JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

196.217.121.230

Neutral Activity

Abuse Confidence Score

0% Low Risk

22 reports

22 reporters · latest 8 months ago

ISP: Office National des Postes et Telecommunications ONPT (Maroc Telecom) / IAM
Usage Type: Fixed Line ISP
ASN: AS36903
Hostname(s): adsl196-230-121-217-196.adsl196-12.iam.net.ma
Domain Name: iam.ma
Country: 🇲🇦 Morocco
City: Meknes, Fes-Meknes

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

No reports in the last 60 days

196.217.121.230 has been reported 22 times. The most recent report is from 8 months ago.

The full history is preserved below and remains searchable. A 0% score reflects the absence of recent activity, but this is not a guarantee that earlier reports were invalid. Abuse confidence score decays, naturally, over time, when the abusive activity stops.

Abuse Reports

Export reports CSV

Total reports

22 from 22 distinct reporters

First reported

February 28th 2026

Most recent report

8 months ago

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇬🇧 openstrike.co.uk	2026-03-01 06:14:18 UTC · (8 months ago)	69 attacks on PHP URLs, env grabbing URLs, config grabbing URLs (type 2): GET /wp-config.php HTTP/1.1 GET /.env.deploy HTTP/1.1 GET /config/database.yml HTTP/1.1	Web App Attack Hacking
🇩🇪 Ba-Yu	2026-02-28 21:51:02 UTC · (8 months ago)	General hacking/exploits/scanning	Web Spam Hacking Brute-Force Exploited Host Web App Attack
🇺🇸 myagent.site	2026-02-28 20:36:38 UTC · (8 months ago)	Blocking for trying to access an exploit file: /.env	Hacking
🇺🇸 nekoify	2026-02-28 19:53:53 UTC · (8 months ago)	IP has triggered Cloudflare WAF. action: block source: firewallManaged clientAsn: 36903 clientASNDescription: MT-MPLS clientCountryName: MA clientIP: 196.217.121.230 clientRequestHTTPMethodName: GET clientRequestHTTPProtocol: HTTP/1.1 clientRequestPa ... show more IP has triggered Cloudflare WAF. action: block source: firewallManaged clientAsn: 36903 clientASNDescription: MT-MPLS clientCountryName: MA clientIP: 196.217.121.230 clientRequestHTTPMethodName: GET clientRequestHTTPProtocol: HTTP/1.1 clientRequestPath: /wp-config.php%20 clientRequestQuery: datetime: 2026-02-28T19:53:53Z rayName: 9d52787c8938e1dc ruleId: 9ce4e284ff2a486aaa37d642bff5a079 userAgent: Mozilla/5.0 (Linux; Android 14; SM-S918B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.101 Mobile Safari/537.36. show less	Open Proxy VPN IP Port Scan Hacking SQL Injection Bad Web Bot Exploited Host Web App Attack
Anonymous	2026-02-28 19:38:52 UTC · (8 months ago)	(mod_security) mod_security triggered on hostname [redacted] 196.217.121.230 (MA/Morocco/adsl196-230-121-217-196.adsl196-12.iam.net.ma)	SQL Injection
🇩🇪 webko.si	2026-02-28 16:42:44 UTC · (8 months ago)	MCK: Excessive 404. Brute forcing vulnerabilities. Last uri: /.env.save	Brute-Force Web App Attack
🇬🇧 Apache	2026-02-28 15:56:20 UTC · (8 months ago)	(mod_security) mod_security (id:210492) triggered by 196.217.121.230 (MA/Morocco/adsl196-230-121-217-196.adsl196-12.iam.net.ma): 5 in the last 300 secs	Brute-Force Web App Attack
🇫🇷 COMAITE	2026-02-28 15:44:54 UTC · (8 months ago)	Common web attack from 196.217.121.230.	Web App Attack
🇫🇷 Baking333	2026-02-28 15:41:01 UTC · (8 months ago)	[redacted] 196.217.121.230 - - [28/Feb/2026:16:40:59 +0100] "GET /.env HTTP/1.1" 302 5287 0/98901 "https://[redacted]/directory/game/Just%20Chatting" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167. ... show more [redacted] 196.217.121.230 - - [28/Feb/2026:16:40:59 +0100] "GET /.env HTTP/1.1" 302 5287 0/98901 "https://[redacted]/directory/game/Just%20Chatting" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36" [redacted] 196.217.121.230 - - [28/Feb/2026:16:40:59 +0100] "GET /.[redacted] HTTP/1.1" 302 1559 0/46591 "https://[redacted]/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36" show less	Bad Web Bot Web App Attack
