JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 77.221.3.34

77.221.3.34 was found in our database!

This IP was reported 29 times. Confidence of Abuse is 80%: ?

80%

ISP	Monet CIP d.o.o.
Usage Type	Fixed Line ISP
ASN	AS42560
Hostname(s)	b2b-77-221-3-34.static.telemach.ba
Domain Name	telemach.ba
Country	🇧🇦 Bosnia and Herzegovina
City	Sarajevo, Federation of B&H

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 77.221.3.34

Whois 77.221.3.34

IP Abuse Reports for 77.221.3.34:

This IP address has been reported a total of 29 times from 20 distinct sources. 77.221.3.34 was first reported on March 4th 2026, and the most recent report was 1 day ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 FeG Deutschland	2026-09-18 00:45:13 (1 day ago)	Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 27	Exploited Host Web App Attack
🇺🇸 TPI-Abuse	2026-09-17 12:22:20 (1 day ago)	(mod_security) mod_security (id:225170) triggered by 77.221.3.34 (b2b-77-221-3-34.static.telemach.ba ... show more (mod_security) mod_security (id:225170) triggered by 77.221.3.34 (b2b-77-221-3-34.static.telemach.ba): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Sep 17 08:22:14.209138 2026] [security2:error] [pid 19797:tid 19897] [client 77.221.3.34:32806] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|grupojdg.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "grupojdg.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aqvbdoRAUmLGYW3tQDEuAAAAABE"] show less	Brute-Force Bad Web Bot Web App Attack
🇹🇷 oalver	2026-09-17 11:11:10 (1 day ago)	Detected by SiberKapan threat intelligence platform (siberkapan.org). Attack types: nginx_path_signa ... show more Detected by SiberKapan threat intelligence platform (siberkapan.org). Attack types: nginx_path_signature. Sources: nginx. Details: path_signature: request to /wp-login.php (HTTP 200). First seen: 2026-09-15. Risk score: 30/100. show less	Web App Attack
🇺🇸 cwytech	2026-09-17 00:38:48 (2 days ago)	Fleet-wide ban from the Ghostfleet 👻. Triggered by scenario: cwy/wp-us-login-only-high.	Bad Web Bot Web App Attack
🇺🇸 nationaleventpros.com	2026-09-16 21:16:33 (2 days ago)	WordPress login attempt	Brute-Force
🇲🇽 octageeks.com	2026-09-16 04:16:47 (3 days ago)	Wordpress malicious attack:[octawp]	Web App Attack
🇫🇷 ELYAZ	2026-09-15 10:54:16 (3 days ago)	(wordpress) Failed wordpress login from 77.221.3.34 (BA/Bosnia and Herzegovina/b2b-77-221-3-34.stati ... show more (wordpress) Failed wordpress login from 77.221.3.34 (BA/Bosnia and Herzegovina/b2b-77-221-3-34.static.telemach.ba): (CF_ENABLE) show less	Brute-Force
🇬🇪 ORDUNET	2026-09-15 10:24:07 (3 days ago)	Botnet UDP flood (DDoS) against a hosted game server at 185.143.177.x:8888/udp in AS203136 (LLC Ordu ... show more Botnet UDP flood (DDoS) against a hosted game server at 185.143.177.x:8888/udp in AS203136 (LLC Ordunet), Georgia, on 2026-09-15 from 14:17 local time (+04:00). This source sustained more than 800 packets/sec toward a single UDP port, against about 200 packets/sec for a legitimate player of that server. It was one of 8847 sources in 2396 networks and 160 countries recorded inside a single 25-minute window - the server's entire real audience is about a hundred players. Detected on a MikroTik RouterOS router in the raw/prerouting chain (dst-limit 800,200,src-address/10s); the timestamp is when this source crossed the threshold. Not a scan and not brute force - a packet flood, so the host is most likely compromised. Evidence: [email protected]. show less	DDoS Attack Exploited Host
🇺🇸 nationaleventpros.com	2026-09-15 07:33:55 (3 days ago)	WordPress login attempt	Brute-Force
🇩🇪 FeG Deutschland	2026-09-15 01:14:37 (4 days ago)	Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 257	Exploited Host Web App Attack
🇲🇽 octageeks.com	2026-09-13 04:12:12 (6 days ago)	Wordpress malicious attack:[octaflood]	Web App Attack
🇩🇪 FeG Deutschland	2026-09-12 12:19:19 (6 days ago)	Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 257	Exploited Host Web App Attack
🇩🇪 LRob	2026-09-11 02:33:40 (1 week ago)	Malicious web request: probing for secrets, traversal or a known exploit path \| method: GET \| path: ... show more Malicious web request: probing for secrets, traversal or a known exploit path \| method: GET \| path: /wp-json/wp/v2/users \| query: _fields=slug&per_page=100&page=1 \| ua: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 \| 2026-09-11 02:33 UTC show less	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-09-10 22:53:57 (1 week ago)	(mod_security) mod_security (id:225170) triggered by 77.221.3.34 (b2b-77-221-3-34.static.telemach.ba ... show more (mod_security) mod_security (id:225170) triggered by 77.221.3.34 (b2b-77-221-3-34.static.telemach.ba): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Sep 10 18:53:53.072885 2026] [security2:error] [pid 4883:tid 4883] [client 77.221.3.34:38084] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|edgecomix.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "edgecomix.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aqM1AfV4YOaGgTU4xrCNdQAAAAc"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 LRob	2026-09-10 21:38:11 (1 week ago)	Asking over plain http and never following the redirect served — a crawler that reads nothing it ask ... show more Asking over plain http and never following the redirect served — a crawler that reads nothing it asks for \| method: GET \| path: / \| 2026-09-10 21:38 UTC show less	Bad Web Bot

Showing 1 to 15 of 29 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇧🇷 200.180.211.214

🇨🇳 139.170.141.170

🇨🇳 115.190.213.72

🇮🇳 103.248.120.6

🇺🇸 70.169.11.216

🇳🇱 45.148.10.240

🇺🇸 40.124.186.184

🇧🇪 34.79.40.62

🇩🇪 2a01:7e01::2000:c2ff:fea5:6058

🇸🇳 213.154.77.61

🇺🇬 196.0.34.106

🇨🇴 190.67.232.220

🇸🇪 171.25.158.82

🇩🇪 165.154.138.34

🇮🇩 128.14.233.38

🇮🇳 117.247.193.27

🇧🇩 103.152.105.209

🇮🇳 103.149.197.34

🇫🇷 85.217.140.12

🇬🇷 83.235.21.125