JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 196.127.66.135

196.127.66.135 was found in our database!

This IP was reported 40 times. Confidence of Abuse is 100%: ?

100%

ISP	2G/3G/4G Mobile Costumers
Usage Type	Mobile ISP
ASN	AS36925
Domain Name	orange.ma
Country	🇲🇦 Morocco
City	Casablanca, Casablanca-Settat

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 196.127.66.135

Whois 196.127.66.135

IP Abuse Reports for 196.127.66.135:

This IP address has been reported a total of 40 times from 30 distinct sources. 196.127.66.135 was first reported on July 28th 2026, and the most recent report was 17 minutes ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇳🇱 JCB	2026-07-30 09:24:00 (17 minutes ago)	196.127.66.135 - - [29/Jul/2026:22:27:21 +0300] "GET /phpinfo HTTP/1.1" 404 236 "-" "Mozilla/5.0 (Wi ... show more 196.127.66.135 - - [29/Jul/2026:22:27:21 +0300] "GET /phpinfo HTTP/1.1" 404 236 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36" 196.127.66.135 - - [29/Jul/2026:22:27:22 +0300] "GET /phpinfo.php HTTP/1.1" 404 236 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36" ... show less	Web App Attack
🇫🇷 mail.avx.gr	2026-07-30 09:10:56 (30 minutes ago)	Plesk Fail2Ban jail: Plesk-WebScanners. Evidence: 196.127.66.135 - - [30/Jul/2026:12:10:55 +0300] "G ... show more Plesk Fail2Ban jail: Plesk-WebScanners. Evidence: 196.127.66.135 - - [30/Jul/2026:12:10:55 +0300] "GET /phpinfo.php HTTP/1.1" 404 65996 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36" show less	Web App Attack
🇮🇳 evicky2002	2026-07-30 06:00:00 (3 hours ago)	Confirmed malicious by STILWaters CTI platform (score=100, sources=1)	Hacking Brute-Force SSH
🇬🇧 consul.to	2026-07-30 05:06:36 (4 hours ago)	Web attack/malicious scanning detected	Web App Attack
🇩🇪 netclix.gr	2026-07-30 00:47:06 (8 hours ago)	(mod_security) mod_security triggered on hostname [redacted] 196.127.66.135 (MA/Morocco/-): (CF_ENA ... show more (mod_security) mod_security triggered on hostname [redacted] 196.127.66.135 (MA/Morocco/-): (CF_ENABLE) show less	SQL Injection
🇳🇿 Antinson	2026-07-30 00:09:47 (9 hours ago)	Scraping with a high error ratio and request rate	Bad Web Bot
🇫🇷 mail.avx.gr	2026-07-29 18:52:37 (14 hours ago)	Plesk Fail2Ban jail: Plesk-Web-Exploits. Evidence: 196.127.66.135 - - [29/Jul/2026:21:52:36 +0300] " ... show more Plesk Fail2Ban jail: Plesk-Web-Exploits. Evidence: 196.127.66.135 - - [29/Jul/2026:21:52:36 +0300] "GET /.env HTTP/1.1" 301 162 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36" show less	Web App Attack
🇩🇪 Petros Stefanakis	2026-07-29 15:32:12 (18 hours ago)	(mod_security) mod_security triggered on hostname [redacted] 196.127.66.135 (MA/Morocco/-)	SQL Injection
