JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

64.227.48.216

Recent Activity

Abuse Confidence Score

100% Critical

26 reports

25 reporters · latest 54 minutes ago

ISP: DigitalOcean, LLC
Usage Type: Data Center/Web Hosting/Transit
ASN: AS14061
Domain Name: digitalocean.com
Country: 🇺🇸 United States of America
City: Santa Clara, California

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Example preview

Account required for the enhanced features Log in Sign up

Abuse Reports

Export reports CSV

Total reports

26 from 25 distinct reporters

First reported

January 10th 2026

Most recent report

54 minutes ago

Last 60 days

Top reporter locations 🇺🇸 United States of America 8 🇩🇪 Germany 6 🇳🇱 Netherlands 3

Most common categories Web App Attack 19 Bad Web Bot 10 Brute-Force 5 Hacking 3 Exploited Host 2

Recent reports We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇷🇴 iulianh	2026-11-14 21:11:21 UTC · (54 minutes ago)	80,443	Brute-Force SSH
🇩🇪 ger-stg-sifi1	2026-11-14 20:00:55 UTC · (2 hours ago)	(wordpress) Failed wordpress login using wp-login.php or xmlrpc.php	Web App Attack
🇩🇪 FeG Deutschland	2026-11-14 19:50:36 UTC · (2 hours ago)	Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 1247	Exploited Host Web App Attack
Anonymous	2026-11-14 19:28:23 UTC · (2 hours ago)	[Sat Nov 14 20:28:22.252798 2026] [authz_core:error] [pid 126792] [client 64.227.48.216:50264] AH01630: client denied by server configuration: /var/www/html/default/ [Sat Nov 14 20:28:22.403883 2026] [authz_core:error] [pid 126792] [client 64.227.48. ... show more [Sat Nov 14 20:28:22.252798 2026] [authz_core:error] [pid 126792] [client 64.227.48.216:50264] AH01630: client denied by server configuration: /var/www/html/default/ [Sat Nov 14 20:28:22.403883 2026] [authz_core:error] [pid 126792] [client 64.227.48.216:50264] AH01630: client denied by server configuration: /var/www/html/default/wp-includes [Sat Nov 14 20:28:22.554849 2026] [authz_core:error] [pid 126792] [client 64.227.48.216:50264] AH01630: client denied by server configuration: /var/www/html/default/xmlrpc.php [Sat Nov 14 20:28:22.705700 2026] [authz_core:error] [pid 126792] [client 64.227.48.216:50264] AH01630: client denied by server configuration: /var/www/html/default/ [Sat Nov 14 20:28:22.856649 2026] [authz_core:error] [pid 126792] [client 64.227.48.216:50264] AH01630: client denied by server configuration: /var/www/html/default/blog ... show less	Web App Attack
🇩🇪 TheSaint	2026-11-14 19:21:31 UTC · (2 hours ago)	PrestaShop Security Module: WordPress probe path detected	Web App Attack
🇵🇱 Budyn	2026-11-14 19:07:38 UTC · (2 hours ago)	[Budyn Honeypot Sinkhole] \| Attack type: WP Path Scanning (Recon) \| Summary: Web scanner triggered an emulated security trap. \| Evidence: \| Host: myspeed.budyn.wtf \| Path: //xmlrpc.php?rsd \| User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Apple ... show more [Budyn Honeypot Sinkhole] \| Attack type: WP Path Scanning (Recon) \| Summary: Web scanner triggered an emulated security trap. \| Evidence: \| Host: myspeed.budyn.wtf \| Path: //xmlrpc.php?rsd \| User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36 \| Request: [Empty / GET Request] show less	Bad Web Bot Web App Attack
🇺🇸 ruusvuu	2026-11-14 19:03:12 UTC · (3 hours ago)	Automated abuse report: 15 attack/probe requests from DigitalOcean, LLC / US. Targeted paths: //wp-includes/wlwmanifest.xml, //xmlrpc.php, //blog/wp-includes/wlwmanifest.xml, //web/wp-includes/wlwmanifest.xml, //wordpress/wp-includes/wlwmanifest.xml. ... show more Automated abuse report: 15 attack/probe requests from DigitalOcean, LLC / US. Targeted paths: //wp-includes/wlwmanifest.xml, //xmlrpc.php, //blog/wp-includes/wlwmanifest.xml, //web/wp-includes/wlwmanifest.xml, //wordpress/wp-includes/wlwmanifest.xml. Sample log lines: [mir-com] [11/14/2026, 12:03:11 PM] GET .mirregistry.com//test/wp-includes/wlwmanifest.xml 404 64.227.48.216 - 3.574 ms [mir-com] [11/14/2026, 12:03:12 PM] GET .mirregistry.com//media/wp-includes/wlwmanifest.xml 404 64.227.48.216 - 3.550 ms [mir-com] [11/14/2026, 12:03:12 PM] GET .mirregistry.com//wp2/wp-includes/wlwmanifest.xml 404 64.227.48.216 - 4.980 ms Detected by an automated web-server log monitor. show less	Web App Attack
🇺🇸 nasset	2026-11-14 16:46:40 UTC · (5 hours ago)	64.227.48.216 - - [14/Nov/2026:08:46:39 -0800] "GET /test/wp-includes/wlwmanifest.xml HTTP/1.1" 403 647 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36" TLSv1.2 ECDHE-RSA-AES256 ... show more 64.227.48.216 - - [14/Nov/2026:08:46:39 -0800] "GET /test/wp-includes/wlwmanifest.xml HTTP/1.1" 403 647 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36" TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 64.227.48.216 - - [14/Nov/2026:08:46:39 -0800] "GET /media/wp-includes/wlwmanifest.xml HTTP/1.1" 403 647 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36" TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 64.227.48.216 - - [14/Nov/2026:08:46:39 -0800] "GET /wp2/wp-includes/wlwmanifest.xml HTTP/1.1" 403 647 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36" TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 64.227.48.216 - - [14/Nov/2026:08:46:39 -0800] "GET /site/wp-includes/wlwmanifest.xml HTTP/1.1" 403 647 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Saf ... show less	Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-11-14 16:44:01 UTC · (5 hours ago)	(mod_security) mod_security (id:225170) triggered by 64.227.48.216 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 14 11:43:54.729611 2026] [security2:error] [pid 5634:tid 5634] [client 64.227.48.216:52536] Mod ... show more (mod_security) mod_security (id:225170) triggered by 64.227.48.216 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 14 11:43:54.729611 2026] [security2:error] [pid 5634:tid 5634] [client 64.227.48.216:52536] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|www.fritsknuf.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.fritsknuf.com"] [uri "/blog/wp-json/wp/v2/users/"] [unique_id "aviPysoSscBQ_4PPRM13kAAAAAQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 kosada.com	2026-11-14 16:25:22 UTC · (5 hours ago)	Repeated requests for suspicious nonexistent URLs, for example: /website/wp-includes/wlwmanifest.xml (HTTP/1.1 port 443, user agent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36" ... show more Repeated requests for suspicious nonexistent URLs, for example: /website/wp-includes/wlwmanifest.xml (HTTP/1.1 port 443, user agent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36") show less	Web App Attack
🇧🇪 cmbplf	2026-11-14 16:25:03 UTC · (5 hours ago)	2.768 requests with url.path */wp-includes/wlwmanifest.xml 497 requests with url.path //xmlrpc.php	Brute-Force Bad Web Bot
🇩🇪 yitzhaq	2026-11-14 16:23:50 UTC · (5 hours ago)	64.227.48.216 - - [14/Nov/2026:17:23:47 +0100] "GET /wp-includes/wlwmanifest.xml HTTP/1.1" 404 538 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36" 64.227.48.216 - - [14/Nov/202 ... show more 64.227.48.216 - - [14/Nov/2026:17:23:47 +0100] "GET /wp-includes/wlwmanifest.xml HTTP/1.1" 404 538 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36" 64.227.48.216 - - [14/Nov/2026:17:23:47 +0100] "GET /blog/wp-includes/wlwmanifest.xml HTTP/1.1" 404 538 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36" 64.227.48.216 - - [14/Nov/2026:17:23:48 +0100] "GET /web/wp-includes/wlwmanifest.xml HTTP/1.1" 404 538 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36" 64.227.48.216 - - [14/Nov/2026:17:23:48 +0100] "GET /wordpress/wp-includes/wlwmanifest.xml HTTP/1.1" 404 538 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36" 64.227.48.216 - - [14/Nov/2026:17:23:47 +0100] "GET / HTTP/1.1" 200 1498 "-" "Mozilla/5.0 (Window show less	Web App Attack Hacking
🇨🇦 Sakusen	2026-11-14 15:39:19 UTC · (6 hours ago)	Automated web scanning: 11 reqs, 9 paths probed, 9 returned 404; probed: 9 .xml	Bad Web Bot
🇩🇪 mondor.ro	2026-11-14 15:36:18 UTC · (6 hours ago)	Cluster member 148.251.176.225 (DE/Germany/antares.webyouridea.ro) said, DENY 64.227.48.216, Reason:[(manifest) WordPress wlwmanifest.xml Attack 64.227.48.216 (US/United States/-): 10 in the last 3600 secs]; Ports: ; Direction: inout; Trigger: LF_CL ... show more Cluster member 148.251.176.225 (DE/Germany/antares.webyouridea.ro) said, DENY 64.227.48.216, Reason:[(manifest) WordPress wlwmanifest.xml Attack 64.227.48.216 (US/United States/-): 10 in the last 3600 secs]; Ports: ; Direction: inout; Trigger: LF_CLUSTER; Logs: show less	Port Scan
🇺🇸 TPI-Abuse	2026-11-14 15:29:02 UTC · (6 hours ago)	(mod_security) mod_security (id:225170) triggered by 64.227.48.216 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 14 10:28:55.347904 2026] [security2:error] [pid 7881:tid 7881] [client 64.227.48.216:53572] Mod ... show more (mod_security) mod_security (id:225170) triggered by 64.227.48.216 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 14 10:28:55.347904 2026] [security2:error] [pid 7881:tid 7881] [client 64.227.48.216:53572] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|modmove.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "modmove.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "avh-NxduNFsfCQ3QLoe_VAAAABA"] show less	Brute-Force Bad Web Bot Web App Attack

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇻🇳 210.245.30.140

🇩🇪 195.182.16.23

🇮🇷 185.112.150.99

🇳🇴 185.12.59.118

🇹🇭 165.154.51.221

🇫🇮 147.185.133.43

🇬🇧 123.58.207.81

🇺🇸 66.132.159.64

🇯🇲 63.143.93.1

🇰🇷 59.23.3.146

🇺🇦 37.54.120.68

🇺🇸 3.129.187.38

🇳🇱 195.178.110.149

🇺🇸 185.226.196.28

🇺🇸 162.241.235.82

🇸🇪 146.247.242.84

🇰🇷 118.37.214.187

🇺🇦 91.198.249.76

🇬🇧 51.75.170.40

🇳🇱 45.148.10.157