JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

202.8.43.237

Neutral Activity Whitelisted Subnet

Abuse Confidence Score

0% Low Risk

23 reports

13 reporters · latest 4 hours ago

202.8.43.237 is on our whitelist as Ahrefs Crawler via the subnet 202.8.40.0/22.

ISP: Ahrefs Crawler B
Usage Type: Data Center/Web Hosting/Transit
ASN: AS140577
Hostname(s): proxy-us000-sa1.ahrefs.net
Domain Name: ahrefs.com
Country: 🇺🇸 United States of America
City: Ashburn, Virginia

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Example preview

Account required for the enhanced features Log in Sign up

Abuse Reports

Export reports CSV

Total reports

23 from 13 distinct reporters

First reported

November 5th 2026

Most recent report

4 hours ago

Last 60 days

Top reporter locations 🇺🇸 United States of America 13 🇩🇪 Germany 3 🇦🇷 Argentina 2

Most common categories Bad Web Bot 15 Web App Attack 11 Brute-Force 6 Port Scan 1 SSH 1

Recent reports We have received reports of abusive activity from this IP address within the last week. This IP is on our whitelist as Ahrefs Crawler. Shared services like this are often reported for traffic that is not abuse, so review the reports before blocking.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 johnkarlhill	2026-11-14 07:05:12 UTC · (4 hours ago)	WebKnight blocked malicious web request on johnkarlhill.com	Brute-Force SSH
🇺🇸 ipblock.com	2026-11-14 01:02:00 UTC · (10 hours ago)	IPBlock protected site ID [4678-sl]. Bad agent, site scraper bot.	Bad Web Bot
🇺🇸 ipblock.com	2026-11-12 13:57:00 UTC · (1 day ago)	IPBlock protected site ID [4678-sl]. Bad agent, site scraper bot.	Bad Web Bot
🇺🇸 francelink.fr	2026-11-11 07:58:25 UTC · (3 days ago)	Azure WAF blocked a request. Rule: 949110. Observed at: 2026-11-11T07:57:34.000Z.	Web App Attack
🇺🇸 ipblock.com	2026-11-10 23:15:00 UTC · (3 days ago)	IPBlock protected site ID [4678-sl]. Bad agent, site scraper bot.	Bad Web Bot
Anonymous	2026-11-10 11:59:43 UTC · (3 days ago)	apache vulnerability scan	Web App Attack
🇩🇪 klaus_ph	2026-11-10 10:56:05 UTC · (4 days ago)	[Tue Nov 10 11:56:04.743271 2026] [authz_core:error] [pid 1970847] [client 202.8.43.237:56128] AH01630: client denied by server configuration: /home/vufind.net/public_html/robots.txt ...	Bad Web Bot
🇺🇸 TPI-Abuse	2026-11-10 01:41:21 UTC · (4 days ago)	(mod_security) mod_security (id:210730) triggered by 202.8.43.237 (proxy-us000-sa1.ahrefs.net): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 20:41:15.823763 2026] [security2:error] [pid 24415:tid 24415] [clien ... show more (mod_security) mod_security (id:210730) triggered by 202.8.43.237 (proxy-us000-sa1.ahrefs.net): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 20:41:15.823763 2026] [security2:error] [pid 24415:tid 24415] [client 202.8.43.237:55924] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|www.chicagowca.com\|F\|2"] [data ".artadvice.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.chicagowca.com"] [uri "/www.artadvice.com"] [unique_id "avJ2OwBqhAfsZ_F14BJwhwAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 ipblock.com	2026-11-09 17:58:00 UTC · (4 days ago)	IPBlock protected site ID [4678-sl]. Bad agent, site scraper bot.	Bad Web Bot
