AbuseIPDB » 196.251.85.138

196.251.85.138 was found in our database!

This IP was reported 132 times. Confidence of Abuse is 69%: ?

69%

ISP	internet-security-cheapyhost
Usage Type	Data Center/Web Hosting/Transit
ASN	AS401120
Domain Name	cheapy.host
Country	Netherlands
City	Amsterdam, North Holland

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated biweekly.

Report 196.251.85.138

Whois 196.251.85.138

IP Abuse Reports for 196.251.85.138:

This IP address has been reported a total of 132 times from 63 distinct sources. 196.251.85.138 was first reported on March 27th 2025, and the most recent report was 1 day ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp in UTC	Comment	Categories
Anonymous	2025-07-11 05:42:56 (1 day ago)	11-07-2025 07:42:55.7 ERROR util.AccessViolations - 196.251.85.138 report to fail2ban - action: bloc ... show more11-07-2025 07:42:55.7 ERROR util.AccessViolations - 196.251.85.138 report to fail2ban - action: block ... show less	Hacking Brute-Force Bad Web Bot
TPI-Abuse	2025-07-11 01:20:25 (1 day ago)	(mod_security) mod_security (id:210730) triggered by 196.251.85.138 (-): 1 in the last 300 secs; Por ... show more(mod_security) mod_security (id:210730) triggered by 196.251.85.138 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 10 21:20:20.291093 2025] [security2:error] [pid 11674:tid 11674] [client 196.251.85.138:46068] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||chinookdrivingacademy.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "chinookdrivingacademy.com"] [uri "/mail: [email protected]"] [unique_id "aHBm1DSuQ8HTf9EaogFFawAAABE"] show less	Brute-Force Bad Web Bot Web App Attack
Site.eu	2025-07-08 13:43:27 (4 days ago)	Excessive multi-domain requests	Brute-Force
Pingger Shikkoken	2025-07-07 06:45:57 (5 days ago)	2025-07-07T06:45:57+00:00 iskariot kernel: AbuseIPDB-Blacklist-Dropped: IN=ens3 OUT=ServerBridge MAC ... show more2025-07-07T06:45:57+00:00 iskariot kernel: AbuseIPDB-Blacklist-Dropped: IN=ens3 OUT=ServerBridge MAC=b6:ab:74:e6:2e:14:84:03:28:62:58:1a:08:00 SRC=196.251.85.138 DST=10.1.1.2 LEN=60 TOS=0x00 PREC=0x00 TTL=53 ID=6527 DF PROTO=TCP SPT=50550 DPT=443 WINDOW=64240 RES=0x00 SYN URGP=0 2025-07-07T06:45:58+00:00 iskariot kernel: AbuseIPDB-Blacklist-Dropped: IN=ens3 OUT=ServerBridge MAC=b6:ab:74:e6:2e:14:84:03:28:62:58:1a:08:00 SRC=196.251.85.138 DST=10.1.1.2 LEN=60 TOS=0x00 PREC=0x00 TTL=53 ID=6528 DF PROTO=TCP SPT=50550 DPT=443 WINDOW=64240 RES=0x00 SYN URGP=0 2025-07-07T06:46:00+00:00 iskariot kernel: AbuseIPDB-Blacklist-Dropped: IN=ens3 OUT=ServerBridge MAC=b6:ab:74:e6:2e:14:84:03:28:62:58:1a:08:00 SRC=196.251.85.138 DST=10.1.1.2 LEN=60 TOS=0x00 PREC=0x00 TTL=53 ID=6529 DF PROTO=TCP SPT=50550 DPT=443 WINDOW=64240 RES=0x00 SYN URGP=0 ... show less	Hacking Bad Web Bot
advena	2025-07-07 02:00:58 (5 days ago)	196.251.85.138 (AS401120 CHEAPY-HOST) was intercepted at 2025-07-07T01:47:47Z after violating WAF di ... show more196.251.85.138 (AS401120 CHEAPY-HOST) was intercepted at 2025-07-07T01:47:47Z after violating WAF directive: 874a3e315c344b1281ad4f00046aab6f. Pre-cautionary/corrective action applied: block. show less	Web Spam Hacking Brute-Force Web App Attack
TPI-Abuse	2025-07-05 09:34:31 (1 week ago)	(mod_security) mod_security (id:210730) triggered by 196.251.85.138 (-): 1 in the last 300 secs; Por ... show more(mod_security) mod_security (id:210730) triggered by 196.251.85.138 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 05 05:34:25.180677 2025] [security2:error] [pid 13950:tid 13968] [client 196.251.85.138:58020] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||maritimeclinic.net|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "maritimeclinic.net"] [uri "/saemed.com"] [unique_id "aGjxoah2sW1pm4Vi7GMovAAAABA"] show less	Brute-Force Bad Web Bot Web App Attack
TPI-Abuse	2025-07-05 06:43:31 (1 week ago)	(mod_security) mod_security (id:210730) triggered by 196.251.85.138 (-): 1 in the last 300 secs; Por ... show more(mod_security) mod_security (id:210730) triggered by 196.251.85.138 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 05 02:43:25.813013 2025] [security2:error] [pid 18335:tid 18335] [client 196.251.85.138:57768] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||danharrisphotoart.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "danharrisphotoart.com"] [uri "/email:[email protected]"] [unique_id "aGjJjQ6xD4m80xttTjdLOQAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack
