JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 41.143.49.18

41.143.49.18 was found in our database!

This IP was reported 37 times. Confidence of Abuse is 88%: ?

88%

ISP	ADSL_Maroc_telecom
Usage Type	Fixed Line ISP
ASN	AS36903
Domain Name	menara.ma
Country	🇲🇦 Morocco
City	Marrakesh, Marrakesh-Safi

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 41.143.49.18

Whois 41.143.49.18

IP Abuse Reports for 41.143.49.18:

This IP address has been reported a total of 37 times from 27 distinct sources. 41.143.49.18 was first reported on May 18th 2026, and the most recent report was 2 weeks ago.

Old Reports: The most recent abuse report for this IP address is from 2 weeks ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 octageeks.com	2026-05-19 04:07:57 (2 weeks ago)	Wordpress malicious attack:[octablocked]	Web App Attack
🇹🇭 MWA SOC	2026-05-18 21:33:52 (2 weeks ago)		Hacking
🇫🇷 MatStef132	2026-05-18 20:49:49 (2 weeks ago)	MatShield L7: blocked on mathost.eu (chrome-ua-hint-missing)	DDoS Attack
🇺🇸 TPI-Abuse	2026-05-18 19:35:53 (2 weeks ago)	(mod_security) mod_security (id:210492) triggered by 41.143.49.18 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 41.143.49.18 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 18 15:35:48.351363 2026] [security2:error] [pid 7561:tid 7665] [client 41.143.49.18:54927] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "securitymediaservices.com"] [uri "/.env"] [unique_id "agtqFEzAUxTJhkMYThQagwAAARE"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 ghostwarriors	2026-05-18 19:20:04 (2 weeks ago)	Webpage scraping	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-05-18 19:18:33 (2 weeks ago)	[Firewall Canary] Temporary ban due to firewall rule match [URI:*/.env]	Web App Attack
🇩🇪 tinect	2026-05-18 18:52:26 (2 weeks ago)	This IP was detected by CrowdSec triggering tinect/http-sensitive-file-probe	Web App Attack
🇺🇸 TPI-Abuse	2026-05-18 18:47:40 (2 weeks ago)	(mod_security) mod_security (id:210492) triggered by 41.143.49.18 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 41.143.49.18 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 18 14:47:32.322359 2026] [security2:error] [pid 8561:tid 8561] [client 41.143.49.18:52323] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rcjlawfirm.com"] [uri "/.env"] [unique_id "agtexMSxwMJLpYb6ltfj5AAAABc"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 psauxit	2026-05-18 18:32:17 (2 weeks ago)	Fail2Ban - NGINX bad requests 400-401-403-404-444, high level vulnerability scanning, commonly xmlrp ... show more Fail2Ban - NGINX bad requests 400-401-403-404-444, high level vulnerability scanning, commonly xmlrpc_attack, wp-login brute force, excessive crawling/scraping show less	Web App Attack Hacking
🇮🇩 Burayot	2026-05-18 18:14:31 (2 weeks ago)	LF_MODSEC: (mod_security) mod_security (id:949110) triggered by 41.143.49.18 (MA/Morocco/-): 2 in th ... show more LF_MODSEC: (mod_security) mod_security (id:949110) triggered by 41.143.49.18 (MA/Morocco/-): 2 in the last 3600 secs show less	Web App Attack
🇺🇸 graphics-muse.org	2026-05-18 18:07:36 (2 weeks ago)	[Mon May 18 12:07:35.503283 2026] [php7:error] [pid 3335056:tid 3335056] [client 41.143.49.18:62846] ... show more [Mon May 18 12:07:35.503283 2026] [php7:error] [pid 3335056:tid 3335056] [client 41.143.49.18:62846] script '/home/httpd/piboxproject/test.php' not found or unable to stat [Mon May 18 12:07:35.506132 2026] [php7:error] [pid 3335059:tid 3335059] [client 41.143.49.18:62848] script '/home/httpd/piboxproject/info.php' not found or unable to stat [Mon May 18 12:07:35.506392 2026] [php7:error] [pid 3334662:tid 3334662] [client 41.143.49.18:51610] script '/home/httpd/piboxproject/phpinfo.php' not found or unable to stat [Mon May 18 12:07:35.678888 2026] [php7:error] [pid 3335056:tid 3335056] [client 41.143.49.18:62846] script '/home/httpd/piboxproject/info.php' not found or unable to stat, referer: http://piboxproject.com/info.php [Mon May 18 12:07:35.678974 2026] [php7:error] [pid 3335059:tid 3335059] [client 41.143.49.18:62848] script '/home/httpd/piboxproject/phpinfo.php' not found or unable to stat, referer: http://piboxproject.com/phpinfo.php [Mon May 18 12:07:36.080002 2026] [php7:error ... show less	Brute-Force Web App Attack
Anonymous	2026-05-18 18:06:07 (2 weeks ago)	Blocked: Reason='Suspicious traffic score=100 (review-based detection)'; Requests=12	Hacking
🇷🇺 Mga Admin	2026-05-18 18:05:10 (2 weeks ago)	41.143.49.18 - - [19/May/2026:01:05:09 +0700] "GET /test.php HTTP/1.1" 404 69 "-" "Mozilla/5.0 (X11; ... show more 41.143.49.18 - - [19/May/2026:01:05:09 +0700] "GET /test.php HTTP/1.1" 404 69 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/124.0.0.0 Safari/537.36" ... show less	Web App Attack
🇺🇸 TPI-Abuse	2026-05-18 17:50:56 (2 weeks ago)	(mod_security) mod_security (id:210492) triggered by 41.143.49.18 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 41.143.49.18 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 18 13:50:51.399884 2026] [security2:error] [pid 23137:tid 23137] [client 41.143.49.18:55773] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "panmaneecnc.com"] [uri "/.env"] [unique_id "agtRe3lL5U52J1ExnkOi6wAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-18 17:16:11 (2 weeks ago)	(mod_security) mod_security (id:210492) triggered by 41.143.49.18 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 41.143.49.18 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 18 13:16:07.451759 2026] [security2:error] [pid 6802:tid 6802] [client 41.143.49.18:64084] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "notepromd.com"] [uri "/.env"] [unique_id "agtJV71fRH9UwH45nm6flwAAABQ"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 37 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇬🇧 104.248.161.154

🇳🇱 92.63.197.5

🇺🇸 66.154.118.5

🇺🇸 47.205.237.24

🇸🇪 45.84.107.33

🇨🇦 178.93.200.184

🇧🇷 177.158.216.200

🇩🇪 92.113.16.50

🇬🇧 89.37.172.150

🇬🇧 81.19.219.244

🇲🇾 47.250.52.227

🇳🇱 45.148.10.183

🇬🇧 31.14.254.71

🇬🇧 5.226.140.109

🇷🇴 2.57.121.112

🇨🇳 220.205.123.19

🇩🇪 195.230.103.248

🇷🇺 188.242.54.195

🇫🇷 185.177.72.11

🇺🇸 184.105.139.108