JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 47.16.96.74

47.16.96.74 was found in our database!

This IP was reported 107 times. Confidence of Abuse is 100%: ?

100%

ISP	Optimum Online (Cablevision Systems)
Usage Type	Fixed Line ISP
ASN	AS6128
Hostname(s)	ool-2f10604a.dyn.optonline.net
Domain Name	optimum.net
Country	🇺🇸 United States of America
City	Syosset, New York

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 47.16.96.74

Whois 47.16.96.74

IP Abuse Reports for 47.16.96.74:

This IP address has been reported a total of 107 times from 81 distinct sources. 47.16.96.74 was first reported on July 28th 2026, and the most recent report was 4 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇨🇭 copestack	2026-07-29 10:00:05 (4 hours ago)	Automated detection: CVE exploit attempt (known vulnerability exploitation). 1 decisions on ov-9acb4 ... show more Automated detection: CVE exploit attempt (known vulnerability exploitation). 1 decisions on ov-9acb4e. show less	Web App Attack
🇺🇸 TPI-Abuse	2026-07-29 08:04:42 (6 hours ago)	(mod_security) mod_security (id:218420) triggered by 47.16.96.74 (ool-2f10604a.dyn.optonline.net): 1 ... show more (mod_security) mod_security (id:218420) triggered by 47.16.96.74 (ool-2f10604a.dyn.optonline.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 29 04:04:37.820776 2026] [security2:error] [pid 14488:tid 14488] [client 47.16.96.74:52604] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)php://(std(in\|out\|err)\|(in\|out)put\|fd\|memory\|temp\|filter)" at ARGS_NAMES:\\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/21_PHP_PHPGen.conf"] [line "22"] [id "218420"] [rev "2"] [msg "COMODO WAF: PHP Injection Attack: I/O Stream Found\|\|192.64.150.106:80\|F\|2"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [tag "CWAF"] [tag "PHPGen"] [hostname "192.64.150.106"] [uri "/hello.world"] [unique_id "amm0FcK_oxxVfhV14lgZowAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack
🇨🇭 altux	2026-07-29 08:00:04 (6 hours ago)	Jul 29 09:59:58 altux6 sshd\[16347\]: Invalid user admin from 47.16.96.74 port 42590 Jul 29 09:59:58 ... show more Jul 29 09:59:58 altux6 sshd\[16347\]: Invalid user admin from 47.16.96.74 port 42590 Jul 29 09:59:58 altux6 sshd\[16347\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=47.16.96.74 Jul 29 10:00:00 altux6 sshd\[16347\]: Failed password for invalid user admin from 47.16.96.74 port 42590 ssh2 ... show less	Brute-Force SSH
🇺🇸 xmission.com	2026-07-29 07:57:51 (7 hours ago)	Blocked by UFW (TCP on 22) Source port: 39225 TTL: 50 Packet length: 40 TOS: 0x08 This report (for ... show more Blocked by UFW (TCP on 22) Source port: 39225 TTL: 50 Packet length: 40 TOS: 0x08 This report (for 47.16.96.74) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan SSH Brute-Force
🇳🇱 i-turnradio.nl	2026-07-29 07:26:03 (7 hours ago)	2026-07-29 @ 09:26:02 (CET) ~ Blocked for trying to access: /hello.world?%ADd+allow_url_include%3d1+ ... show more 2026-07-29 @ 09:26:02 (CET) ~ Blocked for trying to access: /hello.world?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp:/input show less	Web App Attack
