0 (X11; Fedora; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36" 195.214.235.99 - - [09/Jul/2026:04:26:32 +0200] "POST /wp-login.php HTTP/2.0" 403 10714 "https://kurse.tortenatelier-schwanbeck.de/wp-login.php" "Mozilla/5.0 (X11; Fedora; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36" 195.214.235.99 - - [09/Jul/2026:05:29:42 +0200] "GET /wp-login.php HTTP/2.0" 200 16341 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36 Edg/150.0.0.0" 195.214.235.99 - - [09/Jul/2026:05:29:43 +0200] "POST /wp-login.php HTTP/2.0" 403 46871 "https://www.wasch-ar show less	Brute-Force Web App Attack
🇫🇷 LRob	2026-07-09 02:59:54 (3 hours ago)	CrowdSec: lrob/wp-login-slow-bf \| req: ["/wp-login.php"] \| UA: ["Mozilla/5.0 (Macintosh; Intel Mac O ... show more CrowdSec: lrob/wp-login-slow-bf \| req: ["/wp-login.php"] \| UA: ["Mozilla/5.0 (Macintosh; Intel Mac OS X 13_6_9) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36","Mozilla/5.0 (Windows NT 10.0) show less	Brute-Force Web App Attack
🇺🇸 Mundo Bueno	2026-07-09 02:52:28 (3 hours ago)	[ISILIA Protection v2.1] Tentative d'accès: /xmlrpc.php \| Pays: IR \| UA: Mozilla/5.0 (iPhone; CPU iP ... show more [ISILIA Protection v2.1] Tentative d'accès: /xmlrpc.php \| Pays: IR \| UA: Mozilla/5.0 (iPhone; CPU iPhone OS 18_6_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Cr show less	Hacking Web App Attack
🇩🇪 bsoft.de	2026-07-09 02:49:36 (3 hours ago)	195.214.235.99 - - [09/Jul/2026:03:19:22 +0200] "POST /xmlrpc.php HTTP/1.1" 200 247 "-" "Mozilla/5.0 ... show more 195.214.235.99 - - [09/Jul/2026:03:19:22 +0200] "POST /xmlrpc.php HTTP/1.1" 200 247 "-" "Mozilla/5.0 (Linux; Android 11; Redmi Note 9) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Mobile Safari/537.36" 195.214.235.99 - - [09/Jul/2026:04:18:22 +0200] "POST /xmlrpc.php HTTP/1.1" 200 247 "-" "Mozilla/5.0 (Linux; Android 13; Pixel 7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Mobile Safari/537.36" 195.214.235.99 - - [09/Jul/2026:04:49:36 +0200] "GET /wp-login.php HTTP/1.1" 404 74152 "https://bolte.de/wp-login.php" "Mozilla/5.0 (Linux; Android 12; SM-G998B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Mobile Safari/537.36" show less	Web App Attack
🇺🇸 TPI-Abuse	2026-07-09 02:25:07 (4 hours ago)	(mod_security) mod_security (id:225170) triggered by 195.214.235.99 (shahrivar.pws-dns.net): 1 in th ... show more (mod_security) mod_security (id:225170) triggered by 195.214.235.99 (shahrivar.pws-dns.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 08 22:25:00.516232 2026] [security2:error] [pid 826:tid 826] [client 195.214.235.99:49658] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|www.museum.henning.org\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.museum.henning.org"] [uri "/wp-json/wp/v2/users/me"] [unique_id "ak8GfKV60BEtf2asHJ-6YgAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 69 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇳🇱 45.153.34.252

🇨🇳 222.176.201.235

🇧🇷 201.140.208.93

🇸🇬 173.239.196.163

🇪🇸 172.253.227.157

🇻🇳 171.244.143.209

🇧🇩 161.248.201.12

🇨🇦 153.67.3.54

🇫🇮 147.185.133.72

🇺🇸 135.119.96.220

🇸🇬 45.82.78.107

🇸🇬 45.82.78.106

🇧🇷 187.17.224.139

🇳🇱 159.65.195.92

🇨🇳 116.207.127.119

🇫🇷 91.231.89.88

🇳🇱 45.148.10.141

🇺🇸 44.81.255.20

🇵🇰 202.165.237.91

🇹🇭 202.29.224.166