JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 64.112.57.173

64.112.57.173 was found in our database!

This IP was reported 15 times. Confidence of Abuse is 66%: ?

66%

ISP	Nexus Bytes LLC
Usage Type	Fixed Line ISP
ASN	AS6079
Domain Name	nexusbytes.com
Country	🇺🇸 United States of America
City	Leesburg, Virginia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 64.112.57.173

Whois 64.112.57.173

IP Abuse Reports for 64.112.57.173:

This IP address has been reported a total of 15 times from 11 distinct sources. 64.112.57.173 was first reported on July 8th 2026, and the most recent report was 13 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 ipblock.com	2026-07-10 18:56:00 (13 hours ago)	IPBlock protected site ID [4055-d][s=02]. Persistent 404, vulnerability scanner	Hacking Bad Web Bot Web App Attack
Anonymous	2026-07-10 16:11:05 (16 hours ago)	[10/Jul/2026:19:10:30 +0300] 178369983063.722709 64.112.57.173 38093 148.251.76.218 443 [10/Jul/2026 ... show more [10/Jul/2026:19:10:30 +0300] 178369983063.722709 64.112.57.173 38093 148.251.76.218 443 [10/Jul/2026:19:11:04 +0300] 178369986414.697849 64.112.57.173 41931 148.251.76.218 443 show less	Web App Attack
🇺🇸 TPI-Abuse	2026-07-10 02:44:04 (1 day ago)	(mod_security) mod_security (id:210492) triggered by 64.112.57.173 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 64.112.57.173 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 09 22:43:43.964010 2026] [security2:error] [pid 21057:tid 21057] [client 64.112.57.173:47849] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.10bestcountryclubs.com"] [uri "/.env.dev"] [unique_id "alBcX74qvrQUv8ONMHz5zQAAABc"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇰 ScamAware	2026-07-09 22:35:49 (1 day ago)	Detected by Cloudflare Security Events via WordPress automation. Detection: sensitive_files (Sensiti ... show more Detected by Cloudflare Security Events via WordPress automation. Detection: sensitive_files (Sensitive files, source control, config, and backups). Hits from same IP in last 60 minutes: 2. Unique request paths counted internally: 2. Cloudflare action: block. Cloudflare source: firewallCustom. show less	Web App Attack
🇺🇸 ipblock.com	2026-07-09 20:15:00 (1 day ago)	IPBlock protected site ID [4055-d][s=01]. Persistent 404, vulnerability scanner	Hacking Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-09 15:25:16 (1 day ago)	(mod_security) mod_security (id:210492) triggered by 64.112.57.173 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 64.112.57.173 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 09 11:24:55.479902 2026] [security2:error] [pid 8236:tid 8236] [client 64.112.57.173:50965] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.albertmassaad.com"] [uri "/.env.dev"] [unique_id "ak-9R5fyQjC1kVOypt8dQwAAABE"] show less	Brute-Force Bad Web Bot Web App Attack
🇦🇺 paulshipley.com.au	2026-07-09 10:47:25 (1 day ago)	[Thu Jul 09 20:47:24.125627 2026] [security2:error] [pid 502194] [client 64.112.57.173:52359] [clien ... show more [Thu Jul 09 20:47:24.125627 2026] [security2:error] [pid 502194] [client 64.112.57.173:52359] [client 64.112.57.173] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "valueaddedpromotions.com.au"] [uri "/promo/www/product/productlist.php"] [unique_id "ak98PMBy97LyHtE1XyEM0AAAAAo"] ... show less	Web App Attack
🇨🇿 ptlab	2026-07-09 06:45:14 (2 days ago)	Detected xmlrpc_brute attack from WP-host.	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-07-09 04:18:35 (2 days ago)	(mod_security) mod_security (id:211190) triggered by 64.112.57.173 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:211190) triggered by 64.112.57.173 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 09 00:18:16.369399 2026] [security2:error] [pid 28769:tid 28919] [client 64.112.57.173:40771] ModSecurity: Access denied with code 403 (phase 2). Match of "contains cpanel" against "REQUEST_URI" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "55"] [id "211190"] [rev "9"] [msg "COMODO WAF: Remote File Access Attempt\|\|www.adultbaja.com\|F\|2"] [data "Matched Data: /etc/ found within REQUEST_URI: /index.php?option=com_matamko&controller=../../../../../../../../../../etc/passwd%00"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.adultbaja.com"] [uri "/index.php"] [unique_id "ak8hCPppe8hOnADr_KpIhgAAAlY"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 nyt	2026-07-09 03:44:53 (2 days ago)	Sensitive File Probe, Accessing non-existent WordPress signup page.	Web App Attack
🇨🇦 polycoda	2026-07-08 23:43:13 (2 days ago)	🥶 Part of a DDoS attack wave	DDoS Attack
Anonymous	2026-07-08 23:36:27 (2 days ago)	Web Server Enforcement Violation.	Hacking
🇨🇦 polycoda	2026-07-08 21:48:26 (2 days ago)	🥶 Part of massive botnet scraping campaign that nearly turned into a DDoS on 2025-11-27	DDoS Attack
🇱🇺 conseilgouz	2026-07-08 19:31:49 (2 days ago)	are-12 : Block return, carriage return, ... characters=>/de/?view=article&id=79:impressum'& ... show more are-12 : Block return, carriage return, ... characters=>/de/?view=article&id=79:impressum'&catid=10:categorie-de(') show less	Hacking
🇷🇺 OK	2026-07-08 17:06:36 (2 days ago)	HTTP/HTTPS	Hacking Web App Attack

Showing 1 to 15 of 15 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 184.105.247.251

🇩🇪 134.209.228.59

🇮🇹 93.34.83.0

🇳🇱 87.199.197.132

🇺🇸 37.140.223.199

🇰🇷 221.165.184.5

🇺🇸 185.180.141.50

🇺🇸 162.216.149.166

🇭🇰 118.193.47.155

🇧🇩 103.59.176.201

🇳🇱 81.19.216.114

🇩🇪 213.209.159.142

🇵🇪 200.106.49.149

🇺🇸 185.180.141.49

🇨🇳 118.212.120.91

🇫🇷 91.231.89.110

🇨🇦 85.217.149.59

🇺🇸 45.134.142.196

🇬🇧 35.203.210.155

🇭🇰 199.45.154.144