JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

196.77.35.214

Recent Activity

Abuse Confidence Score

45% Elevated

11 reports

9 reporters · latest 1 day ago

ISP: ADSL_Maroc_telecom
Usage Type: Fixed Line ISP
ASN: AS36903
Domain Name: menara.ma
Country: 🇲🇦 Morocco
City: Marrakesh, Marrakesh-Safi

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Example preview

Account required for the enhanced features Log in Sign up

Abuse Reports

Export reports CSV

Total reports

11 from 9 distinct reporters

First reported

June 26th 2021

Most recent report

1 day ago

Last 60 days

Top reporter locations 🇺🇸 United States of America 4 🇨🇦 Canada 1 🇩🇪 Germany 1

Most common categories Web App Attack 7 Brute-Force 5 Bad Web Bot 3 Hacking 1 SSH 1

Recent reports We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
Anonymous	2026-11-13 10:41:17 UTC · (1 day ago)	FortiWeb WAF: 23 attacks detected. Threat Score: 9357800. Types: Client Management(10), HTTP Protocol Constraints(7), Signature Detection(6). Origin: , Morocco.	Web App Attack
🇮🇹 CoreTech srl	2026-11-12 18:43:56 UTC · (1 day ago)	cloudlinux2 fail2ban: 2026-11-12 19:39:19,028 fail2ban.actions [1611]: NOTICE [plesk-modsecurity] Unban 46.172.213.185cloudlinux2 fail2ban: 2026-11-12 19:40:11,671 fail2ban.filter [1611]: INFO [plesk-modsecurity] Found 196.77.35.21 ... show more cloudlinux2 fail2ban: 2026-11-12 19:39:19,028 fail2ban.actions [1611]: NOTICE [plesk-modsecurity] Unban 46.172.213.185cloudlinux2 fail2ban: 2026-11-12 19:40:11,671 fail2ban.filter [1611]: INFO [plesk-modsecurity] Found 196.77.35.214 - 2026-11-12 19:40:11cloudlinux2 fail2ban: 2026-11-12 19:40:11,098 fail2ban.actions [1611]: NOTICE [plesk-modsecurity] Unban 192.228.159.15cloudlinux2 fail2ban: 2026-11-12 19:42:02,444 fail2ban.actions [1611]: NOTICE [plesk-modsecurity] Unban 172.71.148.104cloudlinux2 fail2ban: 2026-11-12 19:42:00,432 fail2ban.actions [1611]: NOTICE [plesk-modsecurity] Unban 172.71.148.105cloudlinux2 fail2ban: 2026-11-12 19:42:35,491 fail2ban.filter [1611]: INFO [plesk-modsecurity] Found 34.139.27.8 - 2026-11-12 19:42:35cloudlinux2 fail2ban: 2026-11-12 19:42:35,460 fail2ban.filter [1611]: INFO [plesk-modsecurity] Found 34.139.27.8 - 2026-11-12 19:42:35cloudlinux2 fail2ban: 2026-11-12 19:42:35,364 fail2ban.filter [1611]: INFO show less	Brute-Force
🇺🇸 TPI-Abuse	2026-11-12 17:51:55 UTC · (1 day ago)	(mod_security) mod_security (id:212750) triggered by 196.77.35.214 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 12:51:51.654949 2026] [security2:error] [pid 24585:tid 24585] [client 196.77.35.214:62386] M ... show more (mod_security) mod_security (id:212750) triggered by 196.77.35.214 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 12:51:51.654949 2026] [security2:error] [pid 24585:tid 24585] [client 196.77.35.214:62386] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\bon(?:abort\|blur\|change\|click\|dblclick\|dragdrop\|error\|focus\|keydown\|keypress\|keyup\|load\|mouse(?:down\|move\|out\|over\|up)\|move\|readystatechange\|reset\|resize\|select\|submit\|unload)\\\\b[^a-zA-Z0-9_]{0,}?=" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/07_XSS_XSS.conf"] [line "69"] [id "212750"] [rev "3"] [msg "COMODO WAF: XSS Attack Detected\|\|lifestylemedica.com\|F\|2"] [data "Matched Data: onerror= found within REQUEST_URI: /lsm/?page_id=</script>'\\x5c\\x22><img src=x onerror=prompt(1)>"] [severity "CRITICAL"] [tag "CWAF"] [tag "XSS"] [hostname "lifestylemedica.com"] [uri "/lsm/"] [unique_id "avX8t13SIrLpgOxbPrFzpAAAABU"] show less	Brute-Force Bad Web Bot Web App Attack
🇿🇦 Megasurf	2026-11-12 17:45:43 UTC · (1 day ago)	web application attack (blocked by the web application firewall). Blocked automatically by our firewall (LF_MODSEC).	Web App Attack
🇬🇧 Celtic	2026-11-12 17:33:47 UTC · (1 day ago)	Blocked by Fail2Ban with Jail (plesk-modsecurity)	Brute-Force SSH
🇺🇸 francelink.fr	2026-11-12 17:25:23 UTC · (1 day ago)	Azure WAF blocked a request. Rule: 949110. Observed at: 2026-11-12T17:23:48.000Z.	Web App Attack
