JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 196.237.224.149

196.237.224.149 was found in our database!

This IP was reported 9 times. Confidence of Abuse is 46%: ?

46%

ISP	SMARTPHONE
Usage Type	Fixed Line ISP
ASN	AS37492
Domain Name	orangetunisie.tn
Country	🇹🇳 Tunisia
City	Tunis, Tunis Governorate

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 196.237.224.149

Whois 196.237.224.149

IP Abuse Reports for 196.237.224.149:

This IP address has been reported a total of 9 times from 7 distinct sources. 196.237.224.149 was first reported on June 12th 2026, and the most recent report was 3 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-06-12 18:01:48 (3 hours ago)	(mod_security) mod_security (id:240335) triggered by 196.237.224.149 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:240335) triggered by 196.237.224.149 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 12 14:01:42.996953 2026] [security2:error] [pid 28809:tid 28815] [client 196.237.224.149:63428] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 196.237.224.149 (+1 hits since last alert)\|aafm.us\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "aafm.us"] [uri "/xmlrpc.php"] [unique_id "aixJhk_LEESkjg1J8voKLwAAAYE"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-06-12 18:01:10 (3 hours ago)	Attac	Brute-Force
🇺🇸 TPI-Abuse	2026-06-12 16:25:33 (4 hours ago)	(mod_security) mod_security (id:240335) triggered by 196.237.224.149 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:240335) triggered by 196.237.224.149 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 12 12:25:27.308120 2026] [security2:error] [pid 28002:tid 28002] [client 196.237.224.149:60982] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 196.237.224.149 (+1 hits since last alert)\|jdeloa.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "jdeloa.com"] [uri "/xmlrpc.php"] [unique_id "aiwy93FcBYxXPmMVGbMFEAAAAA0"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-12 15:48:28 (5 hours ago)	(mod_security) mod_security (id:240335) triggered by 196.237.224.149 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:240335) triggered by 196.237.224.149 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 12 11:48:24.836289 2026] [security2:error] [pid 27990:tid 27990] [client 196.237.224.149:59689] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 196.237.224.149 (+1 hits since last alert)\|sizefinder.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "sizefinder.com"] [uri "/xmlrpc.php"] [unique_id "aiwqSJzCry4-1dUL165wsgAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 integrantservices.com	2026-06-12 14:13:21 (6 hours ago)	(wordpress) Failed wordpress login from 196.237.224.149 (TN/Tunisia/-)	Brute-Force
Anonymous	2026-06-12 09:21:34 (11 hours ago)	196.237.224.149 - - [12/Jun/2026:11:21:12 +0200] "POST /xmlrpc.php HTTP/1.1" 200 593 "-" "WordPress. ... show more 196.237.224.149 - - [12/Jun/2026:11:21:12 +0200] "POST /xmlrpc.php HTTP/1.1" 200 593 "-" "WordPress.com; https://wordpress.com" 196.237.224.149 - - [12/Jun/2026:11:21:14 +0200] "POST /xmlrpc.php HTTP/1.1" 200 403 "-" "WordPress.com; https://wordpress.com" 196.237.224.149 - - [12/Jun/2026:11:21:23 +0200] "POST /xmlrpc.php HTTP/1.1" 200 593 "-" "WordPress.com; https://wordpress.com" 196.237.224.149 - - [12/Jun/2026:11:21:23 +0200] "POST /xmlrpc.php HTTP/1.1" 200 403 "-" "WordPress.com; https://wordpress.com" 196.237.224.149 - - [12/Jun/2026:11:21:33 +0200] "POST /xmlrpc.php HTTP/1.1" 200 593 "-" "Jetpack by WordPress.com (Jetpack 12.5; WordPress 6.4)" ... show less	Brute-Force Web App Attack
🇫🇷 dynamix	2026-06-12 07:18:38 (13 hours ago)	WordPress XMLRPC Brute Force Attack	Brute-Force Web App Attack
🇸🇪 vaia.cloud	2026-06-12 07:03:06 (14 hours ago)	trying wp-login.php/xmlrpc.php 35 times in 1 minutes	Brute-Force Web App Attack
Anonymous	2026-06-12 06:55:54 (14 hours ago)	[ssd5.kdns.gr] httpd-xmlrpc-post: sites=goingkoi.com.cy; logs=/var/log/httpd/domains/goingkoi.com.cy ... show more [ssd5.kdns.gr] httpd-xmlrpc-post: sites=goingkoi.com.cy; logs=/var/log/httpd/domains/goingkoi.com.cy.log; samples=/xmlrpc.php show less	Brute-Force Web App Attack

Showing 1 to 9 of 9 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇳 112.28.234.157

🇧🇬 78.90.19.40

🇨🇳 36.103.222.120

🇺🇸 216.180.246.208

🇮🇶 185.166.25.150

🇨🇳 183.165.251.15

🇺🇸 172.236.228.86

🇩🇿 154.247.20.236

🇮🇩 103.155.47.102

🇵🇹 95.93.40.96

🇨🇳 61.183.86.2

🇫🇷 51.159.142.227

🇨🇳 36.153.231.222

🇧🇷 2804:14d:32b0:4d6e:242f:7c37:4499:ccec

🇩🇪 213.209.159.56

🇽🇰 194.169.167.164

🇸🇬 193.37.32.65

🇭🇰 185.239.84.249

🇧🇷 178.92.162.70

🇺🇸 147.185.132.31