JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 196.127.141.232

196.127.141.232 was found in our database!

This IP was reported 18 times. Confidence of Abuse is 0%: ?

ISP	2G/3G/4G Mobile Costumers
Usage Type	Fixed Line ISP
ASN	AS36925
Domain Name	orange.ma
Country	🇲🇦 Morocco
City	Casablanca, Casablanca-Settat

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 196.127.141.232

Whois 196.127.141.232

IP Abuse Reports for 196.127.141.232:

This IP address has been reported a total of 18 times from 13 distinct sources. 196.127.141.232 was first reported on May 26th 2025, and the most recent report was 1 year ago.

Old Reports: The most recent abuse report for this IP address is from 1 year ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇨🇦 polycoda	2025-05-27 19:27:41 (1 year ago)	📄 Probes for tons of inexistent files and PHP scripts	Hacking Web App Attack
🇺🇸 TPI-Abuse	2025-05-26 23:57:20 (1 year ago)	(mod_security) mod_security (id:210492) triggered by 196.127.141.232 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210492) triggered by 196.127.141.232 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 26 19:57:13.882372 2025] [security2:error] [pid 1258110:tid 1258110] [client 196.127.141.232:56889] [client 196.127.141.232] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "learningbyshipping.com"] [uri "/.env"] [unique_id "aDT_2dv_T5dsLEy5dglx8wAAABY"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2025-05-26 23:50:07 (1 year ago)	Fail2ban block	Brute-Force Exploited Host Web App Attack
🇩🇪 Bedios GmbH	2025-05-26 22:30:42 (1 year ago)	Login credentials theft attempt	Hacking
🇺🇸 TPI-Abuse	2025-05-26 22:18:19 (1 year ago)	(mod_security) mod_security (id:210492) triggered by 196.127.141.232 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210492) triggered by 196.127.141.232 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 26 18:18:12.610155 2025] [security2:error] [pid 1585215:tid 1585215] [client 196.127.141.232:65383] [client 196.127.141.232] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "businessvaluationapp.com"] [uri "/.env"] [unique_id "aDTopIvrTylOpm9w3dSwVQAAAAo"] show less	Brute-Force Bad Web Bot Web App Attack
🇪🇸 el-brujo	2025-05-26 19:49:18 (1 year ago)	Cloudflare WAF: Request Path: /.env Request Query: Host: elhacker.net userAgent: ZAKREGEX-Scanner/2 ... show more Cloudflare WAF: Request Path: /.env Request Query: Host: elhacker.net userAgent: ZAKREGEX-Scanner/2.3.2 Action: block Source: firewallManaged ASN Description: ASMedi Country: MA Method: GET Timestamp: 2025-05-26T19:49:18Z ruleId: 23548ee2b36547a1be09bb2c0550c529. Report generated by Cloudflare-WAF-to-AbuseIPDB (https://github.com/MHG-LAB/Cloudflare-WAF-to-AbuseIPDB). show less	Hacking SQL Injection Web App Attack
🇮🇩 penjaga BRIN	2025-05-26 19:25:09 (1 year ago)	nginx-alfa-240	Web App Attack
🇩🇪 FeG Deutschland	2025-05-26 18:32:24 (1 year ago)	Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 124	Exploited Host Web App Attack
🇺🇸 rdpguard.com	2025-05-26 10:24:56 (1 year ago)	RdpGuard detected brute-force attempt on HTTP	Brute-Force
🇺🇸 TPI-Abuse	2025-05-26 10:11:58 (1 year ago)	(mod_security) mod_security (id:210492) triggered by 196.127.141.232 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210492) triggered by 196.127.141.232 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 26 06:11:53.462787 2025] [security2:error] [pid 2714494:tid 2714494] [client 196.127.141.232:59582] [client 196.127.141.232] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "theledman.com"] [uri "/.env"] [unique_id "aDQ-aVy57n8z8fUm4MTvBQAAAB8"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 joecaliber	2025-05-26 09:40:02 (1 year ago)	Malicious activity detected by monitoring system. Attack types observed: LFI SCAN.	Web App Attack
🇺🇸 TPI-Abuse	2025-05-26 07:51:05 (1 year ago)	(mod_security) mod_security (id:210492) triggered by 196.127.141.232 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210492) triggered by 196.127.141.232 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 26 03:50:59.134950 2025] [security2:error] [pid 1057071:tid 1057071] [client 196.127.141.232:62515] [client 196.127.141.232] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "proprocessor.com"] [uri "/.env"] [unique_id "aDQdY7ifjrWQUk1rPxzf-QAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack
🇮🇹 Progetto1	2025-05-26 07:35:01 (1 year ago)	Website Scanning / Scraping	Bad Web Bot Exploited Host Web App Attack
Anonymous	2025-05-26 07:30:51 (1 year ago)	Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER	Brute-Force SSH
🇧🇪 cmbplf	2025-05-26 04:23:14 (1 year ago)	114 requests with url.path *.env	Brute-Force Bad Web Bot

Showing 1 to 15 of 18 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 184.154.245.42

🇨🇳 182.242.168.32

🇷🇺 176.109.94.182

🇨🇳 171.108.182.252

🇺🇸 162.241.132.183

🇧🇩 114.130.85.36

🇮🇳 103.185.100.98

🇻🇳 103.176.20.115

🇺🇸 54.225.81.20

🇫🇷 54.38.180.48

🇺🇸 203.98.64.72

🇨🇳 140.205.208.195

🇨🇳 122.243.72.104

🇺🇸 107.155.48.46

🇷🇺 94.243.15.42

🇩🇪 69.5.169.100

🇺🇸 64.62.156.101

🇺🇸 54.85.120.2

🇮🇳 45.251.33.137

🇳🇱 45.148.10.157