JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 196.89.154.233

196.89.154.233 was found in our database!

This IP was reported 33 times. Confidence of Abuse is 100%: ?

100%

ISP	ADSL_Maroc_telecom
Usage Type	Fixed Line ISP
ASN	AS36903
Domain Name	menara.ma
Country	🇲🇦 Morocco
City	Marrakesh, Marrakesh-Safi

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 196.89.154.233

Whois 196.89.154.233

IP Abuse Reports for 196.89.154.233:

This IP address has been reported a total of 33 times from 25 distinct sources. 196.89.154.233 was first reported on July 18th 2026, and the most recent report was 3 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇨🇭 backslash	2026-07-20 08:39:00 (3 days ago)		Web App Attack
Anonymous	2026-07-19 16:05:39 (3 days ago)	Blocked: Reason='Vulnerability probing — PHP scan detected (12/60 min)'; Requests=12	Port Scan
🇺🇸 TPI-Abuse	2026-07-19 15:09:09 (3 days ago)	(mod_security) mod_security (id:210492) triggered by 196.89.154.233 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 196.89.154.233 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 19 11:09:02.253310 2026] [security2:error] [pid 1755267:tid 1755267] [client 196.89.154.233:53178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "konahawaii.com"] [uri "/.env"] [unique_id "alzojsbByfp1ilqQkhq0TgAAAAw"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 helios.live	2026-07-19 14:50:16 (4 days ago)	2026/07/19 14:50:15 [error] 1088628#1088628: 2196048 FastCGI sent in stderr: "Primary script unknow ... show more 2026/07/19 14:50:15 [error] 1088628#1088628: 2196048 FastCGI sent in stderr: "Primary script unknown" while reading response header from upstream, client: 196.89.154.233, server: kocerroxy.com, request: "GET /info.php HTTP/1.1", upstream: "fastcgi://unix:/var/run/php/php8.4-fpm-betakocerroxycom.sock:", host: "app.kocerroxy.com" 2026/07/19 14:50:15 [error] 1088628#1088628: 2196047 FastCGI sent in stderr: "Primary script unknown" while reading response header from upstream, client: 196.89.154.233, server: kocerroxy.com, request: "GET /info.php HTTP/1.1", upstream: "fastcgi://unix:/var/run/php/php8.4-fpm-betakocerroxycom.sock:", host: "kocerroxy.com" 2026/07/19 14:50:15 [error] 1088628#1088628: 2196047 FastCGI sent in stderr: "Primary script unknown" while reading response header from upstream, client: 196.89.154.233, server: kocerroxy.com, request: "GET /test.php HTTP/1.1", upstream: "fastcgi://unix:/var/run/php/php8.4-fpm-betakocerroxycom.sock:", host: "kocerroxy.com" 196.89.154.233 ... show less	Web App Attack
🇺🇸 TPI-Abuse	2026-07-19 14:45:28 (4 days ago)	(mod_security) mod_security (id:210492) triggered by 196.89.154.233 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 196.89.154.233 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 19 10:45:20.938057 2026] [security2:error] [pid 23787:tid 23787] [client 196.89.154.233:64631] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "knoxvillelimos.com"] [uri "/.env"] [unique_id "alzjAFDZvBU_GJHpKa3yLgAAAAQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 IndigoRidge	2026-07-19 14:38:57 (4 days ago)	196.89.154.233 - - [19/Jul/2026:10:38:57 -0400] "GET /phpinfo.php HTTP/1.1" 301 162 "-" "Mozilla/5.0 ... show more 196.89.154.233 - - [19/Jul/2026:10:38:57 -0400] "GET /phpinfo.php HTTP/1.1" 301 162 "-" "Mozilla/5.0 (Windows NT 10.0; rv:126.0) Gecko/20100101 Firefox/126.0" 196.89.154.233 - - [19/Jul/2026:10:38:57 -0400] "GET /info.php HTTP/1.1" 301 162 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" 196.89.154.233 - - [19/Jul/2026:10:38:57 -0400] "GET /test.php HTTP/1.1" 301 162 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0" ... show less	Web App Attack
