JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 23.191.200.114

23.191.200.114 was found in our database!

This IP was reported 36 times. Confidence of Abuse is 54%: ?

54%

This address is a Tor exit node. Neither the owner nor the provider are directly behind the offending action.

ISP	Unredacted Inc
Usage Type	Data Center/Web Hosting/Transit
ASN	AS401401
Domain Name	unredacted.org
Country	🇺🇸 United States of America
City	Kansas City, Missouri

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 23.191.200.114

Whois 23.191.200.114

IP Abuse Reports for 23.191.200.114:

This IP address has been reported a total of 36 times from 19 distinct sources. 23.191.200.114 was first reported on March 25th 2026, and the most recent report was 1 day ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇧🇷 ICS Labs	2026-07-16 01:08:33 (1 day ago)	ICS Labs identified 23.191.200.114 as a malicious indicator from threat intelligence.	Hacking
🇺🇸 juguemosalacarioca.com	2026-07-15 16:23:51 (1 day ago)	Multiple HTTP calls attempting to GET resources using common/malformed API calls or formats on port ... show more Multiple HTTP calls attempting to GET resources using common/malformed API calls or formats on port 8080 show less	Web App Attack
🇫🇷 dynamix	2026-07-15 15:16:36 (1 day ago)	WordPress XMLRPC Brute Force Attack	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-07-15 05:14:38 (2 days ago)	(mod_security) mod_security (id:210831) triggered by 23.191.200.114 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210831) triggered by 23.191.200.114 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 15 01:14:33.480627 2026] [security2:error] [pid 4183:tid 4183] [client 23.191.200.114:52572] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.waterarchitecture.com\|F\|4"] [data "panscient.com"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.waterarchitecture.com"] [uri "/"] [unique_id "alcXOQI_fPA_1fM9o8CJIgAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 ger-stg-sifi1	2026-07-14 23:11:07 (2 days ago)	(wordpress) Failed wordpress login using wp-login.php or xmlrpc.php	Web App Attack
🇺🇸 oncord	2026-07-14 19:19:07 (2 days ago)	Form spam	Web Spam
🇺🇸 TPI-Abuse	2026-07-13 12:16:44 (4 days ago)	(mod_security) mod_security (id:240335) triggered by 23.191.200.114 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:240335) triggered by 23.191.200.114 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 13 08:16:40.429900 2026] [security2:error] [pid 1611821:tid 1611821] [client 23.191.200.114:32384] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 23.191.200.114 (+1 hits since last alert)\|barkatthemoonpetsitting.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "barkatthemoonpetsitting.com"] [uri "/xmlrpc.php"] [unique_id "alTXKHqXC5etKhggsjOm-QAAABU"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 sernate	2026-07-07 12:50:59 (1 week ago)	(XMLRPC) WP XMLPRC Attack 23.191.200.114 (US/United States/-): 5 in the last 3600 secs; Ports: ; Di ... show more (XMLRPC) WP XMLPRC Attack 23.191.200.114 (US/United States/-): 5 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_CUSTOMTRIGGER show less	Brute-Force
🇫🇷 dynamix	2026-06-24 05:52:11 (3 weeks ago)	Multiple WAF Violations	Web App Attack
🇩🇪 iGroupware	2026-06-15 15:15:23 (1 month ago)	Suspicious signup pattern	Web App Attack
🇩🇪 ger-stg-sifi1	2026-06-06 10:39:58 (1 month ago)	(wordpress) Failed wordpress login using wp-login.php or xmlrpc.php	Web App Attack
🇺🇸 TPI-Abuse	2026-06-03 00:27:39 (1 month ago)	(mod_security) mod_security (id:210492) triggered by 23.191.200.114 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 23.191.200.114 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 02 20:27:30.820513 2026] [security2:error] [pid 6651:tid 6665] [client 23.191.200.114:17722] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.planmytrust.com"] [uri "/.git/config"] [unique_id "ah908qM8VPTylZqSzuhuJgAAAAc"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 ✨	2026-06-02 00:43:11 (1 month ago)	Rule : PLESK BOT 2026-06-02 02:41:56 Unauthorized login attempt to Plesk Panel from IP 23.191.200.11 ... show more Rule : PLESK BOT 2026-06-02 02:41:56 Unauthorized login attempt to Plesk Panel from IP 23.191.200.114 with username admin show less	Hacking Brute-Force Web App Attack
🇧🇪 cmbplf	2026-06-01 11:02:33 (1 month ago)	659 limiting connections by zone (14m59s)	DDoS Attack
🇫🇷 dynamix	2026-05-31 20:12:00 (1 month ago)	WordPress XMLRPC Brute Force Attack	Brute-Force Web App Attack

Showing 1 to 15 of 36 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇳 113.201.65.26

🇮🇳 103.176.255.195

🇳🇱 91.148.245.81

🇧🇪 198.235.24.247

🇺🇸 151.247.65.231

🇮🇳 103.55.89.5

🇮🇱 82.102.149.88

🇳🇱 45.148.10.152

🇷🇺 212.164.64.118

🇧🇷 177.137.102.138

🇩🇪 167.94.146.45

🇷🇴 151.242.30.210

🇺🇸 64.62.197.177

🇺🇸 34.186.56.200

🇰🇷 211.224.82.142

🇩🇪 185.242.3.226

🇨🇳 60.166.83.71

🇺🇸 54.210.152.179

🇬🇧 45.82.76.131

🇩🇪 43.228.157.10