JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

200.55.231.94

Recent Activity

Abuse Confidence Score

68% Elevated

24 reports

16 reporters · latest 1 day ago

ISP: ETAPA EP
Usage Type: Fixed Line ISP
ASN: AS27668
Domain Name: etapa.net.ec
Country: 🇪🇨 Ecuador
City: Cuenca, Azuay

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Example preview

Account required for the enhanced features Log in Sign up

Abuse Reports

Export reports CSV

Total reports

24 from 16 distinct reporters

First reported

July 31st 2026

Most recent report

1 day ago

Last 60 days

Top reporter locations 🇩🇪 Germany 7 🇺🇸 United States of America 6 🇨🇿 Czechia 4

Most common categories Brute-Force 14 Web App Attack 13 Bad Web Bot 8 Hacking 5 VPN IP 3

Recent reports We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 LRob	2026-11-14 02:45:11 UTC · (1 day ago)	WordPress login brute force \| path: /wp-login.php \| ua: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/155.0.0.0 Safari/537.36 \| 2026-11-14 02:45 UTC	Brute-Force Web App Attack
🇦🇺 FireGuard Server	2026-11-10 05:15:29 UTC · (4 days ago)	Blocked by os-abuseipdb; 4 hits, proto=tcp, ports=443	Port Scan Hacking
🇩🇪 ghostwarriors	2026-11-10 04:50:05 UTC · (4 days ago)	Attempts against non-existent wp-login	Brute-Force Web App Attack
🇩🇪 throny	2026-11-10 04:25:20 UTC · (4 days ago)	Web app exploit probe on a honeypot: requested known vulnerability paths (wp-login.php, .env, .git ...). Requests within an hour: 1 on 1 host(s) User agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0 ... show more Web app exploit probe on a honeypot: requested known vulnerability paths (wp-login.php, .env, .git ...). Requests within an hour: 1 on 1 host(s) User agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Sa Requested, e.g.: - sentry.[REDACTED]/wp-admin/ show less	Web App Attack
🇩🇪 LRob	2026-11-09 15:45:30 UTC · (5 days ago)	Not following 301 redirects — wasted requests \| method: POST \| path: /wp-login.php \| ua: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0 Safari/605.1.15 \| 2026-11-09 15:45 UTC	Bad Web Bot
🇫🇮 inlink.ltd	2026-11-09 09:29:19 UTC · (5 days ago)	Known malicious PHP file or CMS probe	Web App Attack
🇨🇿 Countryman	2026-11-05 01:10:01 UTC · (1 week ago)	repeated unauthorized VPN login attempt, user sweep	VPN IP Hacking Brute-Force
🇨🇿 Countryman	2026-11-04 01:10:06 UTC · (1 week ago)	repeated unauthorized VPN login attempt, user sweep	VPN IP Hacking Brute-Force
🇨🇿 Countryman	2026-11-01 01:10:02 UTC · (2 weeks ago)	repeated unauthorized VPN login attempt, user sweep	VPN IP Hacking Brute-Force
🇨🇿 lp	2026-10-31 07:03:15 UTC · (2 weeks ago)	Unauthorized VPN login attempts: 1 attempts were recorded from 200.55.231.94 2026-10-31T07:42:45+0100 vpn Access-Reject station: 200.55.231.94	Brute-Force Web App Attack
🇨🇭 SOC [GOLINE SA]	2026-10-30 10:07:06 UTC · (2 weeks ago)	[RoutePulse \| 2026-10-30T10:07:06Z \| RTBH-INJECTED] ATTACK CLASS: vpn_bruteforce SOURCE: 200.55.231.94 EVIDENCE: Shunned on the Cisco FTD VPN gateway — Cisco VPN RA Brute force on Cisco FTDv — slow spray: 3 failed logins over 2 h (one every ~72 min, ... show more [RoutePulse \| 2026-10-30T10:07:06Z \| RTBH-INJECTED] ATTACK CLASS: vpn_bruteforce SOURCE: 200.55.231.94 EVIDENCE: Shunned on the Cisco FTD VPN gateway — Cisco VPN RA Brute force on Cisco FTDv — slow spray: 3 failed logins over 2 h (one every ~72 min, under every 15-min threshold and the FTD hold-down) — rung 1-bis (doc 247 §10.2) DETECTION: Conviction Engine SPRT + 14-detector ML stack (6-model weighted ensemble) + 5-pillar threat scoring ACTION: BGP null route injected at RoutePulse network edge show less	Brute-Force Hacking
🇩🇪 LRob	2026-10-30 05:11:15 UTC · (2 weeks ago)	Not following 301 redirects — wasted requests \| host: assainissement-etang.fr \| method: POST \| path: /wp-login.php \| ua: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0 Safari/605.1.15 \| src_port: ... show more Not following 301 redirects — wasted requests \| host: assainissement-etang.fr \| method: POST \| path: /wp-login.php \| ua: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0 Safari/605.1.15 \| src_port: 50286 show less	Bad Web Bot
🇳🇱 BlueWire Hosting	2026-10-30 02:47:17 UTC · (2 weeks ago)	Aggressive scanning resulting into 404	Bad Web Bot
🇺🇸 TPI-Abuse	2026-10-26 07:41:51 UTC · (2 weeks ago)	(mod_security) mod_security (id:225170) triggered by 200.55.231.94 (94.200-55-231.etapanet.net): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 26 03:41:43.931549 2026] [security2:error] [pid 3829:tid 3829] [client ... show more (mod_security) mod_security (id:225170) triggered by 200.55.231.94 (94.200-55-231.etapanet.net): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 26 03:41:43.931549 2026] [security2:error] [pid 3829:tid 3829] [client 200.55.231.94:44122] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|adlc18.org\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "adlc18.org"] [uri "/wp-json/wp/v2/users"] [unique_id "at8EN_eJyntWoftDxHi7lgAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 lostswordfish.com	2026-10-25 05:36:03 UTC · (2 weeks ago)	Wordfence waf block on registrymatters	Web App Attack

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇪🇹 196.189.126.10

🇳🇱 195.178.110.232

🇹🇷 193.35.155.138

🇺🇸 162.216.150.185

🇮🇳 117.241.77.78

🇺🇸 20.40.213.103

🇹🇼 221.120.77.34

🇨🇳 221.3.55.42

🇺🇸 199.96.165.186

🇩🇪 194.88.98.87

🇺🇸 162.216.150.116

🇺🇸 151.243.141.45

🇰🇷 82.26.199.31

🇨🇦 45.198.224.71

🇸🇬 43.134.186.29

🇬🇧 35.203.211.160

🇬🇧 35.203.210.238

🇮🇷 2.187.98.47

🇦🇷 181.26.109.35

🇬🇧 178.62.68.119