🇧🇷 SOC-BR	2026-07-29 07:19:20 (7 hours ago)	Attack detected by Fortinet - apache: Apache.HTTP.Server.cgi-bin.Path.Traversal - 2026-07-28 12:05:2 ... show more Attack detected by Fortinet - apache: Apache.HTTP.Server.cgi-bin.Path.Traversal - 2026-07-28 12:05:27 - Source Port 59342 show less	Port Scan Hacking
🇺🇸 TPI-Abuse	2026-07-29 07:14:09 (7 hours ago)	(mod_security) mod_security (id:218420) triggered by 47.16.96.74 (ool-2f10604a.dyn.optonline.net): 1 ... show more (mod_security) mod_security (id:218420) triggered by 47.16.96.74 (ool-2f10604a.dyn.optonline.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 29 03:14:01.674789 2026] [security2:error] [pid 10706:tid 10706] [client 47.16.96.74:59202] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)php://(std(in\|out\|err)\|(in\|out)put\|fd\|memory\|temp\|filter)" at ARGS_NAMES:\\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/21_PHP_PHPGen.conf"] [line "38"] [id "218420"] [rev "2"] [msg "COMODO WAF: PHP Injection Attack: I/O Stream Found\|\|192.64.150.200:443\|F\|2"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [tag "CWAF"] [tag "PHPGen"] [hostname "192.64.150.200"] [uri "/hello.world"] [unique_id "ammoOZQPMaBa159TDMg5BgAAAAQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇱🇹 NotACaptcha	2026-07-29 06:44:10 (8 hours ago)	Unauthorised access (Jul 29 09:44) SRC=47.16.96.74 LEN=40 TTL=51 ID=23427 TCP DPT=23 WINDOW=65535 SY ... show more Unauthorised access (Jul 29 09:44) SRC=47.16.96.74 LEN=40 TTL=51 ID=23427 TCP DPT=23 WINDOW=65535 SYN show less	Port Scan
🇫🇷 Jager	2026-07-29 06:38:21 (8 hours ago)	Blocked by CrowdSec on homelab for scenario: crowdsecurity/CVE-2017-9841	Brute-Force Port Scan Web App Attack
🇩🇪 NetEye	2026-07-29 06:16:46 (8 hours ago)	SSH brute force login attempt	Brute-Force SSH
🇩🇪 luftwurzel	2026-07-29 06:02:44 (8 hours ago)	2026-07-29T08:02:43.455762+02:00 scharnhorst sshd[1014197]: Invalid user admin from 47.16.96.74 port ... show more 2026-07-29T08:02:43.455762+02:00 scharnhorst sshd[1014197]: Invalid user admin from 47.16.96.74 port 52150 ... show less	Brute-Force SSH
🇩🇪 ghostwarriors	2026-07-29 05:50:31 (9 hours ago)	Webpage scraping	Brute-Force Bad Web Bot Web App Attack
🇲🇳 Public CSIRT/CC of Mongolia	2026-07-29 05:45:56 (9 hours ago)	Honeypot hit: HTTP/1.1 request on 2375 GET /containers/json User-Agent: libredtail-http Accept: / ... show more Honeypot hit: HTTP/1.1 request on 2375 GET /containers/json User-Agent: libredtail-http Accept: /; 2375 [1] TCP show less	Web App Attack
🇺🇸 MPL	2026-07-29 05:40:22 (9 hours ago)	tcp/80 (4 or more attempts)	Port Scan
🇷🇴 SpamStopper	2026-07-29 05:37:46 (9 hours ago)	Fail2Ban - WordPress Bruteforce and Badbots	Hacking Bad Web Bot

Showing 1 to 15 of 107 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇳🇱 192.142.28.77

🇸🇬 157.230.242.55

🇺🇸 91.230.168.35

🇺🇸 23.247.177.46

🇺🇸 2607:f8b0:4004:1009::128

🇳🇱 204.76.203.49

🇹🇭 203.170.192.251

🇧🇪 198.235.24.215

🇨🇳 171.35.128.233

🇺🇸 157.245.95.29

🇭🇰 152.32.135.228

🇺🇸 146.190.41.214

🇺🇸 136.66.143.67

🇺🇸 135.237.125.132

🇨🇳 117.72.212.5

🇫🇷 91.231.89.138

🇮🇳 68.183.85.15

🇺🇸 66.132.172.180

🇲🇾 47.250.81.6

🇲🇽 46.250.169.218