JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 199.180.11.254

199.180.11.254 was found in our database!

This IP was reported 4 times. Confidence of Abuse is 0%: ?

ISP	Skyway Frieght Systems
Usage Type	Data Center/Web Hosting/Transit
ASN	AS394380
Domain Name	skywayinc.com
Country	🇺🇸 United States of America
City	Dallas, Texas

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 199.180.11.254

Whois 199.180.11.254

IP Abuse Reports for 199.180.11.254:

This IP address has been reported a total of 4 times from 3 distinct sources. 199.180.11.254 was first reported on July 1st 2025, and the most recent report was 1 month ago.

Old Reports: The most recent abuse report for this IP address is from 1 month ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
Anonymous	2026-05-20 01:20:04 (1 month ago)	\| Shellshock attack detected	Web App Attack Hacking SQL Injection
🇺🇸 xmission.com	2026-02-07 13:28:15 (5 months ago)	Blocked by UFW (TCP on 8080) Source port: 60337 TTL: 53 Packet length: 60 TOS: 0x08 This report (fo ... show more Blocked by UFW (TCP on 8080) Source port: 60337 TTL: 53 Packet length: 60 TOS: 0x08 This report (for 199.180.11.254) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan Web App Attack
🇺🇸 TPI-Abuse	2026-02-01 13:07:56 (5 months ago)	(mod_security) mod_security (id:210492) triggered by 199.180.11.254 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 199.180.11.254 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Feb 01 08:07:47.735542 2026] [security2:error] [pid 12299:tid 12334] [client 199.180.11.254:52921] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autoconfig.kettlehill.kettlehill.com"] [uri "/.env.prod"] [unique_id "aX9QI8_CAppeKcdveJ3p8gAAAJA"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-07-01 07:12:48 (1 year ago)	(mod_security) mod_security (id:210730) triggered by 199.180.11.254 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210730) triggered by 199.180.11.254 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 01 03:12:42.965768 2025] [security2:error] [pid 32047:tid 32111] [client 199.180.11.254:32993] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|www.kettlehill.net\|F\|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.kettlehill.net"] [uri "/login.php.bak"] [unique_id "aGOKagF1tdoO2im1K3V4dQAAAII"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 4 of 4 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 2a04:4e40:e020:0:207:9296:bc9e:154d

🇨🇳 218.64.60.157

🇩🇪 213.202.231.12

🇫🇷 185.255.126.2

🇷🇺 176.59.133.162

🇹🇭 165.154.120.89

🇯🇵 164.52.24.182

🇵🇭 124.105.218.151

🇸🇬 118.194.234.189

🇺🇸 100.23.69.34

🇸🇬 47.84.105.165

🇺🇸 2a04:4e40:e040:0:207:9296:bc9e:154d

🇺🇸 205.185.117.197

🇳🇱 204.76.203.18

🇧🇷 201.71.192.108

🇧🇪 198.235.24.234

🇹🇼 198.235.24.123

🇮🇷 164.138.130.105

🇺🇸 100.50.17.159

🇷🇴 92.118.39.71