JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 209.227.64.28

209.227.64.28 was found in our database!

This IP was reported 3 times. Confidence of Abuse is 14%: ?

14%

ISP	NTT America, Inc.
Usage Type	Data Center/Web Hosting/Transit
ASN	AS152179
Domain Name	ntt.net
Country	🇺🇸 United States of America
City	Los Angeles, California

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 209.227.64.28

Whois 209.227.64.28

IP Abuse Reports for 209.227.64.28:

This IP address has been reported a total of 3 times from 2 distinct sources. 209.227.64.28 was first reported on September 7th 2026, and the most recent report was 5 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-09-18 19:42:33 (5 hours ago)	(mod_security) mod_security (id:210730) triggered by 209.227.64.28 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210730) triggered by 209.227.64.28 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 18 15:42:24.707204 2026] [security2:error] [pid 31509:tid 31509] [client 209.227.64.28:59031] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|jpkaz.com\|F\|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "jpkaz.com"] [uri "/[email protected]"] [unique_id "aq2UIDRJvMgAIlALFmskPwAAAAs"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-09-13 23:31:54 (5 days ago)	(mod_security) mod_security (id:210730) triggered by 209.227.64.28 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210730) triggered by 209.227.64.28 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 13 19:31:48.157414 2026] [security2:error] [pid 14446:tid 14446] [client 209.227.64.28:48517] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|artfranz.com\|F\|2"] [data ".willowriver3.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "artfranz.com"] [uri "/webdesign/http/:www.willowriver3.com"] [unique_id "aqcyZMZ5EIiv-yZDxfoGFgAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 DrLex0	2026-09-07 09:29:30 (1 week ago)	BnL006: Obvious dumb distributed botnet crawler stepping into honeypot trap, violating robots.txt an ... show more BnL006: Obvious dumb distributed botnet crawler stepping into honeypot trap, violating robots.txt and meta directives 209.227.64.28 443 - [07/Sep/2026:09:29:30 +0000] "GET [redacted] HTTP/1.1" 410 6171 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" show less	Bad Web Bot Exploited Host

Showing 1 to 3 of 3 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇰🇷 211.240.117.75

🇧🇷 205.210.31.252

🇩🇰 185.135.10.235

🇷🇺 145.255.3.4

🇦🇷 104.239.73.169

🇺🇸 50.32.26.35

🇨🇳 39.69.24.62

🇲🇦 196.92.7.247

🇬🇧 193.176.29.17

🇭🇰 165.154.66.193

🇫🇮 147.185.133.43

🇨🇳 117.26.66.174

🇹🇷 95.5.68.195

🇺🇦 93.170.162.110

🇬🇧 35.203.210.220

🇧🇷 205.210.31.182

🇺🇸 195.184.76.172

🇺🇸 192.9.228.120

🇨🇦 174.112.111.244

🇺🇸 173.255.212.137