AbuseIPDB » 196.189.24.118
196.189.24.118
This IP was reported 9 times. Confidence of
Abuse
is 25% : ?
ISP
Ethio Telecom
Usage Type
Fixed Line ISP
ASN
AS24757
Domain Name
ethiotelecom.et
Country
🇪🇹
Ethiopia
City
Addis Ababa, Addis Ababa
IP info including ISP, Usage Type, and Location provided
by IPInfo . Updated weekly.
IP Abuse Reports for 196.189.24.118 :
This IP address has been reported a total of
9
times from
9 distinct
sources.
196.189.24.118 was first reported on
December 24th 2020 , and the most recent report was
19 hours ago
Recent Reports:
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Reporter
IoA Timestamp (UTC)
Comment
Categories
🇨🇭
4server
2026-06-27 18:16:16
(19 hours ago)
[SatJun2720:16:12.1520792026][security2:error][pid1847740:tid1847759][client196.189.24.118:0]ModSecu ...
show more
[SatJun2720:16:12.1520792026][security2:error][pid1847740:tid1847759][client196.189.24.118:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"368\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"xn--walter-wrndli-pmb.ch\"][uri\"/xmlrpc.php\"][unique_id\"akATbLWT87bTs9drLBH9dAAAAFE\"]
show less
Hacking
Web App Attack
🇩🇪
LRob.fr
2026-06-27 15:45:05
(22 hours ago)
Repeated requests on blocked xmlrpc.php, blocked by fail2ban in custom-503-xmlrpc jail
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-27 15:02:44
(23 hours ago)
(mod_security) mod_security (id:225170) triggered by 196.189.24.118 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:225170) triggered by 196.189.24.118 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 27 11:02:36.960607 2026] [security2:error] [pid 11937:tid 11937] [client 196.189.24.118:19533] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||stoneybluff.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "stoneybluff.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aj_mDAuplq2Y0xTpnxan6QAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇹
VHosting
2025-12-23 11:07:40
(6 months ago)
Detected attack and reported by a human
DDoS Attack
Brute-Force
Bad Web Bot
Exploited Host
Web App Attack
SSH
🇺🇸
SiliSoftware
2025-12-16 15:59:11
(6 months ago)
/phpBB3/ucp.php?mode=delete_cookies&sid=45cf7ea5dd1983f3ded4ce95e954dac5
Web App Attack
2025-08-25 12:38:16
(10 months ago)
wordpress-trap
Web App Attack
🇳🇱
exxos
2025-08-23 18:03:01
(10 months ago)
Attacks with Bad user agents
Hacking
🇨🇦
Lagserv.com
2021-05-18 12:27:04
(5 years ago)
XMLRPC brute force
Web Spam
Blog Spam
Brute-Force
Web App Attack
🇩🇪
mapik
2020-12-24 08:49:13
(5 years ago)
2020-12-24T14:49:07.121731multi.mapik.cz postfix/smtpd[2886518]: NOQUEUE: reject: RCPT from unknown[ ...
show more
2020-12-24T14:49:07.121731multi.mapik.cz postfix/smtpd[2886518]: NOQUEUE: reject: RCPT from unknown[196.189.24.118]: 554 5.7.1 Service unavailable; Client host [196.189.24.118] blocked using zen.spamhaus.org; https://www.spamhaus.org/sbl/query/SBLCSS / https://www.spamhaus.org/query/ip/196.189.24.118; from=<[email protected] > to=<[email protected] > proto=ESMTP helo=<[196.189.24.118]>
...
show less
Brute-Force
Showing 1 to
9
of 9 reports
Think this IP has been falsely reported? You may request to have the associated
reports reviewed and removed.
Request Takedown 🚩
Recently Reported IPs: