JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 64.112.57.197

64.112.57.197 was found in our database!

This IP was reported 20 times. Confidence of Abuse is 72%: ?

72%

ISP	Nexus Bytes LLC
Usage Type	Fixed Line ISP
ASN	AS6079
Domain Name	nexusbytes.com
Country	🇺🇸 United States of America
City	Leesburg, Virginia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 64.112.57.197

Whois 64.112.57.197

IP Abuse Reports for 64.112.57.197:

This IP address has been reported a total of 20 times from 12 distinct sources. 64.112.57.197 was first reported on July 8th 2026, and the most recent report was 5 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇨🇿 ptlab	2026-07-11 22:45:35 (5 hours ago)	Detected phpmyadmin attack from WP-host.	Hacking Web App Attack
🇫🇷 conseilgouz	2026-07-11 18:58:47 (9 hours ago)	low-Joomla User : try to access forms...	Hacking
🇺🇸 ipblock.com	2026-07-11 18:18:00 (10 hours ago)	IPBlock protected site ID [4055-d][s=02]. Persistent 404, vulnerability scanner	Hacking Bad Web Bot Web App Attack
Anonymous	2026-07-10 16:30:00 (1 day ago)	[10/Jul/2026:19:11:05 +0300] 178369986537.125918 64.112.57.197 46519 148.251.76.218 443 [10/Jul/2026 ... show more [10/Jul/2026:19:11:05 +0300] 178369986537.125918 64.112.57.197 46519 148.251.76.218 443 [10/Jul/2026:19:29:59 +0300] 178370099995.835880 64.112.57.197 35823 148.251.76.218 443 show less	Web App Attack
Anonymous	2026-07-10 14:19:16 (1 day ago)	FIMPRODE WEBFORM SPAM 64.112.57.197 (64.112.57.197)	Web Spam
🇺🇸 ipblock.com	2026-07-10 11:50:00 (1 day ago)	IPBlock protected site ID [4055-d][s=06]. Persistent 404, vulnerability scanner	Hacking Bad Web Bot Web App Attack
🇫🇷 COMAITE	2026-07-10 10:41:58 (1 day ago)	SQL injection attempt from 64.112.57.197.	Web App Attack
🇫🇷 mikekarl	2026-07-10 06:47:16 (1 day ago)	SQL INJECTION ''	SQL Injection
🇺🇸 ipblock.com	2026-07-09 13:47:00 (2 days ago)	IPBlock protected site ID [4055-d][s=02]. Exploit request, vulnerability scanner.	Hacking Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-09 11:09:47 (2 days ago)	(mod_security) mod_security (id:210492) triggered by 64.112.57.197 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 64.112.57.197 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 09 07:09:29.665229 2026] [security2:error] [pid 19112:tid 19112] [client 64.112.57.197:40055] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.albertmassaad.com"] [uri "/.env.prod.local"] [unique_id "ak-BadGEI-QVWWN5ClIcIAAAAAc"] show less	Brute-Force Bad Web Bot Web App Attack
🇷🇺 OK	2026-07-09 10:45:23 (2 days ago)	HTTP/HTTPS	Hacking Web App Attack
🇩🇪 conseilgouz	2026-07-09 06:34:41 (2 days ago)	ece-12 : Block return, carriage return, ... characters=>/media/astroid/assets/vendor/gsap/gsap.min.j ... show more ece-12 : Block return, carriage return, ... characters=>/media/astroid/assets/vendor/gsap/gsap.min.js?db73ed='(') show less	Hacking
🇺🇸 TPI-Abuse	2026-07-09 06:14:44 (2 days ago)	(mod_security) mod_security (id:212620) triggered by 64.112.57.197 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:212620) triggered by 64.112.57.197 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 09 02:14:29.742137 2026] [security2:error] [pid 27341:tid 27418] [client 64.112.57.197:57663] ModSecurity: Access denied with code 403 (phase 2). Pattern match "<script\\\\b" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/07_XSS_XSS.conf"] [line "65"] [id "212620"] [rev "4"] [msg "COMODO WAF: Cross-site Scripting (XSS) Attack\|\|uoexpanse.com\|F\|2"] [data "Matched Data: <script found within REQUEST_URI: /forums/style.php?id=3&lang=en'\\x22><script>alert(68752)</script>&sid=50affb173e0fedf4fd91d6ef2d80a5c4"] [severity "CRITICAL"] [tag "CWAF"] [tag "XSS"] [hostname "uoexpanse.com"] [uri "/forums/style.php"] [unique_id "ak88RcZkqJtdB0QhKm7xlAAAAgs"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-09 05:07:03 (2 days ago)	(mod_security) mod_security (id:211190) triggered by 64.112.57.197 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:211190) triggered by 64.112.57.197 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 09 01:06:14.246192 2026] [security2:error] [pid 26518:tid 26518] [client 64.112.57.197:42521] ModSecurity: Access denied with code 403 (phase 2). Match of "contains cpanel" against "REQUEST_URI" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "55"] [id "211190"] [rev "9"] [msg "COMODO WAF: Remote File Access Attempt\|\|panierduvillage.com\|F\|2"] [data "Matched Data: /etc/ found within REQUEST_URI: /index.php?option=com_addressbook&controller=../../../../../../../../../../etc/passwd%00"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "panierduvillage.com"] [uri "/index.php"] [unique_id "ak8sRj02yTuXONswpMsblgAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 Starburst SysOp Team	2026-07-09 02:22:42 (3 days ago)	(mod_security-custom) mod_security (id:212620) triggered by 64.112.57.197 (US/United States/New Jers ... show more (mod_security-custom) mod_security (id:212620) triggered by 64.112.57.197 (US/United States/New Jersey/Piscataway/-/[AS6079 RCN-AS]): 1 in the last 3600 secs (0-srv1) show less	Hacking

Showing 1 to 15 of 20 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇩🇪 140.248.75.112

🇱🇹 81.30.98.144

🇫🇷 2a02:c207:2316:8839::1

🇲🇱 197.155.176.35

🇧🇷 179.191.82.115

🇵🇪 131.255.137.210

🇮🇩 103.3.220.218

🇺🇸 45.79.115.59

🇺🇸 20.64.105.248

🇭🇰 165.154.43.179

🇺🇦 146.120.227.179

🇮🇷 37.255.220.246

🇫🇮 147.185.133.50

🇺🇸 147.185.132.58

🇰🇷 124.146.44.248

🇨🇳 101.42.1.32

🇳🇱 81.19.216.108

🇺🇸 20.65.193.1

🇩🇪 216.26.246.30

🇳🇱 204.76.203.80