JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 217.113.30.165

217.113.30.165 was found in our database!

This IP was reported 14 times. Confidence of Abuse is 19%: ?

19%

ISP	LIR LLC
Usage Type	Fixed Line ISP
ASN	AS42991
Domain Name	lir.am
Country	🇦🇲 Armenia
City	Yerevan, Yerevan

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 217.113.30.165

Whois 217.113.30.165

IP Abuse Reports for 217.113.30.165:

This IP address has been reported a total of 14 times from 13 distinct sources. 217.113.30.165 was first reported on May 23rd 2025, and the most recent report was 2 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-07-20 14:53:03 (2 days ago)	(mod_security) mod_security (id:240335) triggered by 217.113.30.165 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:240335) triggered by 217.113.30.165 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 20 10:52:57.851840 2026] [security2:error] [pid 21040:tid 21040] [client 217.113.30.165:49830] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 217.113.30.165 (+1 hits since last alert)\|integrabroadcast.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "integrabroadcast.com"] [uri "/xmlrpc.php"] [unique_id "al42SVQDNJ4ibXh4sxnUBQAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 dynamix	2026-06-17 13:14:48 (1 month ago)	WordPress XMLRPC Brute Force Attack	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-06-17 08:44:25 (1 month ago)	(mod_security) mod_security (id:240335) triggered by 217.113.30.165 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:240335) triggered by 217.113.30.165 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 17 04:44:19.679821 2026] [security2:error] [pid 11445:tid 11445] [client 217.113.30.165:52876] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 217.113.30.165 (+1 hits since last alert)\|esysapps.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "esysapps.com"] [uri "/xmlrpc.php"] [unique_id "ajJeY1SfUNq1rwhAxEkDLAAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 grassau.com	2026-06-11 15:20:17 (1 month ago)	(wordpress) Failed wordpress login from 217.113.30.165 (AM/Armenia/Yerevan/Yerevan/-)	Brute-Force
🇳🇱 soverin	2026-05-25 11:07:05 (1 month ago)	spam	Email Spam
🇳🇱 Cloud86 B.V.	2026-04-09 07:39:11 (3 months ago)	categories: Email Spam	Email Spam
🇬🇧 djboddington	2026-04-09 06:25:12 (3 months ago)	This IP was detected by CrowdSec triggering crowdsecurity/postfix-dnsblog	Email Spam Exploited Host
🇨🇿 interconnect.cz	2026-04-08 09:29:27 (3 months ago)	[08/Apr/2026 11:29:26] IP address 217.113.30.165 found in DNS blacklist SpamHaus SBL-XBL, mail from ... show more [08/Apr/2026 11:29:26] IP address 217.113.30.165 found in DNS blacklist SpamHaus SBL-XBL, mail from <[email protected]> to <[email protected]> [08/Apr/2026 11:29:26] IP address 217.113.30.165 found in DNS blacklist SpamHaus SBL-XBL, mail from <[email protected]> to <[email protected]> [08/Apr/2026 11:29:26] Attempt to deliver to unknown recipient <[email protected]>, from <[email protected]>, IP address 217.113.30.165 ... show less	Brute-Force Email Spam
🇮🇩 hermawan	2026-04-02 05:06:56 (3 months ago)	04/02/2026-12:06:50.953604 [Drop] [] [1:2100000534:0] Suricata match TLS JA4 scan Uniq Zeek no 53 ... show more 04/02/2026-12:06:50.953604 [Drop] [] [1:2100000534:0] Suricata match TLS JA4 scan Uniq Zeek no 534 with hash_t13d4412h1_fd39b124ee10_58ed7828516f [**] [Classification: (null)] [Priority: 3] {TCP} 217.113.30.165:38192 -> 103.166.156.58:443 ... show less	Email Spam Hacking
🇳🇱 exxos	2025-09-16 11:08:03 (10 months ago)	Attacks with Bad user agents	Hacking
🇺🇸 LARL-Stompro-2024	2025-07-06 07:01:45 (1 year ago)	Evergreen ILS - Mylist Bot Abuse - HTTP Port 443 - Fake UserAgent. Requests:1	Bad Web Bot
🇳🇱 Study Bitcoin 🤗	2025-06-08 16:15:30 (1 year ago)	2 port probes: 2x tcp/445 (smb) [gda]	Port Scan Hacking
🇺🇸 creations.works	2025-06-08 12:06:47 (1 year ago)	Blocked by UFW on vds [445/tcp] Source port: 52173 TTL: 120 Packet length: 52 TOS: 0x00 This report ... show more Blocked by UFW on vds [445/tcp] Source port: 52173 TTL: 120 Packet length: 52 TOS: 0x00 This report was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan Hacking Brute-Force
🇩🇪 stalker.to	2025-05-23 08:59:49 (1 year ago)	Datacenter Proxy	Web Spam

Showing 1 to 14 of 14 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇮🇩 163.7.4.169

🇨🇳 114.250.44.55

🇺🇸 91.247.163.155

🇲🇽 189.161.43.93

🇳🇱 174.138.5.239

🇫🇮 45.154.244.222

🇺🇸 44.220.188.168

🇮🇩 163.7.6.74

🇳🇮 161.0.60.2

🇺🇸 154.6.116.21

🇨🇳 114.250.50.67

🇯🇵 103.143.72.165

🇮🇹 95.246.254.108

🇨🇭 62.169.136.79

🇻🇳 14.224.213.222

🇻🇳 14.161.167.85

🇰🇿 5.34.56.211

🇲🇦 197.153.68.108

🇦🇷 181.116.220.27

🇲🇾 172.197.168.125