JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

77.111.247.129

Neutral Activity

Abuse confidence score ?

0% Low Risk

167 reports

71 reporters · latest 6 months ago

ISP	Opera Norway AS
Usage Type	Data Center/Web Hosting/Transit
ASN	AS205016
Domain Name	hernlabs.se
Country	🇳🇱 Netherlands
City	Amsterdam, North Holland

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

No reports in the last 60 days

77.111.247.129 has been reported 167 times. The most recent report is from 6 months ago.

The full history is preserved below and remains searchable. A 0% score reflects the absence of recent activity, but this is not a guarantee that earlier reports were invalid. Abuse confidence score decays, naturally, over time, when the abusive activity stops.

IP Abuse Reports for 77.111.247.129

This IP address has been reported a total of 167 times from 71 distinct sources. 77.111.247.129 was first reported on January 26th 2021, and the most recent report was 6 months ago.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇮🇩 David Koswari	2026-03-02 02:02:00 (6 months ago)	REQ_BLOCKED_ACL	DDoS Attack FTP Brute-Force Ping of Death Port Scan Hacking SQL Injection Spoofing Brute-Force Bad Web Bot Exploited Host Web App Attack SSH IoT Targeted
🇮🇳 liveaspankaj	2026-02-13 03:52:22 (7 months ago)	DDoS attack: 251 requests in 5m (GET / or repair.php).	DDoS Attack
🇺🇸 TPI-Abuse	2025-09-18 02:13:40 (1 year ago)	(mod_security) mod_security (id:210730) triggered by 77.111.247.129 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210730) triggered by 77.111.247.129 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 17 22:13:35.822482 2025] [security2:error] [pid 5796:tid 5796] [client 77.111.247.129:22575] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|homenetserv.com\|F\|2"] [data ".dat.backup"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "homenetserv.com"] [uri "/wallet.dat.backup"] [unique_id "aMtqz_d6l9JpOhYlJBfaQgAAABM"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-09-17 18:01:42 (1 year ago)	(mod_security) mod_security (id:210730) triggered by 77.111.247.129 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210730) triggered by 77.111.247.129 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 17 14:01:35.944544 2025] [security2:error] [pid 7270:tid 7270] [client 77.111.247.129:47273] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|monteriggioni.net\|F\|2"] [data ".dat"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "monteriggioni.net"] [uri "/wallet.dat"] [unique_id "aMr3f0QsWGomEeMPEaHUSwAAACA"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-09-17 02:00:07 (1 year ago)	(mod_security) mod_security (id:210730) triggered by 77.111.247.129 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210730) triggered by 77.111.247.129 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 16 21:59:59.722172 2025] [security2:error] [pid 31530:tid 31530] [client 77.111.247.129:52417] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|1derfulwaysrv.com\|F\|2"] [data ".dat.backup"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "1derfulwaysrv.com"] [uri "/wallet.dat.backup"] [unique_id "aMoWH-dxNlfOnmBBrVyMKgAAAAc"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-09-16 06:53:55 (1 year ago)	(mod_security) mod_security (id:210730) triggered by 77.111.247.129 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210730) triggered by 77.111.247.129 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 16 02:53:48.242948 2025] [security2:error] [pid 23307:tid 23315] [client 77.111.247.129:32651] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|expozium.com\|F\|2"] [data ".dat.backup"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expozium.com"] [uri "/wallet.dat.backup"] [unique_id "aMkJfDEpD0t3YfKE-4QTcAAAAUQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-09-13 18:55:50 (1 year ago)	(mod_security) mod_security (id:210730) triggered by 77.111.247.129 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210730) triggered by 77.111.247.129 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 13 14:55:43.215338 2025] [security2:error] [pid 31102:tid 31102] [client 77.111.247.129:33451] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|www.aikomp.net\|F\|2"] [data ".dat.backup"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.aikomp.net"] [uri "/foodworms.htm/wallet.dat.backup"] [unique_id "aMW-LxSQ2u6xYqiqfUATigAAAA8"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 BestFans.com	2025-08-07 06:56:51 (1 year ago)	Credential brute-force attacks on webpage logins	Brute-Force
🇳🇱 MM-bot	2025-06-10 10:45:04 (1 year ago)	URL-probe: HTTP/1.1 GET request on /sites/all/modules/fckeditor/fckeditor/editor/filemanager/connect ... show more URL-probe: HTTP/1.1 GET request on /sites/all/modules/fckeditor/fckeditor/editor/filemanager/connectors/php/connector.php (2025-06-10 12:45:04 UTC+2) show less	Hacking Web App Attack
🇫🇷 IRISIO	2025-06-02 08:23:04 (1 year ago)	scans/SQL injection/spam posts : 6 queries	SQL Injection Web App Attack
Anonymous	2025-06-01 02:05:20 (1 year ago)	77.111.247.129 - - [01/Jun/2025:04:05:19 +0200] "GET /admin/fckeditor/editor/filemanager/connectors/ ... show more 77.111.247.129 - - [01/Jun/2025:04:05:19 +0200] "GET /admin/fckeditor/editor/filemanager/connectors/php/connector.php?Command=GetFoldersAndFiles&Type=File&CurrentFolder=%2F HTTP/1.1" 301 178 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36" show less	Web App Attack
🇩🇪 BestFans.com	2025-05-22 10:01:58 (1 year ago)	Credential brute-force attacks on webpage logins	Brute-Force
🇫🇷 IRISIO	2025-05-09 07:24:29 (1 year ago)	scans/SQL injection/spam posts : 2 queries	SQL Injection Web App Attack
🇯🇵 Valhalla	2025-05-04 16:39:44 (1 year ago)	/sites/all/libraries/fckeditor/editor/filemanager/connectors/php/connector.php?Command=GetFoldersAnd ... show more /sites/all/libraries/fckeditor/editor/filemanager/connectors/php/connector.php?Command=GetFoldersAndFiles&Type=File&CurrentFolder=%2F show less	Hacking Web App Attack
🇺🇸 brantknudson.org	2025-05-04 06:10:32 (1 year ago)	Client attempted attack using request path '/admin/fckeditor/editor/filemanager/connectors/php/conne ... show more Client attempted attack using request path '/admin/fckeditor/editor/filemanager/connectors/php/connector.php' to honeypot. show less	Web App Attack

Showing 1 to 15 of 167 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 189.104.62.4

🇷🇺 185.92.139.39

🇺🇸 172.253.1.24

🇨🇳 124.88.113.33

🇨🇳 117.81.212.152

🇹🇷 109.224.242.249

🇿🇦 102.129.63.34

🇷🇺 94.253.71.99

🇺🇸 66.132.172.37

🇺🇸 50.6.2.155

🇩🇪 213.209.159.84

🇧🇴 190.129.122.12

🇵🇰 182.185.145.246

🇨🇴 181.236.200.131

🇨🇳 175.30.48.206

🇳🇱 165.22.199.197

🇧🇷 138.185.145.132

🇨🇳 121.235.198.121

🇻🇳 103.154.62.14

🇺🇸 47.148.181.190