JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 196.2.29.24

196.2.29.24 was found in our database!

This IP was reported 16 times. Confidence of Abuse is 70%: ?

70%

ISP	Dimension Data
Usage Type	Fixed Line ISP
ASN	AS20011
Domain Name	global.ntt
Country	🇿🇦 South Africa
City	Durban, KwaZulu-Natal

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 196.2.29.24

Whois 196.2.29.24

IP Abuse Reports for 196.2.29.24:

This IP address has been reported a total of 16 times from 12 distinct sources. 196.2.29.24 was first reported on June 14th 2026, and the most recent report was 1 day ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 deskpass.com	2026-06-20 11:36:16 (1 day ago)	POST /xmlrpc.php	Web App Attack
🇺🇸 TPI-Abuse	2026-06-20 09:05:52 (1 day ago)	(mod_security) mod_security (id:225170) triggered by 196.2.29.24 (-): 1 in the last 300 secs; Ports: ... show more (mod_security) mod_security (id:225170) triggered by 196.2.29.24 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 20 05:05:48.458118 2026] [security2:error] [pid 6790:tid 6790] [client 196.2.29.24:60246] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|arsenalfordemocracy.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "arsenalfordemocracy.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ajZX7HEEflIawYXyF-uzjwAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 lostswordfish.com	2026-06-20 07:38:03 (1 day ago)	Wordfence waf block on uvfousor WPIDD	Web App Attack
🇩🇪 LRob.fr	2026-06-19 21:00:09 (1 day ago)	Repeated requests on blocked xmlrpc.php, blocked by fail2ban in custom-503-xmlrpc jail	Bad Web Bot Web App Attack
🇳🇱 wlt-blocker	2026-06-19 17:09:27 (2 days ago)	Unauthorized access to webpage admin	Web App Attack
🇳🇱 wlt-blocker	2026-06-18 14:31:27 (3 days ago)	Unauthorized access to webpage admin	Web App Attack
🇸🇪 vaia.cloud	2026-06-18 09:00:04 (3 days ago)	trying wp-login.php/xmlrpc.php 30 times in 1 minutes	Brute-Force Web App Attack
Anonymous	2026-06-18 08:33:32 (3 days ago)	ModSecurity rejected a query	Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-17 16:38:44 (4 days ago)	(mod_security) mod_security (id:225170) triggered by 196.2.29.24 (-): 1 in the last 300 secs; Ports: ... show more (mod_security) mod_security (id:225170) triggered by 196.2.29.24 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 17 12:38:35.906774 2026] [security2:error] [pid 7929:tid 7929] [client 196.2.29.24:55951] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|nessmonsters.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "nessmonsters.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ajLNi48hIY53xgAOMvKe7wAAABU"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 4server	2026-06-17 12:27:25 (4 days ago)	[WedJun1714:27:20.9451762026][security2:error][pid2757569:tid2757720][client196.2.29.24:0]ModSecurit ... show more [WedJun1714:27:20.9451762026][security2:error][pid2757569:tid2757720][client196.2.29.24:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"170\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"globalhorizon.ch\"][uri\"/xmlrpc.php\"][unique_id\"ajKSqE_XfNvyJ12ajyCKEgAAAFc\"] show less	Port Scan Brute-Force Web App Attack
🇳🇱 wlt-blocker	2026-06-15 16:10:05 (6 days ago)	Unauthorized access to webpage admin	Web App Attack
🇺🇸 integrantservices.com	2026-06-15 12:02:54 (6 days ago)	(wordpress) Failed wordpress login from 196.2.29.24 (-)	Brute-Force
🇩🇪 4server	2026-06-15 11:09:19 (6 days ago)	[MonJun1513:09:16.0635502026][security2:error][pid72772:tid72924][client196.2.29.24:0]ModSecurity:Ac ... show more [MonJun1513:09:16.0635502026][security2:error][pid72772:tid72924][client196.2.29.24:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"170\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"schneider-tools.ch\"][uri\"/xmlrpc.php\"][unique_id\"ai_dXDVzCSaofMNQw-JOdwAAANU\"] show less	Port Scan Brute-Force Web App Attack
🇺🇸 TAY	2026-06-15 09:34:19 (6 days ago)	196.2.29.24 - - [15/Jun/2026:17:29:40 +0800] "POST /xmlrpc.php HTTP/1.1" 200 6328 "-" "Mozilla/5.0 ( ... show more 196.2.29.24 - - [15/Jun/2026:17:29:40 +0800] "POST /xmlrpc.php HTTP/1.1" 200 6328 "-" "Mozilla/5.0 (Linux; Android 10; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Safari/10.0.0.0 Safari/537.36" 196.2.29.24 - - [15/Jun/2026:17:33:52 +0800] "POST /xmlrpc.php HTTP/1.1" 200 6328 "-" "Mozilla/5.0 (Linux; Android 10; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Firefox/73.0.0.0 Safari/537.36" 196.2.29.24 - - [15/Jun/2026:17:34:19 +0800] "POST /xmlrpc.php HTTP/1.1" 200 6328 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Firefox/95.0.0.0 Safari/537.36" ... show less	Brute-Force
🇺🇸 Penny Packer	2026-06-15 00:31:26 (6 days ago)	Fail2Ban apache-tripwires	Web App Attack

Showing 1 to 15 of 16 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇩🇿 154.242.96.114

🇨🇳 120.48.123.76

🇨🇳 111.127.254.225

🇷🇺 109.61.135.149

🇺🇸 107.150.103.88

🇺🇸 66.132.195.41

🇺🇸 66.132.195.39

🇬🇧 2a06:4880:8000::a2

🇪🇸 2a01:7e02::f03c:95ff:fe51:2252

🇭🇰 2404:6800:4005:c02::12e

🇹🇼 218.167.25.110

🇸🇬 194.5.82.141

🇳🇱 176.65.139.253

🇺🇸 170.106.152.69

🇨🇳 120.230.19.237

🇲🇾 115.133.240.167

🇨🇳 110.245.186.23

🇺🇸 100.34.65.244

🇺🇸 66.132.195.37

🇺🇸 66.132.195.36