🇺🇸 mnsf	2026-02-28 15:05:27 UTC · (8 months ago)	Scanning/Probing (11)	Brute-Force Web App Attack
🇩🇪 Mario Silber	2026-02-28 14:24:09 UTC · (8 months ago)	(mod_security) mod_security triggered on hostname [redacted] 196.217.121.230 (MA/Morocco/adsl196-230-121-217-196.adsl196-12.iam.net.ma)	SQL Injection
🇳🇱 CryptoYakari	2026-02-28 13:17:15 UTC · (8 months ago)	196.217.121.230 - - [28/Feb/2026:16:17:12 +0300] "GET /config.env HTTP/1.0" 404 7003 "https://stackoverflow.com/search?q=%5Bcss%5D+animation&sort=newest" "Mozilla/5.0 (iPad; CPU OS 17_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/ ... show more 196.217.121.230 - - [28/Feb/2026:16:17:12 +0300] "GET /config.env HTTP/1.0" 404 7003 "https://stackoverflow.com/search?q=%5Bcss%5D+animation&sort=newest" "Mozilla/5.0 (iPad; CPU OS 17_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Mobile/15E148 Safari/604.1" 196.217.121.230 - - [28/Feb/2026:16:17:12 +0300] "GET /config/mail.php HTTP/1.0" 404 3515 "https://www.amazon.com/dp/B08N5WRWNW?ref_=nav_em__k_ods_ha_0_1_1_3" "Mozilla/5.0 (X11; Linux x86_64; rv:123.0) Gecko/20100101 Firefox/123.0" 196.217.121.230 - - [28/Feb/2026:16:17:13 +0300] "GET /config/services.php HTTP/1.0" 404 3515 "https://www.reddit.com/r/worldnews/comments/def789/headline/?utm_source=share&utm_medium=web2x" "Mozilla/5.0 (iPad; CPU OS 17_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Mobile/15E148 Safari/604.1" 196.217.121.230 - - [28/Feb/2026:16:17:14 +0300] "GET /settings.py HTTP/1.0" 404 3515 "https://www.amazon.com/s?k=running+shoes&ref=nb_sb_noss_2" "Mozilla/5.0 (X11; ... show less	Web Spam Blog Spam Web App Attack Bad Web Bot
🇫🇷 dynamix	2026-02-28 11:53:38 UTC · (8 months ago)	Multiple WAF Violations	Web App Attack
🇬🇧 consul.to	2026-02-28 11:44:50 UTC · (8 months ago)	Web attack/malicious scanning detected	Web App Attack
🇺🇸 zwebvigil	2026-02-28 11:40:30 UTC · (8 months ago)	196.217.121.230 [28/Feb/2026:03:40:25 -0800] "GET /.env HTTP/1.1" 404 2673 "https://github.com/" port=62407 "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3 Safari/605.1.15" "-" "-" "<host>" 878 196 ... show more 196.217.121.230 [28/Feb/2026:03:40:25 -0800] "GET /.env HTTP/1.1" 404 2673 "https://github.com/" port=62407 "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3 Safari/605.1.15" "-" "-" "<host>" 878 196.217.121.230 [28/Feb/2026:03:40:27 -0800] "GET /.env.local HTTP/1.1" 404 2685 "https://www.google.com/" port=62407 "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.58 Safari/537.36" "-" "-" "<host>" 919 196.217.121.230 [28/Feb/2026:03:40:27 -0800] "GET /.env.production HTTP/1.1" 404 2695 "https://www.google.de/" port=62407 "Mozilla/5.0 (Linux; Android 12; SM-G991B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.230 Mobile Safari/537.36" "-" "-" "<host>" 919 196.217.121.230 [28/Feb/2026:03:40:27 -0800] "GET /.env.development HTTP/1.1" 404 2697 "https://www.bing.com/search?q=" port=62407 "Mozilla/5.0 (X11; Linux x86_64; rv:122.0) Gecko/20100101 Fire show less	Web App Attack

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇦🇷 179.42.181.216

🇯🇵 20.89.238.126

🇨🇳 223.104.54.156

🇺🇸 199.165.159.216

🇰🇼 188.70.24.43

🇬🇧 185.247.137.102

🇨🇱 138.84.35.113

🇨🇳 124.90.99.81

🇨🇳 120.225.51.172

🇹🇼 114.44.160.115

🇫🇷 85.217.140.6

🇧🇪 35.210.236.206

🇺🇸 20.106.169.103

🇲🇽 187.249.114.234

🇺🇸 174.76.8.147

🇬🇧 159.65.94.135

🇭🇰 156.225.1.45

🇫🇮 147.185.133.2

🇳🇱 138.226.239.21

🇨🇳 113.140.95.250