🇺🇸 TPI-Abuse	2026-11-12 16:29:54 UTC · (1 day ago)	(mod_security) mod_security (id:212750) triggered by 196.77.35.214 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 11:29:47.554328 2026] [security2:error] [pid 28424:tid 28424] [client 196.77.35.214:65296] M ... show more (mod_security) mod_security (id:212750) triggered by 196.77.35.214 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 11:29:47.554328 2026] [security2:error] [pid 28424:tid 28424] [client 196.77.35.214:65296] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\bon(?:abort\|blur\|change\|click\|dblclick\|dragdrop\|error\|focus\|keydown\|keypress\|keyup\|load\|mouse(?:down\|move\|out\|over\|up)\|move\|readystatechange\|reset\|resize\|select\|submit\|unload)\\\\b[^a-zA-Z0-9_]{0,}?=" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/07_XSS_XSS.conf"] [line "69"] [id "212750"] [rev "3"] [msg "COMODO WAF: XSS Attack Detected\|\|www.konahawaiirealty.com\|F\|2"] [data "Matched Data: onerror= found within REQUEST_URI: /search/details/1e5/3/?mktrpt=</script>'\\x5c\\x22><img src=x onerror=prompt(1)>"] [severity "CRITICAL"] [tag "CWAF"] [tag "XSS"] [hostname "www.konahawaiirealty.com"] [uri "/search/details/1e5/3/"] [unique_id "avXpe-GTGVOc67HhyLBSzgAAAA0"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-11-12 16:13:45 UTC · (1 day ago)	(mod_security) mod_security (id:212750) triggered by 196.77.35.214 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 11:13:38.441327 2026] [security2:error] [pid 30189:tid 30189] [client 196.77.35.214:65243] M ... show more (mod_security) mod_security (id:212750) triggered by 196.77.35.214 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 11:13:38.441327 2026] [security2:error] [pid 30189:tid 30189] [client 196.77.35.214:65243] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\bon(?:abort\|blur\|change\|click\|dblclick\|dragdrop\|error\|focus\|keydown\|keypress\|keyup\|load\|mouse(?:down\|move\|out\|over\|up)\|move\|readystatechange\|reset\|resize\|select\|submit\|unload)\\\\b[^a-zA-Z0-9_]{0,}?=" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/07_XSS_XSS.conf"] [line "69"] [id "212750"] [rev "3"] [msg "COMODO WAF: XSS Attack Detected\|\|killeramps.com\|F\|2"] [data "Matched Data: onerror= found within REQUEST_URI: /g12terms.php?fromwhat=user registration&fromwhere=</script>'\\x5c\\x22><img src=x onerror=prompt(1)>"] [severity "CRITICAL"] [tag "CWAF"] [tag "XSS"] [hostname "killeramps.com"] [uri "/g12terms.php"] [unique_id "avXlsmcjFR3sYcGp6eKJZgAAABg"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 LRob	2026-11-12 14:56:27 UTC · (2 days ago)	Web exploit attempt \| method: GET \| path: / \| query: p=%3C%2Fscript%3E%27%5C%22%3E%3Cimg+src%3Dx+onError%3Dprompt%281%29%3E&preview=true, p=3583&preview=%3C%2Fscript%3E%27%5C%22%3E%3Cimg+src%3Dx+onError%3Dprompt%281%29%3E \| ua: Mozilla/5.0 (Macintosh ... show more Web exploit attempt \| method: GET \| path: / \| query: p=%3C%2Fscript%3E%27%5C%22%3E%3Cimg+src%3Dx+onError%3Dprompt%281%29%3E&preview=true, p=3583&preview=%3C%2Fscript%3E%27%5C%22%3E%3Cimg+src%3Dx+onError%3Dprompt%281%29%3E \| ua: Mozilla/5.0 (Macintosh; Intel Mac OS X 14.7; rv:133.0) Gecko/20100101 Firefox/133.0, Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.1 Safari/605.1.15 show less	Hacking Web App Attack
Anonymous	2026-08-06 18:20:05 UTC · (3 months ago)	\| [Dangerous/Morocco] Aggressive IP 196.77.35.214 (~30 hits). Type: DoS Defender- Web server 400 error code	Web App Attack Hacking SQL Injection
🇵🇱 ChillScanner	2021-06-26 17:39:11 UTC · (5 years ago)	1 probe(s) @ TCP(23)	Port Scan

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇩🇪 196.251.121.131

🇺🇸 173.255.227.90

🇳🇱 77.239.124.148

🇳🇱 45.227.255.157

🇷🇺 185.94.32.86

🇵🇱 162.158.102.191

🇺🇸 104.22.49.66

🇺🇸 44.220.188.124

🇺🇸 24.43.144.225

🇧🇷 205.210.31.205

🇳🇱 200.138.46.212

🇺🇸 147.185.132.176

🇩🇪 130.49.16.183

🇮🇳 117.96.41.80

🇺🇸 70.184.82.170

🇩🇪 69.5.169.57

🇩🇪 194.187.176.146

🇨🇳 101.96.192.45

🇳🇱 86.38.187.32

🇧🇬 79.124.49.62