JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

4.197.150.118

Neutral Activity

Abuse Confidence Score

0% Low Risk

45 reports

33 reporters · latest 9 months ago

ISP: Microsoft Corporation
Usage Type: Data Center/Web Hosting/Transit
ASN: AS8075
Domain Name: microsoft.com
Country: 🇦🇺 Australia
City: Sydney, New South Wales

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

No reports in the last 60 days

4.197.150.118 has been reported 45 times. The most recent report is from 9 months ago.

The full history is preserved below and remains searchable. A 0% score reflects the absence of recent activity, but this is not a guarantee that earlier reports were invalid. Abuse confidence score decays, naturally, over time, when the abusive activity stops.

Abuse Reports

Export reports CSV

Total reports

45 from 33 distinct reporters

First reported

January 14th 2026

Most recent report

9 months ago

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇧🇪 taivas.nl	2026-01-15 05:32:20 UTC · (9 months ago)	Many_bad_calls	Web App Attack
🇺🇸 octageeks.com	2026-01-15 05:06:51 UTC · (9 months ago)	Wordpress malicious attack:[octablocked]	Web App Attack
Anonymous	2026-01-14 19:34:33 UTC · (9 months ago)	Portscan: TCP/80 (4x), TCP/443 (3x)	Port Scan
🇺🇸 agenciahypelab.com.br	2026-01-14 18:44:57 UTC · (9 months ago)	WordPress login brute-force detectado e bloqueado pelo CSF/LFD. Trigger: LF_TRIGGER	Brute-Force SSH
🇺🇸 TPI-Abuse	2026-01-14 18:44:38 UTC · (9 months ago)	(mod_security) mod_security (id:210350) triggered by 4.197.150.118 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jan 14 13:44:32.818419 2026] [security2:error] [pid 13263:tid 13263] [client 4.197.150.118:1539] Mo ... show more (mod_security) mod_security (id:210350) triggered by 4.197.150.118 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jan 14 13:44:32.818419 2026] [security2:error] [pid 13263:tid 13263] [client 4.197.150.118:1539] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|www.creationorevolution.net\|F\|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.creationorevolution.net"] [uri "/wp-content/plugins/apikey/apikey.php.suspected"] [unique_id "aWfkED-o78mYq7YeAfGeaQAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-01-14 17:50:11 UTC · (9 months ago)	(mod_security) mod_security (id:210350) triggered by 4.197.150.118 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jan 14 12:50:05.145451 2026] [security2:error] [pid 8005:tid 8005] [client 4.197.150.118:1168] ModS ... show more (mod_security) mod_security (id:210350) triggered by 4.197.150.118 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jan 14 12:50:05.145451 2026] [security2:error] [pid 8005:tid 8005] [client 4.197.150.118:1168] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|weddingmusicguitar.com\|F\|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "weddingmusicguitar.com"] [uri "/plugins/content/apismtp/apismtp.php"] [unique_id "aWfXTRWS-remHfMqjqlMeQAAABY"] show less	Brute-Force Bad Web Bot Web App Attack
🇨🇿 ddw	2026-01-14 17:43:29 UTC · (9 months ago)	ModSecurity detection - Rules: 913100(Found User-Agent associated with security scanner)	Web App Attack
🇫🇷 mrcrassi	2026-01-14 17:34:15 UTC · (9 months ago)	Triggered Cloudflare WAF (botFight) from AU. Action taken: MANAGED_CHALLENGE Protocol: HTTP/1.1 (GET method) Endpoint: /zdtltotu.php UA: Mozilla/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Ch ... show more Triggered Cloudflare WAF (botFight) from AU. Action taken: MANAGED_CHALLENGE Protocol: HTTP/1.1 (GET method) Endpoint: /zdtltotu.php UA: Mozilla/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36 This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
🇺🇸 TPI-Abuse	2026-01-14 16:52:00 UTC · (9 months ago)	(mod_security) mod_security (id:210350) triggered by 4.197.150.118 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jan 14 11:51:54.284826 2026] [security2:error] [pid 8072:tid 8072] [client 4.197.150.118:1675] ModS ... show more (mod_security) mod_security (id:210350) triggered by 4.197.150.118 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jan 14 11:51:54.284826 2026] [security2:error] [pid 8072:tid 8072] [client 4.197.150.118:1675] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|jfexpressfr8.com\|F\|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "jfexpressfr8.com"] [uri "/wp-content/plugins/apikey/apikey.php.suspected"] [unique_id "aWfJqo1LVsH8oLTraTrjKAAAACI"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 sthoyer.de	2026-01-14 16:44:44 UTC · (9 months ago)	4.197.150.118 - - [14/Jan/2026:17:44:41 +0100] "POST /ALFA_DATA/alfacgiapi/perl.alfa HTTP/1.1" 302 794 "www.google.com" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.1 ... show more 4.197.150.118 - - [14/Jan/2026:17:44:41 +0100] "POST /ALFA_DATA/alfacgiapi/perl.alfa HTTP/1.1" 302 794 "www.google.com" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36" 4.197.150.118 - - [14/Jan/2026:17:44:41 +0100] "GET /wp-content/themes/seotheme/db.php?u HTTP/1.1" 302 794 "www.google.com" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36" 4.197.150.118 - - [14/Jan/2026:17:44:42 +0100] "POST /wp-plain.php HTTP/1.1" 302 794 "www.google.com" "Mozilla/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36" ... show less	Web App Attack
🇪🇸 masterguru	2026-01-14 16:44:03 UTC · (9 months ago)	UA Mozlila denied. Pattern match "(?:mozlila)" at REQUEST_HEADERS:User-Agent. (1040-123)	Bad Web Bot
🇺🇸 TPI-Abuse	2026-01-14 16:34:54 UTC · (9 months ago)	(mod_security) mod_security (id:210350) triggered by 4.197.150.118 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jan 14 11:34:50.752596 2026] [security2:error] [pid 17190:tid 17190] [client 4.197.150.118:1088] Mo ... show more (mod_security) mod_security (id:210350) triggered by 4.197.150.118 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jan 14 11:34:50.752596 2026] [security2:error] [pid 17190:tid 17190] [client 4.197.150.118:1088] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|premierveterinarysurgery.com\|F\|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "premierveterinarysurgery.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "aWfFqlHc9jC3wPT7vDRc4gAAAB4"], referer: www.google.com show less	Brute-Force Bad Web Bot Web App Attack
🇲🇾 Rizzy	2026-01-14 16:14:46 UTC · (9 months ago)	Multiple WAF Violations	Brute-Force Web App Attack
🇿🇦 Tokolosh Hunters	2026-01-14 16:08:50 UTC · (9 months ago)	AutoBlockWindow-Known bad useragent query-2026-01-14 16:08:49	Bad Web Bot
Anonymous	2026-01-14 16:00:30 UTC · (9 months ago)	...	Web App Attack

Showing 1 to 15 of 45 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇺🇸 167.172.154.26

🇬🇧 87.236.176.6

🇫🇷 85.217.140.46

🇲🇾 49.124.148.191

🇳🇱 45.156.87.155

🇳🇱 45.148.10.157

🇺🇸 34.134.40.35

🇳🇱 31.14.32.4

🇧🇷 191.7.159.201

🇺🇸 172.180.64.122

🇺🇸 170.187.145.131

🇮🇳 168.144.116.160

🇺🇸 159.223.175.171

🇺🇸 129.80.115.224

🇨🇳 117.50.46.117

🇩🇪 69.5.169.124

🇬🇧 37.10.113.215

🇬🇧 31.14.254.25

🇫🇷 5.135.39.194

🇮🇳 210.212.1.62