🇺🇸 TPI-Abuse	2026-11-09 04:08:49 UTC · (5 days ago)	(mod_security) mod_security (id:210730) triggered by 202.8.43.237 (proxy-us000-sa1.ahrefs.net): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 23:08:45.936842 2026] [security2:error] [pid 15458:tid 15458] [clien ... show more (mod_security) mod_security (id:210730) triggered by 202.8.43.237 (proxy-us000-sa1.ahrefs.net): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 23:08:45.936842 2026] [security2:error] [pid 15458:tid 15458] [client 202.8.43.237:35496] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|phantomkennels.com\|F\|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "phantomkennels.com"] [uri "/[email protected]"] [unique_id "avFHTYG8A5EDWf2nEewL2gAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-11-09 01:59:02 UTC · (5 days ago)	(mod_security) mod_security (id:210730) triggered by 202.8.43.237 (proxy-us000-sa1.ahrefs.net): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 20:58:54.244482 2026] [security2:error] [pid 12362:tid 12362] [clien ... show more (mod_security) mod_security (id:210730) triggered by 202.8.43.237 (proxy-us000-sa1.ahrefs.net): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 20:58:54.244482 2026] [security2:error] [pid 12362:tid 12362] [client 202.8.43.237:45294] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|alosi.us\|F\|2"] [data ".bat"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "alosi.us"] [uri "/donna1.bat"] [unique_id "avEo3rHzNG7BPN9LoeOGcQAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 ipblock.com	2026-11-08 18:32:00 UTC · (5 days ago)	IPBlock protected site ID [4678-sl]. Bad agent, site scraper bot.	Bad Web Bot
Anonymous	2026-11-08 09:28:24 UTC · (6 days ago)	apache vulnerability scan	Web App Attack
🇬🇷 setupgr	2026-11-07 19:19:13 UTC · (6 days ago)	(mod_security) mod_security (id:11000010) triggered by 202.8.43.237 (US/United States/Virginia/Sterling/-/[AS140577 Ahrefs Pte Ltd]): 1 in the last 86400 secs (CF_ENABLE); Ports: ; Direction: inout; Trigger: LF_MODSEC; Logs: [Sat Nov 07 21:19:11.414 ... show more (mod_security) mod_security (id:11000010) triggered by 202.8.43.237 (US/United States/Virginia/Sterling/-/[AS140577 Ahrefs Pte Ltd]): 1 in the last 86400 secs (CF_ENABLE); Ports: ; Direction: inout; Trigger: LF_MODSEC; Logs: [Sat Nov 07 21:19:11.414744 2026] [security2:error] [pid 10896:tid 522616] [remote 202.8.43.237:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "AhrefsBot" at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec/modsec2.user.conf"] [line "113"] [id "11000010"] [msg "BLOCKED BOT: AhrefsBot on santoriniicon.com"] [severity "ALERT"] [hostname "santoriniicon.com"] [uri "/robots.txt"] [unique_id "au95rzVCkGhsy_vBCEeYCwADhBs"] show less	Port Scan
🇺🇸 TPI-Abuse	2026-11-07 03:45:55 UTC · (1 week ago)	(mod_security) mod_security (id:210730) triggered by 202.8.43.237 (proxy-us000-sa1.ahrefs.net): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 22:45:51.268650 2026] [security2:error] [pid 25771:tid 25771] [clien ... show more (mod_security) mod_security (id:210730) triggered by 202.8.43.237 (proxy-us000-sa1.ahrefs.net): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 22:45:51.268650 2026] [security2:error] [pid 25771:tid 25771] [client 202.8.43.237:27538] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|www.nationalnova.com\|F\|2"] [data ".db"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.nationalnova.com"] [uri "/images/fly/Thumbs.db"] [unique_id "au6e747UKNtJm_2OXGE8IgAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇨🇭 178.194.85.120

🇮🇳 122.187.221.130

🇳🇱 77.67.26.46

🇺🇸 66.132.186.209

🇺🇸 31.134.10.109

🇬🇧 154.16.44.200

🇧🇷 200.149.51.6

🇳🇱 176.65.148.4

🇮🇳 117.250.250.2

🇮🇹 95.249.217.17

🇺🇸 87.81.233.20

🇺🇸 45.79.190.10

🇺🇸 35.225.56.28

🇳🇱 212.162.153.179

🇫🇮 193.187.151.102

🇫🇷 176.126.104.39

🇷🇴 92.118.39.65

🇺🇸 40.90.227.255

🇨🇳 221.228.203.3

🇳🇱 193.176.31.242