AbuseIPDB » 48.211.216.181

48.211.216.181 was found in our database!

This IP was reported 76 times. Confidence of Abuse is 65%: ?

65%

ISP	Microsoft Limited
Usage Type	Data Center/Web Hosting/Transit
Domain Name	microsoft.com
Country	United States of America
City	Boydton, Virginia

Report 48.211.216.181

Whois 48.211.216.181

IP Abuse Reports for 48.211.216.181:

This IP address has been reported a total of 76 times from 30 distinct sources. 48.211.216.181 was first reported on October 22nd 2024, and the most recent report was 3 weeks ago.

Old Reports: The most recent abuse report for this IP address is from 3 weeks ago. It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp in UTC	Comment	Categories
DJ	2024-11-11 17:55:00 (3 weeks ago)	major hacking attempt	DDoS Attack Hacking SQL Injection Brute-Force Exploited Host Web App Attack
DJ	2024-11-11 00:47:00 (3 weeks ago)	hacking	Hacking SQL Injection Brute-Force Exploited Host Web App Attack
Burayot	2024-11-10 22:48:54 (3 weeks ago)	LF_MODSEC: (mod_security) mod_security (id:949110) triggered by 48.211.216.181 (US/United States/-): ... show moreLF_MODSEC: (mod_security) mod_security (id:949110) triggered by 48.211.216.181 (US/United States/-): 2 in the last 3600 secs show less	Web App Attack
[email protected]	2024-11-10 00:34:30 (4 weeks ago)	Attempts to find pages that do not exist on website.	Web App Attack
MAGIC	2024-11-09 22:08:03 (4 weeks ago)	VM1 Bad user agents ignoring web crawling rules. Draing bandwidth	DDoS Attack Bad Web Bot
Anonymous	2024-11-09 18:38:11 (4 weeks ago)	Trolling and Banned:CE	Hacking Web App Attack
london2038.com	2024-11-09 16:20:16 (4 weeks ago)	Malformed or malicious web request 48.211.216.181 - - [09/Nov/2024:17:20:12 +0100] "GET /index ... show moreMalformed or malicious web request 48.211.216.181 - - [09/Nov/2024:17:20:12 +0100] "GET /index.php?pageuntil=Moyer%27s+Resource&title=Category%3AUnique_Items&title=%2527 HTTP/1.1" 400 9143 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" show less	Hacking Web App Attack
AvonleaConsulting	2024-11-08 00:02:09 (1 month ago)	Brute force attack stopped by firewall	Web Spam Brute-Force Web App Attack
octageeks.com	2024-11-07 05:06:03 (1 month ago)	Wordpress malicious attack:[octablocked]	Web App Attack
exxos	2024-11-07 02:56:49 (1 month ago)	web exploit attacks	Web App Attack
el-brujo	2024-11-07 02:25:37 (1 month ago)	Cloudflare WAF: Request Path: /.env Request Query: Host: hwagm.elhacker.net userAgent: Mozilla/5.0 ... show moreCloudflare WAF: Request Path: /.env Request Query: Host: hwagm.elhacker.net userAgent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 Action: block Source: firewallManaged ASN Description: MICROSOFT-CORP-MSN-AS-BLOCK Country: US Method: GET Timestamp: 2024-11-07T02:25:37Z ruleId: 23548ee2b36547a1be09bb2c0550c529. Report generated by Cloudflare-WAF-to-AbuseIPDB (https://github.com/MHG-LAB/Cloudflare-WAF-to-AbuseIPDB). show less	Hacking SQL Injection Web App Attack
[email protected]	2024-11-07 01:24:19 (1 month ago)	Attempts to find pages that do not exist on website.	Web App Attack
TPI-Abuse	2024-11-07 01:05:46 (1 month ago)	(mod_security) mod_security (id:210492) triggered by 48.211.216.181 (-): 1 in the last 300 secs; Por ... show more(mod_security) mod_security (id:210492) triggered by 48.211.216.181 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 06 20:05:41.040284 2024] [security2:error] [pid 10701:tid 10701] [client 48.211.216.181:63850] [client 48.211.216.181] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.writebetweenthelines.com"] [uri "/.env"] [unique_id "ZywSZSDu55fKyyMCf1jgbAAAAAc"] show less	Brute-Force Bad Web Bot Web App Attack
rafled	2024-11-06 23:27:17 (1 month ago)	attempt to scan and scrape for env files and or files that expose the web app version	Bad Web Bot
TPI-Abuse	2024-11-06 23:13:10 (1 month ago)	(mod_security) mod_security (id:210492) triggered by 48.211.216.181 (-): 1 in the last 300 secs; Por ... show more(mod_security) mod_security (id:210492) triggered by 48.211.216.181 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 06 18:13:04.989937 2024] [security2:error] [pid 20161:tid 20161] [client 48.211.216.181:53083] [client 48.211.216.181] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.legalnexuslawfirm.com"] [uri "/.env"] [unique_id "Zyv4AAAEveOBYTfdY90iHQAAABA"] show less	Brute-Force Bad Web Bot Web App Attack