JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 196.64.209.27

196.64.209.27 was found in our database!

This IP was reported 31 times. Confidence of Abuse is 100%: ?

100%

ISP	Office National des Postes et Telecommunications ONPT (Maroc Telecom) / IAM
Usage Type	Fixed Line ISP
ASN	AS36903
Domain Name	iam.ma
Country	🇲🇦 Morocco
City	Kenitra, Rabat-Sale-Kenitra

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 196.64.209.27

Whois 196.64.209.27

IP Abuse Reports for 196.64.209.27:

This IP address has been reported a total of 31 times from 25 distinct sources. 196.64.209.27 was first reported on August 26th 2026, and the most recent report was 15 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇷 claude CALVET	2026-08-27 06:49:57 (15 hours ago)	gee-88 : Bloc AI bots=>/(Scrap)	Hacking
🇺🇸 wbsouza	2026-08-27 03:41:06 (19 hours ago)	CrowdSec: infra/bad-path-probe — automated firewall drops on self-hosted IDS sensor	Hacking
🇫🇷 carpes0708	2026-08-27 00:40:13 (22 hours ago)		Port Scan Web App Attack
🇫🇮 mnazibo	2026-08-26 23:00:05 (23 hours ago)	Date: 27/Aug/2026 01:19:23 \| Reported IP: 196.64.209.27 mod_security \| id: 930130 \| MA/group.my_doma ... show more Date: 27/Aug/2026 01:19:23 \| Reported IP: 196.64.209.27 mod_security \| id: 930130 \| MA/group.my_domain/- \| Connections: 1 \| Blocked: Permanent Block: [LF_MODSEC] \| URIs: /.env \| Logs: Restricted File Access Attempt show less	SQL Injection Brute-Force Bad Web Bot
🇺🇸 TPI-Abuse	2026-08-26 22:27:03 (1 day ago)	(mod_security) mod_security (id:210492) triggered by 196.64.209.27 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 196.64.209.27 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Aug 26 18:26:57.300663 2026] [security2:error] [pid 20503:tid 20503] [client 196.64.209.27:42052] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "pharmaceuticalsalescareerhub.com"] [uri "/.env"] [unique_id "ao9oMQGQOJNInlnE6iWEwQAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
🇮🇪 Coolnagour	2026-08-26 22:19:50 (1 day ago)	funnypot web honeypot, port 443: HEAD https://funnypot.org/.env	Web App Attack
🇳🇱 homeshowdomain.nl	2026-08-26 21:59:15 (1 day ago)	Auto-ban: >3000 req/min op 2026-08-26	Web App Attack SSH Hacking
Anonymous	2026-08-26 21:47:02 (1 day ago)	Bot / scanning and/or hacking attempts: HEAD /.env HTTP/1.1	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-08-26 21:27:49 (1 day ago)	(mod_security) mod_security (id:210492) triggered by 196.64.209.27 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 196.64.209.27 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Aug 26 17:27:42.737251 2026] [security2:error] [pid 3762:tid 3762] [client 196.64.209.27:40300] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "dinogirl.com"] [uri "/.env"] [unique_id "ao9aTgJMmZXWojwK5euMYwAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 mieg	2026-08-26 20:30:27 (1 day ago)	Web vulnerability probing	Brute-Force Web App Attack
🇵🇱 Budyn	2026-08-26 19:46:55 (1 day ago)	Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scan ... show more Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: minio.definitelynotahoneypot.xyz \| URI: /.env \| UA: Unknown User-Agent \| BODY: [Empty / GET Request] show less	Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-08-26 19:45:49 (1 day ago)	(mod_security) mod_security (id:210492) triggered by 196.64.209.27 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 196.64.209.27 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Aug 26 15:45:42.595293 2026] [security2:error] [pid 10395:tid 10395] [client 196.64.209.27:59500] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "asdfwordpro.com"] [uri "/.env"] [unique_id "ao9CZlojiRI4No2FvSxumQAAAAs"] show less	Brute-Force Bad Web Bot Web App Attack
🇵🇱 srebrakowski.com	2026-08-26 16:36:26 (1 day ago)	crowdsec/waf-detected-exploits	Brute-Force
🇩🇪 LRob	2026-08-26 16:35:32 (1 day ago)	Probing for secret files (.git, .env, credentials, database dumps, wp-config) \| method: HEAD (+1 mor ... show more Probing for secret files (.git, .env, credentials, database dumps, wp-config) \| method: HEAD (+1 more) \| path: /.env \| 2026-08-26 16:35 UTC show less	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-08-26 16:35:18 (1 day ago)	(mod_security) mod_security (id:210492) triggered by 196.64.209.27 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 196.64.209.27 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Aug 26 12:35:14.311869 2026] [security2:error] [pid 27860:tid 27860] [client 196.64.209.27:46304] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.formationone.com"] [uri "/.env"] [unique_id "ao8VwnvkdtLor-6A3556zAAAAAQ"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 31 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇩🇪 193.124.20.244

🇮🇳 116.74.164.106

🇫🇷 85.217.140.44

🇺🇸 66.132.186.254

🇻🇳 42.1.65.123

🇳🇱 185.226.197.68

🇺🇸 185.180.141.49

🇬🇧 165.22.118.79

🇩🇪 139.19.117.131

🇨🇳 120.48.71.14

🇱🇹 62.60.130.201

🇨🇳 58.34.174.90

🇳🇱 52.233.193.61

🇱🇹 213.176.26.52

🇧🇷 205.210.31.248

🇳🇱 185.226.197.67

🇧🇷 177.19.145.25

🇷🇺 85.235.33.142

🇬🇧 81.19.219.213

🇸🇬 43.106.62.140