🇩🇪 big-cloud.nl	2026-07-19 14:27:28 (4 days ago)	Try to access /.env	Web App Attack
🇺🇸 kosada.com	2026-07-19 14:25:08 (4 days ago)	Web vulnerability probing: /phpinfo.php	Web App Attack
🇨🇭 4server	2026-07-19 14:22:08 (4 days ago)	[SunJul1916:22:04.3241502026][security2:error][pid1413752:tid1413981][client196.89.154.233:0]ModSecu ... show more [SunJul1916:22:04.3241502026][security2:error][pid1413752:tid1413981][client196.89.154.233:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"[\\\\\\\\n\\\\\\\\r]\"atARGS_GET:lang.[file\"/etc/apache2/conf.d/modsec_rules/00_asl_zz_strict.conf\"][line\"143\"][id\"390722\"][rev\"5\"][msg\"Atomicorp.comWAFRules:HTTPHeaderInjectionAttackviapayload\(CR/LFdetected\)\"][data\"MatchedData:\\\\x0dfoundwithinARGS_GET:lang:jaVasCript:/\-/\/\`/\'/\\\\x5c\\\\x22/\\/\(/\*/oNcliCk=confirm\(\'https://www.google.com/search\?q=1\'\)\)//\\\\x0d\\\\x0a\\\\x0d\\\\x0a//\</stYle/\</titLe/\</teXtarEa/\</scRipt/--\!\>\\\\x5c\\\\x5cx3csVg/\<sVg/oNloAd=confirm\(\'https://www.google.com/search\?q=1\'\)//\>\\\\x5c\\\\x5cx3e\"][severity\"CRITICAL\"][hostname\"whatsdecor.ch\"][uri\"/prodotto/12622/\"][unique_id\"alzdjNuySTEGf-RZC4ZA2AAAARU\"] show less	Hacking Web App Attack
🇳🇱 wlt-blocker	2026-07-19 14:17:21 (4 days ago)	SQL injection attempt	SQL Injection
🇫🇷 pm33	2026-07-19 14:09:33 (4 days ago)	Probing for resource vulnerabilities HTTP(S)	Web App Attack
🇦🇺 Telemetry2U.com	2026-07-19 14:07:17 (4 days ago)	SQL Injection attempt detected	Web App Attack SQL Injection
🇺🇸 mnsf	2026-07-19 14:05:29 (4 days ago)	Too many Status 40X (14)	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-07-19 13:58:34 (4 days ago)	(mod_security) mod_security (id:210492) triggered by 196.89.154.233 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 196.89.154.233 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 19 09:58:26.611208 2026] [security2:error] [pid 3058673:tid 3058673] [client 196.89.154.233:52574] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "kirkrmartin.com"] [uri "/.env"] [unique_id "alzYAgufTHsAL6ZVQUNIHQAAAAo"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-19 13:42:55 (4 days ago)	(mod_security) mod_security (id:210492) triggered by 196.89.154.233 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 196.89.154.233 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 19 09:42:50.919807 2026] [security2:error] [pid 24073:tid 24073] [client 196.89.154.233:63878] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "kingdomvalleyfarm.com"] [uri "/.env"] [unique_id "alzUWgOp0aS92nMX8z0rPQAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 33 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇻🇳 157.66.224.129

🇳🇱 45.154.98.128

🇮🇳 203.193.150.244

🇺🇸 195.184.76.164

🇪🇨 191.99.40.101

🇷🇸 185.37.26.244

🇨🇳 182.37.0.190

🇺🇸 172.235.49.88

🇦🇺 172.105.189.192

🇺🇸 162.243.147.237

🇮🇳 122.168.123.73

🇩🇪 64.226.126.224

🇳🇱 45.156.87.254

🇳🇱 45.148.10.151

🇮🇪 34.247.57.246

🇺🇸 20.29.24.158

🇺🇸 2607:f8b0:4001:c76::12e

🇺🇸 172.253.86.16

🇩🇪 104.207.63.111

🇧🇩 103.158.125.167