JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 196.207.227.105

196.207.227.105 was found in our database!

This IP was reported 25 times. Confidence of Abuse is 18%: ?

18%

ISP	SONATEL Societe Nationale Des Telecommunications Du Senegal
Usage Type	Fixed Line ISP
ASN	AS8346
Domain Name	sonatel.sn
Country	🇸🇳 Senegal
City	Dakar, Dakar

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 196.207.227.105

Whois 196.207.227.105

IP Abuse Reports for 196.207.227.105:

This IP address has been reported a total of 25 times from 14 distinct sources. 196.207.227.105 was first reported on March 31st 2025, and the most recent report was 3 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-10-23 21:03:02 (3 days ago)	(mod_security) mod_security (id:210350) triggered by 196.207.227.105 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210350) triggered by 196.207.227.105 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 23 17:02:56.397049 2026] [security2:error] [pid 15084:tid 15155] [client 196.207.227.105:18508] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|seanmeriwether.com\|F\|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "seanmeriwether.com"] [uri "/"] [unique_id "atvLgCPbzCCLF0SgQtbP7AAAAgI"], referer: https://queertype.blogspot.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇩🇰 powerhostingdk	2026-10-13 13:52:14 (1 week ago)	[mailserver] CrowdSec detected crowdsecurity/postscreen-rbl (1 events). Automated abuse report.	Email Spam Brute-Force
🇺🇸 鬼影233	2026-09-21 23:52:59 (1 month ago)	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Sa ... show more Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 show less	Bad Web Bot
🇺🇸 鬼影233	2026-09-21 20:55:34 (1 month ago)	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Sa ... show more Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36 show less	Bad Web Bot
🇺🇸 鬼影233	2026-09-14 20:14:53 (1 month ago)	Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0. ... show more Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 show less	Bad Web Bot
🇺🇸 TPI-Abuse	2026-08-03 08:19:54 (2 months ago)	(mod_security) mod_security (id:210730) triggered by 196.207.227.105 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210730) triggered by 196.207.227.105 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 03 04:19:48.169248 2026] [security2:error] [pid 76462:tid 76462] [client 196.207.227.105:52171] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|www.achildsspace.com\|F\|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.achildsspace.com"] [uri "/facebook.com"] [unique_id "anBPJK3WAfZlugJ9HOCohAAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
🇵🇱 bmino.pl	2026-08-03 00:28:39 (2 months ago)	Autoban IP(2): 196.207.227.105 - Hostname: SONATEL-AS Autonomous System - City: Dakar - Region: Daka ... show more Autoban IP(2): 196.207.227.105 - Hostname: SONATEL-AS Autonomous System - City: Dakar - Region: Dakar - Country: Senegal - Location: - Organization: Sonatelnet - failed attempts. show less	Web App Attack
🇩🇪 pltcldvlpr	2026-06-14 22:41:33 (4 months ago)	Bogus Useragent: 196.207.227.105 - - [14/Jun/2026:14:54:04 +0200] "GET /protocol?id=bb_4_42&paragrap ... show more Bogus Useragent: 196.207.227.105 - - [14/Jun/2026:14:54:04 +0200] "GET /protocol?id=bb_4_42&paragraph=153729&seq=18 HTTP/1.1" 302 5 "-" "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 11.0; Trident/4.0)" asn=8346 org="SONATEL-AS Autonomous System" country=SN ... show less	Bad Web Bot
🇺🇸 xmission.com	2026-06-09 08:51:59 (4 months ago)	Blocked by UFW (TCP on 9101) Source port: 52624 TTL: 110 Packet length: 48 TOS: 0x08 This report (f ... show more Blocked by UFW (TCP on 9101) Source port: 52624 TTL: 110 Packet length: 48 TOS: 0x08 This report (for 196.207.227.105) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇩🇪 SMARTNET	2026-05-27 06:03:53 (5 months ago)	Aisuru(Mirai variant) DDoS \| Incident ID: 05d1ccb8-9fe2-4914-b2a4-f363f4cb0b0e	DDoS Attack
🇺🇸 xmission.com	2026-04-28 14:23:28 (5 months ago)	Blocked by UFW (TCP on 9101) Source port: 2007 TTL: 113 Packet length: 52 TOS: 0x00 This report (fo ... show more Blocked by UFW (TCP on 9101) Source port: 2007 TTL: 113 Packet length: 52 TOS: 0x00 This report (for 196.207.227.105) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇺🇸 TPI-Abuse	2026-04-21 13:40:57 (6 months ago)	(mod_security) mod_security (id:240950) triggered by 196.207.227.105 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:240950) triggered by 196.207.227.105 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Apr 21 09:40:49.748077 2026] [security2:error] [pid 1298617:tid 1298617] [client 196.207.227.105:13799] ModSecurity: Access denied with code 403 (phase 1). Pattern match "\\\\D" at TX:1. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "4530"] [id "240950"] [rev "2"] [msg "COMODO WAF: XSS & SQL injection vulnerability in Pragyan CMS 3.0 (CVE-2015-1471)\|\|www.noelramos.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "www.noelramos.com"] [uri "/wiki/index.php"] [unique_id "aed-Yeas8KBHZvXLEuwxHAAAABM"], referer: http://www.noelramos.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇹🇷 rtbh.com.tr	2026-03-05 20:11:54 (7 months ago)	list.rtbh.com.tr report: tcp/0	Brute-Force
🇦🇺 MAGIC	2025-12-11 01:09:35 (10 months ago)	VM1 Bad user agents ignoring web crawling rules. Draing bandwidth	DDoS Attack Bad Web Bot
Anonymous	2025-11-25 02:54:30 (11 months ago)	scanning http requests from known botnet	Web App Attack

Showing 1 to 15 of 25 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇩🇪 213.209.159.238

🇺🇸 187.40.235.16

🇨🇴 181.79.159.3

🇩🇪 151.243.11.172

🇺🇸 104.232.79.58

🇧🇬 91.191.209.98

🇫🇷 88.161.64.160

🇷🇸 77.105.37.219

🇵🇱 57.128.214.238

🇳🇱 45.148.10.121

🇺🇸 35.80.48.175

🇯🇵 34.146.179.240

🇺🇸 8.234.225.193

🇺🇸 216.25.89.123

🇪🇹 196.190.33.12

🇵🇾 190.128.241.2

🇺🇸 172.212.107.121

🇸🇪 165.231.143.109

🇺🇸 129.121.120.170

🇦🇺 115.186.228.39