JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 213.204.127.6

213.204.127.6 was found in our database!

This IP was reported 159 times. Confidence of Abuse is 46%: ?

46%

ISP	TerraNet sal
Usage Type	Fixed Line ISP
ASN	AS39010
Domain Name	terra.net.lb
Country	🇱🇧 Lebanon
City	Beirut, Beirut

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 213.204.127.6

Whois 213.204.127.6

IP Abuse Reports for 213.204.127.6:

This IP address has been reported a total of 159 times from 46 distinct sources. 213.204.127.6 was first reported on December 9th 2024, and the most recent report was 8 minutes ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 pixelmemory.us	2026-07-01 03:04:34 (8 minutes ago)	2026-07-01T03:03:24 213.204.127.6 GET /Photos/Outdoors/2020-06-13%20Kenedy%20Meadows/raw/DSC03436.AR ... show more 2026-07-01T03:03:24 213.204.127.6 GET /Photos/Outdoors/2020-06-13%20Kenedy%20Meadows/raw/DSC03436.ARW Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 ... show less	Bad Web Bot
🇺🇸 Hmorrin	2026-06-30 00:16:28 (1 day ago)		Port Scan
🇫🇷 SpaceHost-Server	2026-06-29 22:38:48 (1 day ago)		Brute-Force Web App Attack
Anonymous	2026-06-29 21:23:25 (1 day ago)	Fail2Ban triggered	Web App Attack
🇺🇸 Hmorrin	2026-06-28 02:16:38 (3 days ago)		Port Scan
🇮🇹 www.tana.it	2026-06-22 15:59:12 (1 week ago)	PHP scan	Web App Attack
🇺🇸 TPI-Abuse	2026-06-12 06:34:00 (2 weeks ago)	(mod_security) mod_security (id:210730) triggered by 213.204.127.6 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210730) triggered by 213.204.127.6 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 12 02:33:55.883462 2026] [security2:error] [pid 18926:tid 18987] [client 213.204.127.6:32428] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|www.jean-paullederer.com\|F\|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.jean-paullederer.com"] [uri "/[email protected]"] [unique_id "aiuoUyZvKBzZYgUaZG2LyAAAAZI"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-06-10 21:58:17 (2 weeks ago)	Malicious activity detected	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-05-30 21:51:23 (1 month ago)	(mod_security) mod_security (id:210730) triggered by 213.204.127.6 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210730) triggered by 213.204.127.6 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 30 17:51:18.747111 2026] [security2:error] [pid 11128:tid 11128] [client 213.204.127.6:29398] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|www.nwarchitect.com\|F\|2"] [data ".digitalkora.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.nwarchitect.com"] [uri "/www.digitalkora.com"] [unique_id "ahtb1nrDxQkTHEwoNKjZlwAAABc"] show less	Brute-Force Bad Web Bot Web App Attack
🇯🇵 Short-legs-Spider	2026-05-18 19:48:57 (1 month ago)	Persistent request -- [19/May/2026:04:48:57 +0900] "GET /==d.cgi?== HTTP/1.1" 403 76 "-" "Mozilla/ ... show more Persistent request -- [19/May/2026:04:48:57 +0900] "GET /==d.cgi?== HTTP/1.1" 403 76 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36" show less	Bad Web Bot
🇨🇦 DRI	2026-05-14 06:50:37 (1 month ago)	Unsolicited TCP traffic on Honeypot, srcport=51808 dstport=80	Port Scan Hacking
🇺🇸 TPI-Abuse	2026-05-09 01:02:47 (1 month ago)	(mod_security) mod_security (id:949110) triggered by 213.204.127.6 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:949110) triggered by 213.204.127.6 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 08 21:02:44.014302 2026] [security2:error] [pid 26568:tid 26568] [client 213.204.127.6:17392] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.sunstrongmetal.com"] [uri "/files/templateArtifacts.js"] [unique_id "af6HtHXM4-OWPi4our3WCQAAAAo"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-03 20:19:08 (1 month ago)	(mod_security) mod_security (id:210730) triggered by 213.204.127.6 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210730) triggered by 213.204.127.6 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 03 16:19:01.036804 2026] [security2:error] [pid 9520:tid 9520] [client 213.204.127.6:25054] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|frightlibrary.org\|F\|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "frightlibrary.org"] [uri "/citizen/ontarioplace.com"] [unique_id "afettZWn437cqtr1xY8ALAAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-02 16:42:40 (1 month ago)	(mod_security) mod_security (id:210730) triggered by 213.204.127.6 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210730) triggered by 213.204.127.6 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 02 12:42:31.918375 2026] [security2:error] [pid 10197:tid 10197] [client 213.204.127.6:27988] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|comics.flyingdodostudio.com\|F\|2"] [data ".tumblr.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "comics.flyingdodostudio.com"] [uri "/harrowingtalesatthebusstop/inkyphalangies.tumblr.com"] [unique_id "afYpd3j-b0VKatSKYu5CswAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-04-15 20:14:24 (2 months ago)	Web App Attack, Hacking	Hacking Web App Attack

Showing 1 to 15 of 159 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇳🇱 195.178.110.232

🇨🇴 186.85.240.118

🇸🇬 161.118.221.77

🇮🇳 135.235.138.254

🇧🇷 118.26.105.116

🇮🇩 103.168.135.187

🇺🇸 71.6.134.237

🇧🇪 198.235.24.239

🇺🇸 135.119.239.50

🇵🇭 113.19.183.124

🇨🇳 106.227.75.197

🇳🇱 94.249.225.251

🇺🇸 69.74.29.21

🇺🇸 66.240.236.116

🇺🇸 65.181.111.175

🇨🇳 60.23.232.220

🇸🇬 47.236.138.49

🇳🇱 45.198.224.46

🇺🇸 45.136.27.97

🇮🇪 34.242.164.218