JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 196.3.101.2

196.3.101.2 was found in our database!

This IP was reported 76 times. Confidence of Abuse is 100%: ?

100%

ISP	Eduardo Mondlane University
Usage Type	University/College/School
ASN	AS31960
Hostname(s)	webhost.snoticias.co.mz
Domain Name	uem.mz
Country	🇲🇿 Mozambique
City	Maputo, Maputo City

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 196.3.101.2

Whois 196.3.101.2

IP Abuse Reports for 196.3.101.2:

This IP address has been reported a total of 76 times from 51 distinct sources. 196.3.101.2 was first reported on April 1st 2024, and the most recent report was 6 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
Anonymous	2026-06-20 05:12:57 (6 hours ago)	<jail> banned by fail2ban	Brute-Force Web App Attack
🇩🇪 excill	2026-06-20 03:04:34 (8 hours ago)	Honeypot mesh observed 827 attack events in 24h — cowrie/dionaea/heralding/suricata	Port Scan Hacking Brute-Force SSH
Anonymous	2026-06-19 22:50:00 (12 hours ago)	Part of a persistent, large-scale spam campaign. This IP is used to distribute phishing emails promo ... show more Part of a persistent, large-scale spam campaign. This IP is used to distribute phishing emails promoting illicitly modified B-CAS cards. The associated landing pages are intentionally using Cloudflare’s protection to conceal their activities (Cloaking). This is a verified malicious actor involved in long-term fraud and victim tracking. [Illegally modified B-CAS card sales site: https://ref.az/Wvkr -> https://ewkv1jh8mx1tdv.cfd/] show less	Web Spam Email Spam Spoofing Phishing
🇫🇷 tecnicorioja	2026-06-19 22:00:37 (13 hours ago)	wp-login attack [19/Jun/2026:05:20:05	Brute-Force Web App Attack
Anonymous	2026-06-19 13:21:05 (21 hours ago)	Web App Attack, Hacking	Hacking Web App Attack
🇦🇺 paulshipley.com.au	2026-06-19 11:14:05 (1 day ago)	shop.levellapromotions.com.au:443 196.3.101.2 - - [19/Jun/2026:21:14:02 +1000] "GET /?author=3&feed= ... show more shop.levellapromotions.com.au:443 196.3.101.2 - - [19/Jun/2026:21:14:02 +1000] "GET /?author=3&feed=rss2 HTTP/1.1" 404 4298 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36, Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36" ... show less	Web App Attack
🇺🇸 TPI-Abuse	2026-06-19 11:02:24 (1 day ago)	(mod_security) mod_security (id:225170) triggered by 196.3.101.2 (webhost.snoticias.co.mz): 1 in the ... show more (mod_security) mod_security (id:225170) triggered by 196.3.101.2 (webhost.snoticias.co.mz): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 19 07:02:20.331538 2026] [security2:error] [pid 12636:tid 12636] [client 196.3.101.2:33130] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|dennisangellismusic.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "dennisangellismusic.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "ajUhvDvC0KJmGNXWKMoE2wAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
🇨🇦 polycoda	2026-06-19 10:28:01 (1 day ago)	📄 Probes for wp-login.php and other inexistent URLs	Hacking Web App Attack
🇩🇪 YF	2026-06-19 10:10:20 (1 day ago)	WordPress author enumeration	Web App Attack
🇩🇪 stinpriza	2026-06-19 09:55:22 (1 day ago)	Web App Attack	Web App Attack
🇺🇸 TPI-Abuse	2026-06-19 09:45:27 (1 day ago)	(mod_security) mod_security (id:225170) triggered by 196.3.101.2 (webhost.snoticias.co.mz): 1 in the ... show more (mod_security) mod_security (id:225170) triggered by 196.3.101.2 (webhost.snoticias.co.mz): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 19 05:45:19.145583 2026] [security2:error] [pid 30047:tid 30047] [client 196.3.101.2:42878] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|www.support.leonardodecaprio.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.support.leonardodecaprio.com"] [uri "/wp-json/wp/v2/users/5"] [unique_id "ajUPr4oWNZo4CvmHsGxMUwAAAAs"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 masterguru	2026-06-19 09:44:45 (1 day ago)	WordPress: User enumeration. Pattern match "(author\\\\= (88030-197)	Hacking
🇺🇸 TPI-Abuse	2026-06-19 09:19:30 (1 day ago)	(mod_security) mod_security (id:225170) triggered by 196.3.101.2 (webhost.snoticias.co.mz): 1 in the ... show more (mod_security) mod_security (id:225170) triggered by 196.3.101.2 (webhost.snoticias.co.mz): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 19 05:19:27.063765 2026] [security2:error] [pid 2676:tid 2676] [client 196.3.101.2:53446] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|partners.imagineyourphotos.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "partners.imagineyourphotos.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "ajUJn3KT9kkU5blR2E6vSwAAAAo"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-19 08:46:44 (1 day ago)	(mod_security) mod_security (id:225170) triggered by 196.3.101.2 (webhost.snoticias.co.mz): 1 in the ... show more (mod_security) mod_security (id:225170) triggered by 196.3.101.2 (webhost.snoticias.co.mz): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 19 04:46:41.347154 2026] [security2:error] [pid 28574:tid 28574] [client 196.3.101.2:49026] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|lawrencehale.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "lawrencehale.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "ajUB8a0_-6D4jtlKfSSmMQAAABI"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-19 08:30:38 (1 day ago)	(mod_security) mod_security (id:225170) triggered by 196.3.101.2 (webhost.snoticias.co.mz): 1 in the ... show more (mod_security) mod_security (id:225170) triggered by 196.3.101.2 (webhost.snoticias.co.mz): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 19 04:30:32.943371 2026] [security2:error] [pid 8683:tid 8683] [client 196.3.101.2:34412] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|rocksolidhomebuilders.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rocksolidhomebuilders.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "ajT-KEHN-e4YK-g7dIXrMwAAABA"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 76 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇸🇦 188.54.139.185

🇮🇳 106.193.37.156

🇻🇳 27.66.9.189

🇺🇸 20.115.90.24

🇨🇳 180.102.110.142

🇰🇭 119.13.157.23

🇺🇸 97.99.240.68

🇵🇱 95.214.53.157

🇬🇧 86.22.249.135

🇸🇦 51.36.51.131

🇳🇱 45.148.10.141

🇸🇦 37.107.61.57

🇸🇬 8.219.231.149

🇷🇴 2.57.122.177

🇺🇦 195.211.213.61

🇲🇩 178.168.53.210

🇺🇸 162.216.149.119

🇯🇵 118.193.61.170

🇸🇦 109.83.126.95

🇮🇩 103.99.214.16