JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 64.112.57.189

64.112.57.189 was found in our database!

This IP was reported 17 times. Confidence of Abuse is 52%: ?

52%

ISP	Nexus Bytes LLC
Usage Type	Fixed Line ISP
ASN	AS6079
Domain Name	nexusbytes.com
Country	🇺🇸 United States of America
City	Leesburg, Virginia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 64.112.57.189

Whois 64.112.57.189

IP Abuse Reports for 64.112.57.189:

This IP address has been reported a total of 17 times from 8 distinct sources. 64.112.57.189 was first reported on July 8th 2026, and the most recent report was 3 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 conseilgouz	2026-07-14 07:04:50 (3 hours ago)	vee-12 : Block return, carriage return, ... characters=>/component/weblinks/weblink/3-autosur?catid= ... show more vee-12 : Block return, carriage return, ... characters=>/component/weblinks/weblink/3-autosur?catid=12&amp;Itemid=1029'&task=weblink.go(') show less	Hacking
🇩🇪 conseilgouz	2026-07-13 16:08:23 (18 hours ago)	mae-12 : Block return, carriage return, ... characters=>/media/mod_cg_gallery/unitegallery/js/uniteg ... show more mae-12 : Block return, carriage return, ... characters=>/media/mod_cg_gallery/unitegallery/js/unitegallery.min.js?d5ab88='(') show less	Hacking
🇨🇭 chr70	2026-07-13 15:55:00 (18 hours ago)	Scanning for vulnerabilities	Web App Attack
🇮🇹 mgarofano80	2026-07-13 15:42:51 (18 hours ago)		Brute-Force Web App Attack
🇺🇸 Rayulcifer	2026-07-11 18:53:51 (2 days ago)	64.112.57.189 - - [11/Jul/2026:13:53:43 -0500] "GET /.env.production HTTP/2.0" 403 488 "-" "Mozilla/ ... show more 64.112.57.189 - - [11/Jul/2026:13:53:43 -0500] "GET /.env.production HTTP/2.0" 403 488 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36" ... show less	Open Proxy Port Scan Hacking Web App Attack SSH
🇫🇷 conseilgouz	2026-07-11 18:53:04 (2 days ago)	upe-7 : Trying access unauthorized files/dir=>/wp-content/blogs.dir/about.php	Hacking
🇫🇷 conseilgouz	2026-07-10 11:41:06 (3 days ago)	hae-12 : Block return, carriage return, ... characters=>/media/astroid/assets/vendor/gsap/gsap.min.j ... show more hae-12 : Block return, carriage return, ... characters=>/media/astroid/assets/vendor/gsap/gsap.min.js?8465a5='(') show less	Hacking
🇺🇸 ipblock.com	2026-07-09 20:36:00 (4 days ago)	IPBlock protected site ID [4055-d][s=07]. Persistent 404, vulnerability scanner	Hacking Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-09 17:14:16 (4 days ago)	(mod_security) mod_security (id:210492) triggered by 64.112.57.189 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 64.112.57.189 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 09 13:13:59.633754 2026] [security2:error] [pid 12084:tid 12084] [client 64.112.57.189:41145] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "iclog.us"] [uri "/.env.production"] [unique_id "ak_W1_BzFgRad3OfoE5xFgAAABY"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-09 13:14:33 (4 days ago)	(mod_security) mod_security (id:210492) triggered by 64.112.57.189 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 64.112.57.189 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 09 09:14:18.238954 2026] [security2:error] [pid 29396:tid 29396] [client 64.112.57.189:38179] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.mathewsdental.com"] [uri "/.env.prod.local"] [unique_id "ak-eqllYUGr__vpTw4VF9AAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack
🇷🇺 OK	2026-07-09 09:50:23 (5 days ago)	HTTP/HTTPS	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-07-09 08:37:04 (5 days ago)	(mod_security) mod_security (id:212620) triggered by 64.112.57.189 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:212620) triggered by 64.112.57.189 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 09 04:36:49.314007 2026] [security2:error] [pid 17184:tid 17227] [client 64.112.57.189:51809] ModSecurity: Access denied with code 403 (phase 2). Pattern match "<script\\\\b" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/07_XSS_XSS.conf"] [line "65"] [id "212620"] [rev "4"] [msg "COMODO WAF: Cross-site Scripting (XSS) Attack\|\|www.adultbaja.com\|F\|2"] [data "Matched Data: <script found within REQUEST_URI: /chicamain.php?cid=8'\\x22><script>alert(68752)</script>"] [severity "CRITICAL"] [tag "CWAF"] [tag "XSS"] [hostname "www.adultbaja.com"] [uri "/chicaMain.php"] [unique_id "ak9doeXYIxB8v2RRTA_mswAAAQk"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 conseilgouz	2026-07-09 06:34:58 (5 days ago)	ece-12 : Block return, carriage return, ... characters=>/media/mod_menu/js/menu.min.js?5a565f=' ... show more ece-12 : Block return, carriage return, ... characters=>/media/mod_menu/js/menu.min.js?5a565f='(') show less	Hacking
🇺🇸 TPI-Abuse	2026-07-09 05:07:01 (5 days ago)	(mod_security) mod_security (id:212620) triggered by 64.112.57.189 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:212620) triggered by 64.112.57.189 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 09 01:06:13.459693 2026] [security2:error] [pid 28869:tid 28869] [client 64.112.57.189:40947] ModSecurity: Access denied with code 403 (phase 2). Pattern match "<script\\\\b" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/07_XSS_XSS.conf"] [line "65"] [id "212620"] [rev "4"] [msg "COMODO WAF: Cross-site Scripting (XSS) Attack\|\|panierduvillage.com\|F\|2"] [data "Matched Data: <script found within REQUEST_URI: /src/addressbook.php?</script><script>alert(document.domain)</script>"] [severity "CRITICAL"] [tag "CWAF"] [tag "XSS"] [hostname "panierduvillage.com"] [uri "/src/addressbook.php"] [unique_id "ak8sRbPg1CpIMit7k5uJdAAAABg"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-09 01:22:47 (5 days ago)	(mod_security) mod_security (id:210492) triggered by 64.112.57.189 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 64.112.57.189 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 08 21:22:31.579610 2026] [security2:error] [pid 13085:tid 13085] [client 64.112.57.189:45365] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "verenacastle.com"] [uri "/.env.dev"] [unique_id "ak7315UYDcspUWBY-8b5dwAAABU"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 17 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇳🇱 34.158.110.198

🇯🇵 207.56.226.222

🇺🇸 195.184.76.64

🇫🇷 172.71.126.222

🇩🇪 69.5.169.22

🇺🇸 66.132.186.242

🇺🇸 66.132.186.218

🇨🇳 58.255.236.228

🇳🇱 45.148.10.151

🇺🇸 2607:f8b0:4023:1006::12b

🇺🇸 2604:a880:2:d1:0:1:6ab8:1

🇫🇷 2001:41d0:303:3d6a::1

🇳🇱 195.178.110.30

🇲🇽 189.216.141.53

🇷🇺 185.46.47.157

🇧🇩 103.23.205.22

🇺🇸 65.49.20.75

🇹🇿 41.59.70.26

🇲🇽 189.201.193.218

🇵🇱 176.53.159.197