JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 196.191.240.104

196.191.240.104 was found in our database!

This IP was reported 23 times. Confidence of Abuse is 5%: ?

ISP	Ethio Telecom
Usage Type	Mobile ISP
ASN	AS24757
Domain Name	ethiotelecom.et
Country	🇪🇹 Ethiopia
City	Sodo, South Ethiopia Regional State

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 196.191.240.104

Whois 196.191.240.104

IP Abuse Reports for 196.191.240.104:

This IP address has been reported a total of 23 times from 18 distinct sources. 196.191.240.104 was first reported on September 21st 2023, and the most recent report was 1 day ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
Anonymous	2026-07-20 06:50:26 (1 day ago)	denied traffic to a honeypot network. destination port 46634.	Port Scan Hacking
🇨🇦 DRI	2026-05-16 11:51:52 (2 months ago)	Unsolicited TCP traffic on Honeypot, srcport=42875 dstport=23	Port Scan Hacking
🇯🇵 jay hung	2026-04-21 18:38:21 (3 months ago)	2026-04-21T18:38:15.859553+00:00 quarktech kernel: [2874969.787184] [UFW BLOCK] IN=eth0 OUT= MAC=22: ... show more 2026-04-21T18:38:15.859553+00:00 quarktech kernel: [2874969.787184] [UFW BLOCK] IN=eth0 OUT= MAC=22:00:92:2e:84:93:fe:ff:ff:ff:ff:ff:08:00 SRC=196.191.240.104 DST=172.237.29.33 LEN=1280 TOS=0x00 PREC=0x00 TTL=49 ID=18910 DF PROTO=UDP SPT=13488 DPT=443 LEN=1260 ... show less	Port Scan
🇸🇬 mypatricks	2026-03-27 09:19:02 (3 months ago)	196.191.240.104 \| Port: 9959 \| DNS: 196.191.240.104 2026-03-27T17:19:01+08:00 Africa/Addis_Ababa \| I ... show more 196.191.240.104 \| Port: 9959 \| DNS: 196.191.240.104 2026-03-27T17:19:01+08:00 Africa/Addis_Ababa \| IPs reserved list \| UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 HTTP/1.1 443 GET \| URL: /account/create/?98cfb036aa161342d21f37d16b0b2b85=1774530507 \| Ref: https://xxxxxx/hashtag/plane/?2585fe11255d58f49598db49401=ms-my&code=ms-my \| Country: ET/Ethiopia/+02:00 IP City: Sodo Windows 9e2d4f9baefd7e19-ADD/ADD 1 hits/0 secs Robots 2 show less	Brute-Force Web App Attack Blog Spam Web Spam Exploited Host
🇨🇭 backslash	2026-02-09 15:15:15 (5 months ago)	block ruleset 333FBABBA6DC06D7D20EDF60700DF5D9612E6F09	Bad Web Bot
Anonymous	2025-11-25 07:52:42 (7 months ago)	scanning http requests from known botnet	Web App Attack
🇬🇧 Birdo	2024-11-15 11:49:59 (1 year ago)	[SMB Honeypot Report] Timestamp: 2024-11-15 11:49:58 UTC Port: 40685 No credentials captured Attack ... show more [SMB Honeypot Report] Timestamp: 2024-11-15 11:49:58 UTC Port: 40685 No credentials captured Attack Type: Unauthorized SMB connection attempt show less	Port Scan Hacking Brute-Force
🇺🇸 rdpguard.com	2024-08-12 07:22:34 (1 year ago)	RdpGuard detected brute-force attempt on HTTP	Brute-Force
🇳🇿 Tripwire	2024-06-29 10:07:21 (2 years ago)	Wordpress login attempts	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2024-06-21 09:57:03 (2 years ago)	(mod_security) mod_security (id:225170) triggered by 196.191.240.104 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:225170) triggered by 196.191.240.104 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 21 05:56:58.335746 2024] [security2:error] [pid 21864:tid 47298734200576] [client 196.191.240.104:51082] [client 196.191.240.104] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|www.killasgarage.bike\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.killasgarage.bike"] [uri "/wp-json/wp/v2/users/1"] [unique_id "ZnVOaqHl7ZHjnGBqU_5npAAAAM4"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 fortypoundhead	2024-05-31 19:29:53 (2 years ago)	PHP vulnerability scan	Web App Attack
🇫🇷 Sklurk	2024-05-30 06:57:40 (2 years ago)	Web App Attack	Web App Attack
🇺🇦 URAN Publishing Service	2024-04-14 09:40:13 (2 years ago)	196.191.240.104 - - [14/Apr/2024:12:40:07 +0300] "GET /wp-login.php HTTP/1.1" 404 2972 "-" "Mozilla/ ... show more 196.191.240.104 - - [14/Apr/2024:12:40:07 +0300] "GET /wp-login.php HTTP/1.1" 404 2972 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko" 196.191.240.104 - - [14/Apr/2024:12:40:09 +0300] "GET /xmlrpc.php HTTP/1.1" 404 366 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko" ... show less	Web App Attack
🇧🇪 Ivo Vynckier	2024-03-24 14:54:00 (2 years ago)	196.191.240.104 - - [24/Mar/2024:10:23:51 +0100] "GET /wp-login.php HTTP/1.1" 404 27 "-" "Mozilla/5. ... show more 196.191.240.104 - - [24/Mar/2024:10:23:51 +0100] "GET /wp-login.php HTTP/1.1" 404 27 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko" 196.191.240.104 - - [24/Mar/2024:10:23:51 +0100] "GET /xmlrpc.php HTTP/1.1" 404 27 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko" show less	Web App Attack
🇺🇸 TPI-Abuse	2024-03-23 20:56:16 (2 years ago)	(mod_security) mod_security (id:225170) triggered by 196.191.240.104 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:225170) triggered by 196.191.240.104 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Mar 23 16:56:11.430492 2024] [security2:error] [pid 6325] [client 196.191.240.104:3486] [client 196.191.240.104] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|salernospizza.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "salernospizza.com"] [uri "/wp-json/wp/v2/users/1"] [unique_id "Zf9B61t3KHpMf2r7Kb8GUwAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 23 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇩🇪 43.131.26.226

🇺🇸 20.168.7.149

🇰🇷 211.251.245.88

🇷🇴 193.46.255.86

🇲🇴 182.93.7.194

🇨🇳 116.179.37.131

🇹🇭 61.19.114.132

🇳🇱 45.148.10.151

🇰🇷 43.131.253.14

🇩🇪 43.131.23.154

🇺🇸 43.130.78.203

🇶🇦 34.18.120.123

🇳🇱 193.176.31.198

🇦🇷 190.99.71.203

🇺🇸 166.88.152.188

🇺🇸 147.185.132.205

🇰🇿 89.218.69.66

🇺🇸 43.130.57.76

🇺🇸 43.130.53.252

🇺🇸 43.130.32.245