JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 196.188.126.72

196.188.126.72 was found in our database!

This IP was reported 43 times. Confidence of Abuse is 28%: ?

28%

ISP	Ethio Telecom
Usage Type	Mobile ISP
ASN	AS24757
Domain Name	ethiotelecom.et
Country	🇪🇹 Ethiopia
City	Addis Ababa, Addis Ababa

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 196.188.126.72

Whois 196.188.126.72

IP Abuse Reports for 196.188.126.72:

This IP address has been reported a total of 43 times from 22 distinct sources. 196.188.126.72 was first reported on February 29th 2024, and the most recent report was 1 day ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 stechusa	2026-06-29 15:44:44 (1 day ago)	[Askari] \| country=ET \| Behavior: HTTP/1.1 over TLS, Concurrent page load during attack, Targeting s ... show more [Askari] \| country=ET \| Behavior: HTTP/1.1 over TLS, Concurrent page load during attack, Targeting specific pages show less	Bad Web Bot DDoS Attack
🇺🇸 stechusa	2026-06-29 13:44:24 (1 day ago)	[Askari] \| country=ET	Bad Web Bot DDoS Attack
🇺🇸 stechusa	2026-06-29 13:44:24 (1 day ago)	ELEVATED_THREAT \| country=ET \| ASN=Ethio Telecom \| Request from ET during geo-diverse attack (10 cou ... show more ELEVATED_THREAT \| country=ET \| ASN=Ethio Telecom \| Request from ET during geo-diverse attack (10 countries) \| First request to deep URL: /category/light-bulbs.html \| Request from ET (Ethiopia), outside target markets (US/CA) show less	Bad Web Bot DDoS Attack
🇺🇸 kosada.com	2026-06-29 09:21:07 (1 day ago)	Web bot: denial-of-service flood	DDoS Attack Bad Web Bot
Anonymous	2026-06-28 07:50:57 (2 days ago)	Unauthorized connection attempt	Port Scan Hacking Exploited Host
🇩🇪 SMARTNET	2026-05-27 06:03:53 (1 month ago)	Aisuru(Mirai variant) DDoS \| Incident ID: e316b406-db2c-400a-bc37-dfbfcc0acc61	DDoS Attack
Anonymous	2026-05-12 21:00:13 (1 month ago)	Unauthorized connection attempt	Port Scan Hacking Exploited Host
🇺🇸 stechusa	2026-03-20 09:41:08 (3 months ago)	[Askari] ELEVATED_THREAT \| country=ET \| ASN=Ethiopian Telecommunication Corporation \| 28 IPs targeti ... show more [Askari] ELEVATED_THREAT \| country=ET \| ASN=Ethiopian Telecommunication Corporation \| 28 IPs targeting /brand.html \| Facet request during elevated threat (facet_ratio=0.85, unique_ips=233) \| HTTP/1.1 over TLS (elevated=True) \| Signals: http1_on_tls, non_target_geo, concurrent_facet_load, path_concentration show less	Web App Attack Hacking Web Spam
🇫🇷 vtchost.com	2026-03-12 13:08:19 (3 months ago)	invalid/bad user agent - possible botnet ...	Bad Web Bot
🇺🇸 matt	2026-03-04 04:06:44 (3 months ago)	DDOS attack with query parameters attempting to overload WordPress site.	DDoS Attack
🇪🇸 el-brujo	2026-02-28 15:03:28 (4 months ago)	28/Feb/2026:16:03:28.267184 +0100Apache-Error: [file "apache2_util.c"] [line 271] [level 3] [client ... show more 28/Feb/2026:16:03:28.267184 +0100Apache-Error: [file "apache2_util.c"] [line 271] [level 3] [client 196.188.126.72] ModSecurity: Warning. detected SQLi using libinjection with fingerprint 'X' [file "/etc/httpd/modsecurity.d/activated_rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line "66"] [id "942100"] [msg "SQL Injection Attack Detected via libinjection"] [data "Matched Data: X found within REQUEST_COOKIES:x-ms-gateway-slice: estsfd' WHERE 9020=9020/!50000AND/GTID_SUBSET(/!50000CONCAT/(%27~%27,(/!50000SELECT/(ELT(2869=2869,1))),%27~%27),2869)-- -"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.5"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-sqli"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/66"] [tag "PCI/6.5.2"] [hostname "parrot.elhacker.net"] [uri "/pool/"] [unique_id "aaMDwFHyLYTmefgMk7g0EQAAApU"] ... show less	Hacking Web App Attack
🇨🇭 backslash	2026-02-11 06:55:07 (4 months ago)	block ruleset 333FBABBA6DC06D7D20EDF60700DF5D9612E6F09	Bad Web Bot
🇺🇸 TPI-Abuse	2026-02-04 09:30:25 (4 months ago)	(mod_security) mod_security (id:210730) triggered by 196.188.126.72 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210730) triggered by 196.188.126.72 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Feb 04 04:30:21.027999 2026] [security2:error] [pid 1345127:tid 1345127] [client 196.188.126.72:59899] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|www.et.lobibilisim.com\|F\|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.et.lobibilisim.com"] [uri "/config/filesystems.php.bak"] [unique_id "aYMRrX1mbHE6G3Ey6sc5RwAAAAk"], referer: https://www.et.lobibilisim.com/ show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-01-27 13:01:09 (5 months ago)	scanning http requests from known botnet	Web App Attack
🇺🇸 RAP	2026-01-08 13:02:48 (5 months ago)	2026-01-08 13:02:48 UTC Unauthorized activity to TCP port 23. Telnet	Port Scan

Showing 1 to 15 of 43 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 195.184.76.194

🇲🇽 187.189.87.17

🇮🇳 168.144.181.117

🇵🇭 122.54.146.157

🇳🇱 107.6.151.170

🇭🇰 101.36.119.146

🇳🇴 93.89.113.60

🇬🇧 77.89.153.197

🇧🇷 45.164.39.253

🇧🇷 206.0.20.186

🇹🇼 198.235.24.84

🇺🇸 198.2.216.9

🇩🇴 190.167.237.191

🇲🇽 187.228.40.200

🇲🇽 187.190.35.163

🇨🇳 182.146.137.249

🇧🇷 177.158.252.188

🇯🇵 172.70.223.228

🇺🇸 162.216.150.217

🇺🇸 135.237.122.43