Pingger Shikkoken	2025-07-01 09:29:32 (1 week ago)	2025-07-01T09:29:32+00:00 iskariot kernel: AbuseIPDB-Blacklist-Dropped: IN=ens3 OUT=ServerBridge MAC ... show more2025-07-01T09:29:32+00:00 iskariot kernel: AbuseIPDB-Blacklist-Dropped: IN=ens3 OUT=ServerBridge MAC=b6:ab:74:e6:2e:14:84:03:28:62:58:1a:08:00 SRC=196.251.85.138 DST=10.1.1.2 LEN=60 TOS=0x00 PREC=0x00 TTL=53 ID=52692 DF PROTO=TCP SPT=59454 DPT=443 WINDOW=64240 RES=0x00 SYN URGP=0 2025-07-01T09:29:33+00:00 iskariot kernel: AbuseIPDB-Blacklist-Dropped: IN=ens3 OUT=ServerBridge MAC=b6:ab:74:e6:2e:14:84:03:28:62:58:1a:08:00 SRC=196.251.85.138 DST=10.1.1.2 LEN=60 TOS=0x00 PREC=0x00 TTL=53 ID=52693 DF PROTO=TCP SPT=59454 DPT=443 WINDOW=64240 RES=0x00 SYN URGP=0 2025-07-01T09:29:35+00:00 iskariot kernel: AbuseIPDB-Blacklist-Dropped: IN=ens3 OUT=ServerBridge MAC=b6:ab:74:e6:2e:14:84:03:28:62:58:1a:08:00 SRC=196.251.85.138 DST=10.1.1.2 LEN=60 TOS=0x00 PREC=0x00 TTL=53 ID=52694 DF PROTO=TCP SPT=59454 DPT=443 WINDOW=64240 RES=0x00 SYN URGP=0 ... show less	Hacking Bad Web Bot
TPI-Abuse	2025-06-30 17:07:33 (1 week ago)	(mod_security) mod_security (id:210730) triggered by 196.251.85.138 (-): 1 in the last 300 secs; Por ... show more(mod_security) mod_security (id:210730) triggered by 196.251.85.138 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 30 13:07:26.594892 2025] [security2:error] [pid 2848:tid 2848] [client 196.251.85.138:51260] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||urlpick.com|F|2"] [data ".adoptsearch.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "urlpick.com"] [uri "/http:/www.adoptsearch.com"] [unique_id "aGLETuNPpfYs0ZS3nJI9xwAAABk"] show less	Brute-Force Bad Web Bot Web App Attack
MM-bot	2025-06-30 05:57:31 (1 week ago)	URL-probe: HTTP/1.1 GET request on /item.url (2025-06-30 07:57:31 UTC+2)	Hacking Web App Attack
ozisp.com.au	2025-06-29 17:29:37 (1 week ago)	null_null_<33>1751218174 [1:2400042:4386] ET DROP Spamhaus DROP Listed Traffic Inbound group 43 [Cla ... show morenull_null_<33>1751218174 [1:2400042:4386] ET DROP Spamhaus DROP Listed Traffic Inbound group 43 [Classification: Misc Attack] [Priority: 2] {TCP} 196.251.85.138:55104 show less	Hacking
TPI-Abuse	2025-06-29 03:05:18 (1 week ago)	(mod_security) mod_security (id:210730) triggered by 196.251.85.138 (-): 1 in the last 300 secs; Por ... show more(mod_security) mod_security (id:210730) triggered by 196.251.85.138 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 28 23:05:13.398469 2025] [security2:error] [pid 3668165:tid 3668176] [client 196.251.85.138:60518] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.oldcarz.com|F|2"] [data ".daewoo.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.oldcarz.com"] [uri "/www.daewoo.com"] [unique_id "aGCtaVyz55mzcO3xgzWhHAAAAQY"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2025-06-28 04:07:38 (2 weeks ago)	28-06-2025 06:07:37.6 ERROR util.AccessViolations - 196.251.85.138 report to fail2ban - action: bloc ... show more28-06-2025 06:07:37.6 ERROR util.AccessViolations - 196.251.85.138 report to fail2ban - action: block ... show less	Hacking Brute-Force Bad Web Bot
COMPLEX	2025-06-28 03:25:26 (2 weeks ago)	Triggered Cloudflare WAF (firewallCustom) from NL. Action taken: BLOCK ASN: 401120 (CHEA ... show moreTriggered Cloudflare WAF (firewallCustom) from NL. Action taken: BLOCK ASN: 401120 (CHEAPY-HOST) Protocol: HTTP/1.1 (GET method) Endpoint: / show less	Bad Web Bot
Globe2	2025-06-25 00:57:46 (2 weeks ago)	[25/Jun/2025:01:57:15 +0100] pjrJUjbVgi8GxNLprmDTmIxt 196.251.85.138 51556 194.36.163.79 443 [ ... show more[25/Jun/2025:01:57:15 +0100] pjrJUjbVgi8GxNLprmDTmIxt 196.251.85.138 51556 194.36.163.79 443 [25/Jun/2025:01:57:33 +0100] M3l3n1xaCa66QPWR98ka-1Ed 196.251.85.138 29402 194.36.163.79 443 [25/Jun/2025:01:57:45 +0100] ZQ54ImnKd1YHayu0C8eaPm1T 196.251.85.138 22946 194.36.163.79 443 ... show less	Web App Attack

Is this your IP? You may request to takedown any associated reports. We will attempt to verify your ownership. Request Takedown 🚩