JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 217.195.153.81

217.195.153.81 was found in our database!

This IP was reported 18 times. Confidence of Abuse is 77%: ?

77%

ISP	Shock Hosting LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS395092
Hostname(s)	nl1.shockvpn.net
Domain Name	shockhosting.com
Country	🇳🇱 Netherlands
City	Amsterdam, North Holland

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 217.195.153.81

Whois 217.195.153.81

IP Abuse Reports for 217.195.153.81:

This IP address has been reported a total of 18 times from 13 distinct sources. 217.195.153.81 was first reported on December 21st 2025, and the most recent report was 6 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇮 YF	2026-07-17 20:00:55 (6 hours ago)	xmlrpc.php Potential DDoS or brute force	DDoS Attack Brute-Force
🇪🇸 masterguru	2026-07-17 15:42:58 (10 hours ago)	(xmlrpc) Failed xmlrpc access from 217.195.153.81 (NL/The Netherlands/nl1.shockvpn.net): 5 in the la ... show more (xmlrpc) Failed xmlrpc access from 217.195.153.81 (NL/The Netherlands/nl1.shockvpn.net): 5 in the last 3600 secs (0-122) show less	Hacking
🇦🇺 QT	2026-07-17 01:06:50 (1 day ago)	Unauthorised WordPress admin login attempted at 2026-07-17 11:06:49 +1000	Web App Attack
🇺🇸 TPI-Abuse	2026-07-16 20:54:56 (1 day ago)	(mod_security) mod_security (id:240335) triggered by 217.195.153.81 (nl1.shockvpn.net): 1 in the las ... show more (mod_security) mod_security (id:240335) triggered by 217.195.153.81 (nl1.shockvpn.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 16 16:54:51.457457 2026] [security2:error] [pid 15909:tid 15909] [client 217.195.153.81:57665] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 217.195.153.81 (+1 hits since last alert)\|deborahbein.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "deborahbein.com"] [uri "/xmlrpc.php"] [unique_id "allFG1uszJfCJpYT5yJG9wAAAAs"] show less	Brute-Force Bad Web Bot Web App Attack
🇨🇭 4server	2026-07-16 19:42:51 (1 day ago)	[ThuJul1621:42:48.9790172026][security2:error][pid1072752:tid1072777][client217.195.153.81:0]ModSecu ... show more [ThuJul1621:42:48.9790172026][security2:error][pid1072752:tid1072777][client217.195.153.81:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"368\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"manishimwe.ch\"][uri\"/xmlrpc.php\"][unique_id\"alk0OBaQ-s3CQPOnjXKAxQAAAIw\"] show less	Hacking Web App Attack
🇩🇪 LRob	2026-07-16 16:17:54 (1 day ago)	CrowdSec: crowdsecurity/http-bf-wordpress_bf_xmlrpc \| req: /xmlrpc.php \| UA: WordPress.com; https:// ... show more CrowdSec: crowdsecurity/http-bf-wordpress_bf_xmlrpc \| req: /xmlrpc.php \| UA: WordPress.com; https://wordpress.com show less	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-07-14 22:54:53 (3 days ago)	(mod_security) mod_security (id:240335) triggered by 217.195.153.81 (nl1.shockvpn.net): 1 in the las ... show more (mod_security) mod_security (id:240335) triggered by 217.195.153.81 (nl1.shockvpn.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 14 18:54:48.272183 2026] [security2:error] [pid 8787:tid 8787] [client 217.195.153.81:58635] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 217.195.153.81 (+1 hits since last alert)\|globalsolutions.technology\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "globalsolutions.technology"] [uri "/xmlrpc.php"] [unique_id "ala-OJdJMOhb-AvaWAqxIQAAAAo"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 Petros Stefanakis	2026-07-14 21:59:26 (3 days ago)	(wordpress) Failed wordpress login from 217.195.153.81 (nl1.shockvpn.net)	Brute-Force
🇺🇸 TPI-Abuse	2026-07-14 20:57:06 (3 days ago)	(mod_security) mod_security (id:240335) triggered by 217.195.153.81 (nl1.shockvpn.net): 1 in the las ... show more (mod_security) mod_security (id:240335) triggered by 217.195.153.81 (nl1.shockvpn.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 14 16:57:03.028414 2026] [security2:error] [pid 29638:tid 29638] [client 217.195.153.81:52556] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 217.195.153.81 (+1 hits since last alert)\|jimrichardart.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "jimrichardart.com"] [uri "/xmlrpc.php"] [unique_id "alain9AaP2lXmEmF6MpuMQAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 masterguru	2026-07-14 20:55:07 (3 days ago)	xmlrpc request blocked, no referer. Pattern match "xmlrpc.php" at REQUEST_URI. (88010-201)	Hacking
🇺🇸 TPI-Abuse	2026-07-14 19:01:44 (3 days ago)	(mod_security) mod_security (id:240335) triggered by 217.195.153.81 (nl1.shockvpn.net): 1 in the las ... show more (mod_security) mod_security (id:240335) triggered by 217.195.153.81 (nl1.shockvpn.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 14 15:01:38.267112 2026] [security2:error] [pid 9036:tid 9036] [client 217.195.153.81:51297] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 217.195.153.81 (+1 hits since last alert)\|loneoakhoney.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "loneoakhoney.com"] [uri "/xmlrpc.php"] [unique_id "alaHkl-MyuQ7WeAumpNNzwAAAAc"] show less	Brute-Force Bad Web Bot Web App Attack
🇧🇪 madeit	2026-07-14 17:41:47 (3 days ago)		Web App Attack
🇬🇧 Apache	2026-07-14 16:21:33 (3 days ago)	(mod_security) mod_security (id:240335) triggered by 217.195.153.81 (nl1.shockvpn.net): 5 in the las ... show more (mod_security) mod_security (id:240335) triggered by 217.195.153.81 (nl1.shockvpn.net): 5 in the last 300 secs show less	Brute-Force Web App Attack
🇧🇪 cmbplf	2026-07-13 23:10:29 (4 days ago)	7.598 requests with url.path */xmlrpc.php	Brute-Force Bad Web Bot
🇩🇪 Séfora Srl	2026-07-13 22:03:08 (4 days ago)	Failed attempt detected by Fail2Ban in plesk-modsecurity jail	Web App Attack

Showing 1 to 15 of 18 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇸🇬 198.38.91.219

🇳🇱 195.178.110.137

🇳🇱 176.65.149.31

🇩🇪 162.158.95.12

🇮🇳 139.59.30.74

🇨🇳 112.254.13.99

🇺🇸 68.160.176.9

🇺🇸 65.49.1.74

🇺🇸 65.49.1.68

🇺🇸 64.62.156.52

🇧🇷 45.185.194.141

🇺🇸 13.86.112.154

🇮🇹 2.33.239.68

🇺🇸 2600:1f18:3120:f503:a89e:e784:3fa:a57b

🇻🇪 200.75.128.217

🇳🇱 194.26.192.146

🇳🇱 185.223.235.55

🇩🇪 185.183.181.2

🇺🇸 173.255.243.63

🇲🇾 149.118.135.252