🇳🇱 0xffffffff	2026-07-29 14:09:03 (19 hours ago)	[2026-07-29 17:09:00.637081] [authz_core:error] [pid 23985:tid 136578167289536] [client 196.127.66.1 ... show more [2026-07-29 17:09:00.637081] [authz_core:error] [pid 23985:tid 136578167289536] [client 196.127.66.135:0] AH01630: client denied by server configuration: /var/www//.env , error_notes:config-files , URI:'/.env' [2026-07-29 17:09:00.865046] [authz_core:error] [pid 23985:tid 136578150504128] [client 196.127.66.135:0] AH01630: client denied by server configuration: /var/www//.env , error_notes:config-files , URI:'/.env' [2026-07-29 17:09:01.109885] [authz_core:error] [pid 23985:tid 136578116933312] [client 196.127.66.135:0] AH01630: client denied by server configuration: /var/www//.env.save , error_notes:backup-files , URI:'/.env.save' [2026-07-29 17:09:01.341151] [authz_core:error] [pid 23985:tid 136578125326016] [client 196.127.66.135:0] AH01630: client denied by server configuration: /var/www//.env.php , error_notes:missing-php , URI:'/.env.php' [2026-07-29 17:09:01.569598] [authz_core:error] [pid 23985:tid 136578091747008] [client 196.127.66.135:0] AH01630: client denied by server configuration: /var/www/ show less	Web App Attack Bad Web Bot
🇦🇺 clapper	2026-07-29 12:54:43 (20 hours ago)	(mod_security) mod_security (id:949110) triggered by 196.127.66.135 (MA/Morocco/-): 5 in the last 60 ... show more (mod_security) mod_security (id:949110) triggered by 196.127.66.135 (MA/Morocco/-): 5 in the last 600 secs; ID: rub show less	Brute-Force Bad Web Bot
🇧🇪 voormedia	2026-07-29 12:51:50 (20 hours ago)	Accessed trap at '/.env'	Web App Attack
🇬🇧 Axel	2026-07-29 11:20:02 (22 hours ago)	Blocked by ModSecurity. Rule ID: 210492 Message: None Phase: 1 Severity: CRITICAL URI: /.env Server: ... show more Blocked by ModSecurity. Rule ID: 210492 Message: None Phase: 1 Severity: CRITICAL URI: /.env Server: UK-01 show less	Web App Attack Hacking SQL Injection
🇩🇪 4server	2026-07-29 07:36:25 (1 day ago)	[WedJul2909:36:20.8757352026][security2:error][pid1257412:tid1257478][client196.127.66.135:0]ModSecu ... show more [WedJul2909:36:20.8757352026][security2:error][pid1257412:tid1257478][client196.127.66.135:0]ModSecurity:Accessdeniedwithcode403\(phase2\).OperatorGEmatched5atTX:anomaly_score.[file\"/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf\"][line\"94\"][id\"949110\"][msg\"InboundAnomalyScoreExceeded\(TotalScore:5\)\"][severity\"CRITICAL\"][ver\"OWASP_CRS/3.3.10\"][tag\"application-multi\"][tag\"language-multi\"][tag\"platform-multi\"][tag\"attack-generic\"][hostname\"autoeuro.lv\"][uri\"/.env.php\"][unique_id\"ammtdKyzu-T26otmVxp1UAAAAIU\"] show less	Port Scan Brute-Force Web App Attack
🇸🇪 vaia.cloud	2026-07-29 06:55:02 (1 day ago)	crowdsecurity/http-probing	Brute-Force Web App Attack
🇧🇾 lns.bz	2026-07-29 06:31:59 (1 day ago)	.env scanning [BY]	Web App Attack

Showing 1 to 15 of 40 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇰🇷 43.131.253.14

🇬🇧 35.203.210.174

🇺🇸 172.232.8.247

🇨🇳 111.42.175.101

🇷🇺 91.122.79.23

🇹🇷 88.247.3.101

🇧🇬 78.128.112.146

🇳🇱 45.148.10.147

🇮🇩 36.77.231.254

🇸🇪 20.91.199.21

🇨🇦 4.239.243.30

🇦🇷 186.1.224.45

🇸🇬 161.118.214.247

🇩🇪 159.89.109.165

🇦🇹 152.53.111.131

🇯🇵 128.1.48.187

🇮🇳 106.195.70.216

🇷🇴 92.118.39.71

🇳🇱 88.151.33.203

🇩🇪 69.5.169.67